{
"canonical_url": "github.com/features/copilot",
"category": "Coding agent",
"commercial": true,
"compliance": [
{
"certificate_id": "github, inc.",
"covers_resource": "unknown",
"credited": false,
"detail": {
"note": "From the STAR Registry index card; STAR Level 1 is a self-assessment (CAIQ), Level 2 a third-party certification or attestation.",
"organization": "GitHub, Inc.",
"terms": [
"star_level_1",
"star_level_2",
"caiq",
"certification"
]
},
"display": "STAR Level 2: found in CSA STAR Registry on 2026-10-26",
"evidence_url": "https://cloudsecurityalliance.org/star/registry/github, inc.",
"framework": "csa_star",
"issued": "2018-05-30",
"issuer": "Cloud Security Alliance",
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "51c7c3cba565bd44fb1a057b2b3d9312894a56c98eab49f361756b0b3c868a15",
"period_end": null,
"retrieved_at": "2026-10-26T12:25:32Z",
"review_reason": "entity 1.00 (index card)",
"reviewer": null,
"scope": "entity",
"source": "csa_star",
"status": "active",
"tier": 1,
"valid_until": null,
"variant": "STAR_LEVEL_2"
},
{
"certificate_id": "FR1812058188",
"covers_resource": "partial",
"credited": false,
"detail": {
"cso": "GitHub Enterprise Cloud",
"csp": "GitHub",
"deployment_model": "Public Cloud",
"fedramp_status": "FedRAMP Authorized",
"impact_level": "LI-SaaS"
},
"display": "FedRAMP LI-SaaS: FedRAMP Authorized (FedRAMP Marketplace, 2026-10-26)",
"evidence_url": "https://marketplace.fedramp.gov/products/FR1812058188",
"framework": "fedramp",
"issued": "2018-10-04",
"issuer": "Agency / 3PAO Coalfire Systems, Inc.",
"match_confidence": 0.933,
"next_check": "2026-11-02",
"payload_hash": "64bc98d4cebbc137a6e7b94442b8678790eefa29e4347928a0de8620b56a168a",
"period_end": null,
"retrieved_at": "2026-10-26T12:24:25Z",
"review_reason": "entity 1.00, offering 0.85",
"reviewer": null,
"scope": "product",
"source": "fedramp",
"status": "active",
"tier": 1,
"valid_until": null,
"variant": "FEDRAMP_LI_SAAS"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": false,
"detail": {
"pages_visited": 6
},
"display": "Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://github.com/security",
"framework": "gdpr",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "d5170ae8744fe6f60f0a1d2eb1f0a3b7eb05bad69b6bd7b4c6aa5039d4872a75",
"period_end": null,
"retrieved_at": "2026-10-26T12:29:39Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": false,
"detail": {
"pages_visited": 6
},
"display": "Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://github.com/security",
"framework": "soc2",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "d5170ae8744fe6f60f0a1d2eb1f0a3b7eb05bad69b6bd7b4c6aa5039d4872a75",
"period_end": null,
"retrieved_at": "2026-10-26T12:29:39Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
}
],
"deployment": "GitHub; VS Code; GitHub",
"description": "Deeply integrated coding agent across GitHub workflows and developer tooling.",
"disclaimer": "Reference implementation by Hemant Naik. Compliance information is compiled from the sources shown as of the date shown. It is not an assessment, certification, legal opinion or recommendation. Confirm current status with the vendor and the issuing body.",
"domains": {
"business": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "general",
"rank": 1,
"recomputed": 96.9,
"score": 87.3,
"score_version": "sar-score-2.0",
"seed_rank": 1,
"seed_score": 96.9,
"source": "seed_xlsx",
"unknown": []
},
"cybersecurity": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "security",
"rank": 9,
"recomputed": 84.8,
"score": 82.0,
"score_version": "sar-score-2.0",
"seed_rank": 9,
"seed_score": 84.8,
"source": "seed_xlsx",
"unknown": []
},
"data": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "data",
"rank": 15,
"recomputed": 90.2,
"score": 93.6,
"score_version": "sar-score-2.0",
"seed_rank": 15,
"seed_score": 90.2,
"source": "seed_xlsx",
"unknown": []
},
"finance": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "regulated",
"rank": 30,
"recomputed": 78.8,
"score": 77.0,
"score_version": "sar-score-2.0",
"seed_rank": 30,
"seed_score": 78.8,
"source": "seed_xlsx",
"unknown": []
},
"government": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "regulated",
"rank": 5,
"recomputed": 96.5,
"score": 77.0,
"score_version": "sar-score-2.0",
"seed_rank": 5,
"seed_score": 96.5,
"source": "seed_xlsx",
"unknown": []
},
"healthcare": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "regulated",
"rank": 21,
"recomputed": 78.8,
"score": 77.0,
"score_version": "sar-score-2.0",
"seed_rank": 21,
"seed_score": 78.8,
"source": "seed_xlsx",
"unknown": []
},
"insurance": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "regulated",
"rank": 15,
"recomputed": 78.8,
"score": 77.0,
"score_version": "sar-score-2.0",
"seed_rank": 15,
"seed_score": 78.8,
"source": "seed_xlsx",
"unknown": []
},
"legal": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "regulated",
"rank": 15,
"recomputed": 78.8,
"score": 77.0,
"score_version": "sar-score-2.0",
"seed_rank": 15,
"seed_score": 78.8,
"source": "seed_xlsx",
"unknown": []
},
"regulatory": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "regulated",
"rank": 28,
"recomputed": 78.8,
"score": 77.0,
"score_version": "sar-score-2.0",
"seed_rank": 28,
"seed_score": 78.8,
"source": "seed_xlsx",
"unknown": []
},
"sales": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "commercial",
"rank": 12,
"recomputed": 87.5,
"score": 88.6,
"score_version": "sar-score-2.0",
"seed_rank": 12,
"seed_score": 87.5,
"source": "seed_xlsx",
"unknown": []
},
"supply_chain": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "operations",
"rank": 9,
"recomputed": 84.2,
"score": 88.6,
"score_version": "sar-score-2.0",
"seed_rank": 9,
"seed_score": 84.2,
"source": "seed_xlsx",
"unknown": []
},
"technology": {
"components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 0.0,
"health": 20.0,
"trust": 17.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {},
"profile": "technology",
"rank": 1,
"recomputed": 100.0,
"score": 93.6,
"score_version": "sar-score-2.0",
"seed_rank": 1,
"seed_score": 100.0,
"source": "seed_xlsx",
"unknown": []
}
},
"external_ids": {},
"first_seen": "2026-10-26T12:11:40Z",
"governance": {
"certification_disclaimer": true,
"claims": [],
"evidence_urls": []
},
"id": "res_f80a0e1295d21843",
"identity": {
"evidence": [
"publisher_domain_matches_vendor"
],
"rules_version": "identity-1.1",
"tier": 3
},
"issues": {
"advisories": 0,
"cves": 0,
"incidents": 0,
"links": [],
"regulator_actions": 0,
"withdrawn_certificates": 0
},
"last_seen": "2026-10-26T12:11:40Z",
"license": "Proprietary",
"name": "GitHub Copilot coding agent",
"news": [],
"news_checked": true,
"protocols": {
"a2a": {
"not_checked": "code_host",
"status": "unknown"
},
"ard": {
"not_checked": "code_host",
"status": "unknown"
},
"mcp": {
"checked_by": "hemant.naik",
"checked_on": "2026-10-02",
"evidence_url": "https://docs.github.com/en/copilot/how-tos/use-copilot-agents/coding-agent/extend-coding-agent-with-mcp",
"note": "\"Configure MCP servers for your repository\" (GitHub Docs)",
"source": "curated_claim",
"status": "claimed"
}
},
"publisher_domain": "github.com",
"resource_type": "agent",
"scope": "public",
"security": {
"advisories": 0,
"checked_at": "2026-10-26T12:31:27Z",
"cves": 0,
"source": "nvd",
"tier": 1
},
"seed": {
"last_verified": "2026-09-25",
"snapshot_date": "2026-09-25"
},
"seed_components": {
"adoption": 30.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 45.0,
"health": 20.0,
"trust": 25.0
},
"signals": {
"observed_popularity": "Commercial"
},
"slug": "github-microsoft-github-copilot-coding-agent",
"sources": [
{
"payload_hash": "eed24d4e9b6459846936ea478d1f7d4ea47522b6df41a59f0062ed6be6ab72de",
"retrieved_at": "2026-10-26T12:11:40Z",
"system": "seed_xlsx",
"url": "https://github.com/features/copilot"
}
],
"tags": [],
"tenant": null,
"traces": [
{
"checked_on": null,
"date": "2025-10-08",
"format": "report",
"id": "tr_camoleak_copilot_chat_2025",
"kind": "red_team",
"notes": "Copilot Chat, a sibling of the Copilot coding agent on the same platform",
"observed": {
"actions": [
"read the hidden comment as instructions",
"searched private repositories the victim could access",
"rendered pre-signed Camo image URLs that encoded the data"
],
"approval": false,
"egress": true,
"entry": "indirect prompt injection via a hidden PR comment",
"outcome": "Private source and secrets exfiltrated; GitHub disabled image rendering in Copilot Chat",
"refused": false,
"secrets_touched": true
},
"reviewer": null,
"scenario": "An invisible comment in a pull request instructs Copilot Chat to encode private repository content as a sequence of image requests through GitHub's Camo proxy",
"scope": "platform",
"source": "Legit Security",
"tier": 3,
"title": "CamoLeak: hidden pull-request comment makes Copilot Chat leak private source via GitHub's image proxy (CVSS 9.6)",
"url": "https://legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code",
"vendor_response": "GitHub mitigation (image rendering disabled in Copilot Chat), August 2025"
}
],
"trust": {
"compliance": 1,
"identity": 3,
"issues": 1,
"protocols": 3,
"security": 1,
"traces": 3,
"vendor_compliance": 1
},
"url": "https://github.com/features/copilot",
"vendor": "GitHub / Microsoft"
}