GitHub Copilot

The GitHub connector brings the Copilot coding agent into MITRITY. It discovers the agent across an organization's repositories, imports its activity as MITRITY audit events and reads org-level security posture. It works through a GitHub App: the MITRITY GitHub App, which you install in one click, or a read-only App that you create yourself. It never writes to your organization.

For the connector model, read SaaS-Embedded Agent Governance first. This page covers what is specific to GitHub.

What it discovers

• The organization's Copilot deployment, as a single governed agent.
• Copilot coding agents per repository, detected through the copilot_coding_agent repository custom property. GitHub does not expose a dedicated "agents" API, so the connector keys off the property that GitHub sets when the coding agent is enabled on a repo.

Each discovered agent arrives with state discovered under Agents → Needs review, with a link back to the repository or organization on GitHub.

Requirements

Connect with the MITRITY GitHub App

This is the default path. MITRITY holds the App's key, so there is no key for you to create or store, and GitHub sends the Copilot coding agent's activity to MITRITY as it happens.

1. In MITRITY, go to Settings → Platforms → Connect a platform and choose GitHub.
2. Select Install GitHub App. MITRITY sends you to GitHub's install page for the MITRITY GitHub App, with a link signed for your MITRITY organization. Finish the install within 15 minutes, before the link expires.
3. On GitHub, choose your organization and the repositories, all or a selected set, and install. GitHub lists the permissions the App asks for before you confirm.
4. GitHub returns you to Settings → Platforms, where the connection appears with the message "GitHub connected — discovering agents." Select Sync now to run the first sync right away, or wait for the scheduled one.

The connection stores the installation's ID and no secret. At sync time, the connector mints a short-lived installation token with the MITRITY App's key.

If you are not an owner of the organization, GitHub sends your install to the owners as a request, and MITRITY shows "Install requested — awaiting your GitHub organization admin's approval." No connection exists yet. Once an owner approves the request, select Install GitHub App again to create it.

Activity by webhook

With the MITRITY GitHub App, GitHub also sends MITRITY the push and pull_request events of the repositories you installed it on, as they happen. MITRITY keeps the ones that the Copilot coding agent sent, and records each as an observed github.push or github.pull_request event for the organization's Copilot agent. It records nothing until a sync has discovered that agent and you have governed it, the same rule that Observe follows. Events from other senders are ignored.

Connect with your own App

Use this path to hold the App and its key yourself. A connection through your own App is polled on the schedule and receives no webhooks.

Step 1 — Create a read-only GitHub App

1. In GitHub, go to Organization Settings → Developer settings → GitHub Apps → New GitHub App.
2. Name it (e.g. mitrity-governance) and set any homepage URL. Leave the webhook inactive: MITRITY receives webhooks only from the MITRITY GitHub App.
3. Grant read-only permissions only. The connector needs to read organization and repository metadata, custom properties and, for Observe, the organization audit log. Do not grant any write permission.
4. Restrict installation to this organization only.
5. Create the App, then generate a private key. GitHub downloads a .pem file. This is the secret that MITRITY stores, encrypted, so keep it safe.
6. Note the App ID shown on the App's settings page.

Step 2 — Install the App on your organization

1. From the App's page, click Install App and install it on your organization, on all repositories or a selected set.
2. After you install it, the URL contains the Installation ID (.../installations/<id>). Note it.

Step 3 — Connect in MITRITY

In Settings → Platforms → Connect a platform, choose GitHub, select Advanced: connect with your own App credentials, and provide:

Save, then click Sync now. At sync time, the connector mints a short-lived installation token from your App key. The long-lived key never leaves the encrypted store. Then the connector runs Discover → Observe → Posture.

Observe requires GitHub Enterprise Cloud

The organization audit-log API is the connector's richest Observe source for Copilot activity. It is available only on GitHub Enterprise Cloud.

Observe imports events only for agents you have governed: a discovered agent gets Discover and Posture only.

On a non-Enterprise organization, the connector still runs. It discovers agents and reads posture, and the scheduled Observe imports no audit events instead of failing with an error. A connection made with the MITRITY GitHub App still records the coding agent's pushes and pull requests by webhook. If you expect Copilot activity in your MITRITY audit log and see none, confirm that the agent is governed and that the org is on Enterprise Cloud.

Imported events carry source = github and are marked as observed: recorded, not gated. They flow to the audit log and Insights. Unlike runtime events, they are not forwarded to SIEM destinations.

Posture

The connector reads what GitHub exposes about the org's Copilot and security configuration, and records findings (OK / Warning / Unknown).

Some controls cannot be read directly through the App's permissions. For those, the connector records a proxy finding from what is readable (workflow-run metadata, repository properties) and marks it Unknown rather than asserting OK. A visibility gap is never reported as a pass. See Posture & Security.

Governing a discovered agent

Once agents appear under Needs review, assign a policy to move one to governed, or suppress it. Assigning a policy sets the agent's governance mode to Constrained, which means governed out-of-band. GitHub-embedded agents are not enforced in-band: see read-only by design.

Related documentation

• SaaS-Embedded Agent Governance
• Posture & Security
• Writing Policies
• SIEM Integration