GitHub Copilot

Add an Anyray model to VS Code Chat, route the standalone copilot CLI through the gateway, and import native usage on Business/Enterprise.

Coverage

Lane	Setup	What Anyray covers
Copilot subscription	Enroll, then run Connect with --subscription. Installs the Anyray extension; stores your key in VS Code SecretStorage and registers retrieval in each user profile's mcp.json.	Pick an Anyray · … model to optimize chat before Copilot runs it. Agent mode can call anyray_retrieve / anyray_recall; GitHub still serves and bills the request. Business/Enterprise usage imports via the GitHub connector; Individual doesn't.
Gateway API key	Run Connect without --subscription. Configures the same extension for the gateway and registers the retrieval MCP.	Anyray chat models route text through the gateway for optimization and spend attribution. They remain text-only: Chat Completions cannot faithfully carry VS Code's Prompt-TSX, opaque, image/document, or mixed-message tool results, so the extension does not advertise tool calling.
Copilot CLI (seat)	Runs in the default Connect sweep whenever a Copilot sign-in is readable on the machine (COPILOT_GITHUB_TOKEN, the CLI's own /login, the shared ~/.config/github-copilot dir, or an OpenCode github-copilot login). Writes COPILOT_PROVIDER_* env into your shell profile, pointed at the gateway's Copilot carrier route.	Every copilot CLI request routes through the gateway and is optimized, traced, and attributed — and GitHub still bills it to your Copilot plan: the gateway forwards your own seat token to the Copilot API.
Copilot CLI (org BYOK)	Run Connect with --org (or with no Copilot seat on the machine). Same env block, pointed at the gateway's /v1 lane with your ark_… key.	Same routing/optimization coverage, but GitHub BYOK replaces subscription inference: requests bill as org API usage, not against a Copilot seat.
Native Copilot	No client change. Business/Enterprise admins enable the GitHub connector under Settings → Providers.	Imports content-free usage only. Native chat and inline completions aren't routed or optimized. Not available for Individual.

No proxy, certificate, DNS, or endpoint changes — native Copilot is untouched.

Connect VS Code

Business/Enterprise: allow language-model providers first

On Copilot Business and Enterprise, a GitHub org policy gates third-party language-model providers in Copilot Chat. An org admin must allow it (GitHub org settings → Copilot → policies → the bring-your-own-key / language-model-provider policy) before developers run Connect — otherwise the Anyray models install but never appear in the picker. Individual plans have no such gate. Fleet rollouts should flip this policy before the bulk apply.

1

Check your VS Code version

The Anyray model provider needs VS Code 1.121+. Upgrade older installs first — native Copilot keeps working meanwhile.

2

Enroll and run Connect

Enroll with the link from your admin, then run Connect. It reuses your local ark_… key on later runs and won't change VS Code without a valid key.

curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --enroll https://app.anyray.ai/enroll/enl_… --tools copilot
# After enrollment (or with ANYRAY_CLIENT_KEY set):
npx anyray-connect --gateway https://gateway.example.com --tools copilot
# Add --subscription to use the signed-in Copilot seat.

Subscription mode keeps your GitHub sign-in; API-key mode uses the gateway's provider key. Your key lives in SecretStorage, never in workspace settings.

3

Pick an Anyray model

Reload VS Code if Connect asks you to, open Chat's model picker, and select an Anyray · … model for the requests you want optimized. In agent mode, open Select Tools and ensure the Anyray MCP tools are enabled. Connect writes the native profile-scoped mcp.json entry only from a durable install; a temporary npx runtime is skipped so VS Code is never left with a dead command.

You must pick the model

VS Code lets an extension add a model, not replace Copilot's. Only requests you send to an Anyray model are optimized. In subscription mode the gateway records no inference spend (Copilot runs the request) — use the GitHub connector (Native Copilot lane above) for Business/Enterprise visibility.

Remote-SSH, Dev Containers, and Codespaces

When VS Code attaches to a remote machine over Remote-SSH, a dev container, or a Codespace, Copilot Chat and its extension host run on the remote side — so the Anyray provider, your key, and the model picker all live there, not on your laptop. Configure the window that actually renders Chat:

• Open the machine with the Remote-SSH (or Dev Containers) extension and let VS Code install its server.

• Run Connect from that window's integrated terminal, not a local shell:

  npx anyray-connect --enroll https://app.anyray.ai/enroll/enl_… --tools copilot

  Connect detects the VS Code server on the remote host, installs the Anyray extension into the remote extension host, and hands your key to its SecretStorage over the same filesystem.

• Needs the Anyray extension 0.1.17+, which runs in the remote (workspace) extension host — the same one as Copilot Chat, which is the only host that can see the models it re-labels. If Connect asks for a reload, reload the remote window and pick the Anyray · … model again.

• Use a current Connect. Earlier releases had no remote-host awareness and deliberately refused to configure anything from a remote shell, steering you back to the machine that owns the VS Code window. npx anyray-connect@latest (or re-run the install command) picks up the remote support.

• The VS Code 1.121+ requirement applies to the server on the remote host, not your laptop. Check it in that window's terminal with code --version; an older server installs the extension but never shows the models.

• The gateway URL must be reachable from the remote host — HTTPS, or http on loopback. A deployed gateway just works; a gateway running only on your laptop needs an SSH tunnel to the remote (ssh -R), or point Connect at the deployed one.

• The retrieval MCP tools (anyray_retrieve / anyray_recall) register on the remote side too — Connect writes the server's own mcp.json, not your laptop's — so agent mode can call them from the remote window. Open Select Tools and enable the Anyray MCP tools.

Running Connect in a local terminal only configures your laptop's VS Code, so the models never appear in the remote window — the usual reason "Anyray models aren't visible over Remote-SSH." On extensions before 0.1.17 they could show up for the first moments after the window opened and then vanish, because the laptop's copy of the provider lost sight of Copilot Chat once the remote host took it over. Same cause, same fix: configure the window that renders Chat.

Connect the Copilot CLI

The standalone copilot CLI (@github/copilot) is a different product from the VS Code extension. Its route to a gateway is GitHub's BYOK contract, which is env-only — there is no config-file equivalent. Connect points that contract at one of two gateway lanes:

• Seat lane (default). The BYOK "provider" is the gateway's Copilot carrier route (/v1/copilot/default/header), and the BYOK key is your own Copilot sign-in token — the gateway forwards it to GitHub's Copilot API, so billing stays on your Copilot plan while requests are optimized, traced, and attributed. Because nothing about billing changes, the default sweep configures this lane on its own whenever it can read a Copilot sign-in: COPILOT_GITHUB_TOKEN, the shared ~/.config/github-copilot credential dir, an OpenCode github-copilot login, or (on an explicit --tools copilot-cli run) the macOS Keychain item the CLI's /login creates.
• Org lane (--org). The BYOK provider is the gateway's /v1 lane with your ark_… key: requests bill as org API usage and stop consuming Copilot premium requests. Connect selects it under the global --org decision, or when no Copilot seat exists on the machine. A machine that configured this lane stays on it across re-applies — Connect never flips a recorded lane choice by itself.

A seat with no readable sign-in holds

If Connect detects a Copilot seat but can't read any sign-in token, it leaves the CLI on native GitHub inference and prints how to enable the seat lane — it never falls back to org billing on its own. That hold is a supported end state, not an unfinished setup: doctor reports the CLI as not applicable rather than as a routing failure, and it doesn't count toward the problem exit code, --repair, or fleet connect-health.

1

Run Connect

npx anyray-connect
# or, to also allow the macOS Keychain sign-in read:
npx anyray-connect --tools copilot-cli

Connect writes a managed copilot-cli block into your shell profile (~/.zshrc, ~/.bashrc, or ~/.profile) with COPILOT_PROVIDER_TYPE, COPILOT_PROVIDER_BASE_URL, COPILOT_PROVIDER_WIRE_API, COPILOT_MODEL, and the content-free x-anyray-metadata attribution header, and registers the Anyray retrieval MCP server (anyray_retrieve / anyray_recall) in ~/.copilot/mcp-config.json — the recovery path that lets the optimizer's externalize trims stay lossless on this lane. Secrets are not written into the profile — the seat token (and, off the local key-refresh daemon, your ark_… key) go in ~/.anyray/copilot-cli.sh at mode 0600, which the block sources.

2

Reload your shell

Run source ~/.zshrc (or open a new terminal). A copilot session started before the change keeps its old env until you restart it.

VS Code hosts the CLI in-process — restart it

VS Code's Copilot CLI surfaces (the CLI chat view and its Autopilot worktree runs) never launch the copilot binary: the bundled Copilot Chat extension loads the CLI SDK inside its extension host. That host resolves your login shell's environment once, when the editor starts — so an editor that was already open when Connect wrote the block never sees it, and those sessions keep talking straight to GitHub with no spend and no traces. Nothing in the transcript says so; the missing rows are the only symptom. Quit VS Code fully and reopen it. Connect prints this same reminder when it applies the block while VS Code is running.

Verify

Send one request from the CLI, then open Console → Traces and filter tool:copilot-cli — on the seat lane the trace shows subscription-covered billing. npx anyray-connect status also lists the CLI once its block points at your gateway.

Choosing the model

COPILOT_MODEL only sets the CLI's startup default — the /model picker and the --model flag still switch models live, and the chosen id goes to the wire. On the seat lane the upstream is GitHub's Copilot API itself, so every id the picker offers resolves; on the org lane the id must be one your gateway routes.

The default differs per lane. The org lane uses anyray-default, the gateway's routing sentinel — the gateway resolves your org's default model, so the CLI follows routing changes with no client edit. The seat lane forwards verbatim to GitHub's Copilot API, where the sentinel does not resolve, so it defaults to a real Copilot model id (claude-opus-4.5). Pin either lane's default with ANYRAY_COPILOT_MODEL (shared with the VS Code lane; the CLI takes the first id, since COPILOT_MODEL names one model rather than a picker list):

ANYRAY_COPILOT_MODEL=gpt-5-codex npx anyray-connect --tools copilot-cli

Windows

Managed profile blocks are POSIX shell. On Windows, Connect prints the equivalent commands instead of writing anything — setx on the org lane, PowerShell [Environment]::SetEnvironmentVariable on the seat lane (its headers value is multi-line, which setx can't carry) — run them, then restart your terminal. Secrets print masked: substitute the seat token from the source Connect names, and the gateway key from npx anyray-connect print-key.

Reverting, and shells that are already open

npx anyray-connect --tools copilot-cli --revert removes the managed block and deletes ~/.anyray/copilot-cli.sh. A shell that already sourced the block keeps the exported variables, so the CLI stays on BYOK in that shell until you unset them or open a new terminal — Connect names the exact variables in its output. Inline completions and GitHub-hosted features were never routed and are unaffected.

Zero-touch fleets

On MDM-provisioned machines with a fleet bootstrap file, an installed-but-unconfigured extension shows a sign-in notification (verification code plus an Open sign-in action) instead of staying silent, and configures itself automatically once the device-grant enrollment completes — no reload, no manual anyray-connect run. The notification carries only the sign-in URL and code, never a credential.

Revert

npx anyray-connect --tools copilot --revert

Clears the extension settings and SecretStorage key, removes stale Anyray endpoint entries, then fully restart VS Code.