GitHub Copilot
Add an Anyray model to VS Code Chat, route the standalone copilot CLI through the gateway, and
import native usage on Business or Enterprise.
Nothing here changes a proxy, certificate, DNS record, or endpoint. Native Copilot keeps working untouched, and only requests you send to an Anyray model are optimized.
VS Code and the CLI are separate products with separate setups. Do the one you use, or both.
VS Code
A GitHub org policy gates third-party language-model providers in Copilot Chat, under GitHub org settings → Copilot → policies. An org admin must allow it before developers run Connect, or the Anyray models install but never appear in the picker. Individual plans have no such gate.
The Anyray model provider needs VS Code 1.121+. Native Copilot keeps working while you upgrade.
curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- \
--enroll https://app.anyray.ai/enroll/enl_… --tools copilot
Already enrolled, or ANYRAY_CLIENT_KEY set?
npx anyray-connect@latest --gateway https://gateway.example.com --tools copilot
Add --subscription to keep your GitHub sign-in and spend your Copilot seat. Without it the
gateway's own provider key serves the request. Your key lives in VS Code SecretStorage, never in
workspace settings, and Connect changes nothing without a valid ark_… key.
Reload VS Code if Connect asks, open Chat's model picker, and select an Anyray · … model. In agent mode, open Select Tools and enable the Anyray MCP tools.
VS Code lets an extension add a model, not replace Copilot's. Requests on Copilot's own models stay on the native lane.
Connect enables the Agents window for you, and the agent host reads that setting at process
start. A window reload is not enough. --quit-apps does the restart for you.
| What you get | Subscription mode | API-key mode |
|---|---|---|
| Chat optimization | Yes, on Anyray models | Yes, on Anyray models |
| Who serves and bills | GitHub, on your Copilot seat | The gateway's provider key |
| Gateway inference spend | None recorded | Recorded and attributed |
anyray_retrieve in agent mode | Yes | No. Text-only, so it stays out of the Agents window |
| Native usage visibility | The GitHub connector, Business and Enterprise only | Not applicable |
Working over Remote-SSH, Dev Containers, or Codespaces? The extension host runs on the remote side, so run Connect from that window's integrated terminal, not a local shell. Versions, tunnels, and the Agents-window caveat: remote windows.
Copilot CLI
The standalone copilot CLI (@github/copilot) is a different product from the VS Code extension.
Its route to a gateway is GitHub's BYOK contract, which is env-only.
VS Code's Copilot CLI surfaces never launch the copilot binary. The bundled extension loads the
CLI SDK inside its extension host, which resolves your login shell's environment once, at editor
start. An editor left open keeps talking straight to GitHub, and missing trace rows are the only
symptom.
npx anyray-connect@latest --tools copilot-cli
On macOS that explicit form is what lets Connect read a /login stored in the Keychain, because
the read raises a permission dialog. Elsewhere the plain npx anyray-connect@latest sweep picks
the CLI up too.
Connect writes a managed copilot-cli block into your shell profile and registers the retrieval
MCP server in ~/.copilot/mcp-config.json. Secrets stay out of the profile: they go in
~/.anyray/copilot-cli.sh at mode 0600, which the block sources.
Run source ~/.zshrc, or open a new terminal. A copilot session started before the change
keeps its old environment.
Console → Traces, filtered to tool:copilot-cli. On the seat lane the trace shows
subscription-covered billing. npx anyray-connect@latest status also lists the CLI once its
block points at your gateway.
Connect picks the lane for you:
| Lane | When | Billing |
|---|---|---|
| Seat, the default | Connect can read a Copilot sign-in (which sources) | Your Copilot plan. A seat whose sign-in it cannot read stays on native GitHub inference, never moved to org billing |
Org, with --org | You pass --org, or the machine has no Copilot seat | Org API usage. It stops consuming Copilot premium requests. A machine on this lane stays on it |
Your sign-in decides which models you get
GitHub grants a Copilot token the models of the OAuth app that minted it, not what your plan
lists, so a CLI /login token can 400 on every current model. If Connect reports no current
models, run anyray-connect copilot-login once, which is a browser device-code step, then
re-run anyray-connect --tools copilot-cli.
Measured numbers.
`/logout` does not stop Anyray routing
On the seat lane the CLI authenticates to the gateway with the sign-in in your managed block, not
its own GitHub session. So copilot's /logout clears the session while requests keep flowing
on your Copilot seat. Run anyray-connect --revert to stop it, which removes the managed
block, the owner-only credential, and the sign-in copilot-login minted.
Per-lane model defaults, the anyray-connect models picker, Windows command forms, and revert
behavior for open shells: Copilot reference.
Import native Copilot usage
Business and Enterprise only. It imports usage data, and routes nothing: native chat and inline completions stay on GitHub.
An admin enables the GitHub connector under Settings → Providers with a read-only metrics token (which permission). Individual plans cannot do this.
Zero-touch fleets
On MDM-provisioned machines with a fleet bootstrap file, an installed-but-unconfigured extension shows a sign-in notification with a verification code and an Open sign-in action. It configures itself once the device-grant enrollment completes, with no reload and no manual run. The notification carries only the sign-in URL and code, never a credential.
Revert
npx anyray-connect@latest --tools copilot --revert
This clears the extension settings and SecretStorage key and removes stale Anyray endpoint entries. Restart VS Code fully afterward.