GitHub Copilot
Add an Anyray model to VS Code Chat, route the standalone copilot CLI through the gateway, and
import native usage on Business or Enterprise.
Coverage
No proxy, certificate, DNS, or endpoint changes. Native Copilot is untouched.
| Lane | Setup | What Anyray covers |
|---|---|---|
| Copilot subscription | Enroll, then Connect with --subscription. Installs the Anyray extension: key in VS Code SecretStorage, retrieval MCP in each profile's mcp.json. | Pick an Anyray · … model to optimize chat before Copilot runs it. Agent mode can call anyray_retrieve and anyray_recall. GitHub still serves and bills the request. Business and Enterprise usage imports through the GitHub connector. Individual does not. |
| Gateway API key | Connect without --subscription. Same extension, pointed at the gateway. | Anyray chat models route text through the gateway for optimization and spend attribution. Text-only, so the extension does not advertise tool calling and stays out of the Agents window. |
| VS Code Agents window | Automatic in subscription mode. Connect adds extensions.supportAgentsWindow and chat.agentHost.byokModels.enabled to settings.json, each only if absent. | Anyray models appear in the Copilot agent's model picker, and turns route back through the extension, so they are optimized, traced, and attributed like Chat. Restart VS Code once after Connect, because the agent host reads the bridge setting at process start and outlives a window reload. --quit-apps does it for you. |
| Copilot CLI (seat) | In the default Connect sweep whenever a Copilot sign-in is readable. Writes COPILOT_PROVIDER_* env into your shell profile, pointed at the gateway's Copilot carrier route. | Every copilot CLI request is optimized, traced, and attributed. GitHub still bills it to your Copilot plan, because the gateway authenticates with your own sign-in. |
| Copilot CLI (org BYOK) | Connect with --org, or automatically when the machine has no Copilot seat. Same env block, pointed at the gateway's /v1 lane with your ark_… key. | Same coverage, but GitHub BYOK replaces subscription inference: requests bill as org API usage, not against a Copilot seat. |
| Native Copilot | No client change. Business and Enterprise admins enable the GitHub connector under Settings → Providers with a read-only metrics token (which permission). | Imports usage data only. Native chat and inline completions are not routed or optimized. Not available for Individual. |
Connect VS Code
A GitHub org policy gates third-party language-model providers in Copilot Chat, under GitHub org settings → Copilot → policies. An org admin must allow it before developers run Connect, or the Anyray models install but never appear in the picker. Individual plans have no such gate.
The Anyray model provider needs VS Code 1.121+. Native Copilot keeps working while you upgrade.
curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --enroll https://app.anyray.ai/enroll/enl_… --tools copilot
# After enrollment (or with ANYRAY_CLIENT_KEY set):
npx anyray-connect@latest --gateway https://gateway.example.com --tools copilot
# Add --subscription to use the signed-in Copilot seat.
Subscription mode keeps your GitHub sign-in. API-key mode uses the gateway's provider key. Your
key lives in SecretStorage, never in workspace settings, and Connect will not change VS Code
without a valid ark_… key.
Reload VS Code if Connect asks, open Chat's model picker, and select an Anyray · … model. In
agent mode, open Select Tools and enable the Anyray MCP tools. They register only from a
durable install, so a temporary npx runtime is skipped and VS Code is never left with a dead
command.
The Agents window (title bar → Open in Agents) keeps a separate model list. On a subscription seat Connect enables it for you, and it appears the next time VS Code starts.
VS Code lets an extension add a model, not replace Copilot's, so only requests you send to an Anyray model are optimized. In subscription mode the gateway records no inference spend, because Copilot runs the request. Business and Enterprise visibility comes from the GitHub connector.
Working over Remote-SSH, Dev Containers, or Codespaces? The extension host runs on the remote side, so run Connect from that window's integrated terminal, not a local shell. Versions, tunnels, and the Agents-window caveat: remote windows.
Connect the Copilot CLI
The standalone copilot CLI (@github/copilot) is a different product from the VS Code extension.
Its route to a gateway is GitHub's BYOK contract, which is env-only.
| Lane | Provider | Billing |
|---|---|---|
| Seat (default) | The gateway's Copilot carrier route (/v1/copilot/<plan>/header), with your own Copilot sign-in token as the BYOK key. The gateway performs GitHub's short-lived token exchange where the plan host requires it. | Stays on your Copilot plan. The default sweep configures this lane whenever it can read a sign-in (which sources). A seat whose sign-in it cannot read stays on native GitHub inference, never moved to org billing. |
Org (--org) | The gateway's /v1 lane with your ark_… key. | Bills as org API usage and stops consuming Copilot premium requests. Selected by --org, or when the machine has no Copilot seat. A machine that configured this lane stays on it. |
npx anyray-connect@latest
# macOS only: also permits the Keychain sign-in read:
npx anyray-connect@latest --tools copilot-cli
On macOS the explicit --tools copilot-cli form is what lets Connect read a /login stored in
the Keychain, because that read raises a permission dialog.
Connect writes a managed copilot-cli block into your shell profile with
COPILOT_PROVIDER_TYPE, COPILOT_PROVIDER_BASE_URL, COPILOT_PROVIDER_WIRE_API,
COPILOT_MODEL, and the x-anyray-metadata header. It registers the retrieval MCP server in
~/.copilot/mcp-config.json, which keeps the optimizer's externalize trims lossless. Secrets
stay out of the profile: the seat token and your ark_… key go in ~/.anyray/copilot-cli.sh at
mode 0600, which the block sources.
Run source ~/.zshrc, or open a new terminal. A copilot session started before the change
keeps its old environment until you restart it.
VS Code's Copilot CLI surfaces never launch the copilot binary. The bundled extension loads the
CLI SDK inside its extension host, which resolves your login shell's environment once, at editor
start. An editor already open when Connect wrote the block keeps talking straight to GitHub, and
missing trace rows are the only symptom.
Send one request from the CLI, then open Console → Traces and filter tool:copilot-cli. On the
seat lane the trace shows subscription-covered billing. npx anyray-connect@latest status also
lists the CLI once its block points at your gateway.
Your sign-in decides which models you get
GitHub grants a Copilot token the models of the OAuth app that minted it, not what your plan
lists, so a CLI /login token can 400 on every current model. If Connect reports no current
models, run anyray-connect copilot-login once, which is a browser device-code step, then
re-run anyray-connect --tools copilot-cli.
Measured numbers.
`/logout` does not stop Anyray routing
On the seat lane the CLI authenticates to the gateway with the sign-in in your managed block,
not its own GitHub session. So copilot's /logout clears the session while requests keep
flowing on your Copilot seat. Run anyray-connect --revert to stop it, which removes the
managed block, the owner-only credential, and the sign-in copilot-login minted.
Per-lane model defaults, the anyray-connect models picker, Windows command forms, and revert
behavior for open shells: Copilot reference.
Zero-touch fleets
On MDM-provisioned machines with a fleet bootstrap file, an installed-but-unconfigured extension shows a sign-in notification with a verification code and an Open sign-in action. It configures itself once the device-grant enrollment completes, with no reload and no manual run. The notification carries only the sign-in URL and code, never a credential.
Revert
npx anyray-connect@latest --tools copilot --revert
This clears the extension settings and SecretStorage key and removes stale Anyray endpoint entries. Restart VS Code fully afterward.