GitHub Copilot Cheat Sheet: CLI & Slash Commands, Variables, and Shortcuts

GitHub Copilot CLI is a coding agent that runs in your terminal. It can inspect and edit files, run commands, manage sessions, delegate tasks, and connect to GitHub and VS Code.

This GitHub Copilot cheat sheet lists CLI slash commands, keyboard shortcuts, startup flags, environment variables, permission controls, and customization options. Separate sections also include Copilot app commands and VS Code Chat references.

Last updated: October 19, 2026.

GitHub Copilot CLI Quick Reference

Use /version and /help to check your installed release and commands.

Essential Commands and Shortcuts

CLI Command Syntax

Top-Level CLI Commands

Copilot CLI Slash Commands

Conversation, context, and navigation

Sessions, history, and sharing

Models, reasoning, plans, and autonomy

GitHub Copilot Model Availability

Agents, research, review, and delegation

Files, directories, and worktrees

Configuration, extensions, and terminal controls

Settings files and useful options

Personal preferences belong in ~/.copilot/settings.json. Shared repository defaults use .github/copilot/settings.json, and private repository overrides use .github/copilot/settings.local.json. Copilot ignores preference keys in config.json. That file stores application state and authentication fallback data. Inspect effective values and managed restrictions with /settings.

Maintenance, diagnostics, and account commands

On macOS, Microsoft Entra sign-in uses the native broker when available and falls back to browser authentication. If a GitHub.com Connector needs additional GitHub CLI permissions, update the authorization when prompted and retry the connection with the same sign-in method.

Remote control and scheduled work

Copilot CLI Keyboard Shortcuts

Global and input shortcuts

Timeline, tasks, sessions, and diff shortcuts

Copilot CLI Modes and Permissions

Standard, Plan, and Autopilot

Permission modes and patterns

Permission patterns use Kind(argument). The :* suffix in shell(git:*) matches the command stem followed by a space. Path checks resolve symlinks and ./.. segments before matching.

copilot --allow-tool='shell(git:*)' --deny-tool='shell(git push)'
copilot --allow-tool='github(create_issue)'
copilot --deny-tool='write(secret.txt)'

Manual Approval asks you to approve operations. Assisted Permissions uses a permission judge to assess requests against your instructions and policy, including visible shell code. An organization can disable Assisted Permissions or suppress startup bypass flags. Check the policy warning and /permissions show when a requested mode does not take effect. The timeline identifies whether a decision came from you, Assisted Permissions, policy, or unattended fallback.

Enterprise-managed permissions.limitTo restricts domain requests to an administrator-defined boundary. Personal approvals and allow-all modes cannot expand it. URLs recognized in shell requests must satisfy this boundary too. The setting does not independently restrict file reads, writes, or shell execution.

Local sandbox commands and credentials

Local command sandboxing is available through /sandbox and --sandbox. It constrains filesystem and network access on supported hosts. Shell commands and local MCP/LSP processes use operating-system restrictions. Built-in file operations check the same filesystem policy within the CLI. Remote MCP servers run outside your machine. On Windows, programs that ignore proxy settings can bypass network host rules.

Use the Credentials tab to configure Git and gh authentication and masked environment variables. The dialog suggests possible environment secrets and lets you add approved masking hosts before saving. sandbox.credentials.envVars maps each variable name to a nonempty injectHosts array. Sandboxed processes receive placeholders. The local proxy injects real values only into HTTPS request headers sent to those hosts. Settings store variable names and host rules, not secret values.

{"sandbox": {
  "credentials": {
    "envVars": {
      "ACME_API_TOKEN": {
        "injectHosts": ["api.example.com"]
      }
    }
  }
}}

Place this configuration in ~/.copilot/settings.json and replace the example variable and hostname with your own. The variable must exist in the parent environment. Sandbox settings are personal or enterprise-managed. Repository settings cannot override them. copilot config supports credential injectHosts keys, with key completion in Bash, Zsh, and Fish. Inspect /sandbox policy after changing access rules. Local-network allowlists include localhost and loopback hosts when local-network access is enabled.

Copilot CLI Command-Line Flags

Session and terminal flags

Agent, tool, MCP, and Autopilot flags

Programmatic mode

-p runs one prompt and exits. -s prints only the agent response. --output-format=json emits JSON Lines for automation. The process waits for background agents and shell commands before exit, subject to COPILOT_TASK_WAIT_TIMEOUT_SECONDS.

Use --secret-env-vars=NAME for extra secrets that need output redaction. GitHub token values receive default redaction. --share=PATH saves a Markdown transcript after a programmatic run, and --share-gist publishes a secret gist. Session transcripts can contain source code, prompts, paths, and tool output. Inspect them before sharing.

Repository-controlled hooks, extensions, and workspace MCP servers stay disabled in prompt mode unless the folder is trusted or the matching opt-in environment variable is set. This protects unattended jobs from executable configuration committed by an untrusted repository.

copilot -sp "Summarize the request flow and list the main entry points"
copilot -p "Fix the failing unit tests and report changed files" \
  --allow-tool='read,write,shell(npm test)' \
  --output-format=json
copilot -C ./services/api --plan -i "Plan the authentication migration"

Copilot CLI Environment Variables

Authentication, directories, and runtime

Context, skills, plugins, and unattended work

BYOK and offline variables

Copilot CLI can use OpenAI-compatible endpoints, Azure OpenAI, and Anthropic through BYOK. Models must provide streaming and tool calling. The CLI can also use local OpenAI-compatible services such as Ollama.

For reusable multi-provider configuration, use ~/.copilot/providers.json or point COPILOT_PROVIDERS_CONFIG to another registry file. COPILOT_PROVIDER_* variables also configure a provider. A provider registry takes precedence when it defines providers or models.

Logging and OpenTelemetry

Use --log-level=none|error|warning|info|debug|all|default and --log-dir=PATH for local logs. OpenTelemetry is disabled until an enabling variable is present.

Copilot CLI Customization

Custom instructions

Instruction files can import another file with a line that starts with @path. Use /instructions to inspect and toggle loaded sources. Use /env to confirm the effective customization set. --no-custom-instructions disables these files for the session.

copilot init and /init analyze the repository and create or improve .github/copilot-instructions.md. Good repository instructions record build, test, and lint commands, architecture boundaries, generated files, coding conventions, and release constraints.

Copilot CLI merges instructions found in these locations:

• .github/copilot-instructions.md
• .github/instructions/**/*.instructions.md and .claude/rules/**/*.md. Scope Claude rule files with paths or applyTo frontmatter.
• AGENTS.md, CLAUDE.md, and GEMINI.md in the Git root and working directory
• $HOME/.copilot/copilot-instructions.md
• $HOME/.copilot/instructions/**/*.instructions.md
• Extra directories in COPILOT_CUSTOM_INSTRUCTIONS_DIRS

Prompt files

Prompt files live in .github/prompts/*.prompt.md and are invoked from supported IDEs. They package a repeatable prompt with variables and context for a focused action, such as test generation or an API review. Prompt files are unavailable as a native Copilot CLI customization type. Use a skill or a command file for a reusable CLI action.

Custom agents

Project agents live in .github/agents/ or .claude/agents/. Personal agents live in ~/.copilot/agents/. The file name becomes the agent ID. The required description tells Copilot when to use it. Optional fields set name, model, tools, inference behavior, and MCP servers.

Set include-custom-instructions: true in agent frontmatter to pass repository instruction files to that agent when it runs as a subagent. The default is false. Select an agent with /agent or start directly with copilot --agent=test-reviewer. A read-only agent should omit write and shell tools. Built-in agents handle exploration, command execution, code review, research, security review, and general delegated work.

---
name: test-reviewer
description: Reviews unit tests for missing cases and brittle assertions
include-custom-instructions: true
tools:
  - view
  - grep
---
Review tests only. Report findings with file paths and line numbers. Do not edit files.

Agent skills and commands

A skill is a directory with SKILL.md. Project skills can live under .github/skills/, .claude/skills/, or .agents/skills/. Personal skills can live under ~/.copilot/skills/ or ~/.agents/skills/. A valid skill declares name and description in YAML frontmatter.

Copilot selects a relevant skill automatically, or you can invoke /release-check. Use /skills list, /skills info NAME, /skills add, /skills remove, and /skills reload for management. Individual Markdown commands under .claude/commands/ provide a lighter alternative. A command has lower precedence when a skill uses that command name.

---
name: release-check
description: Checks version, changelog, tests, and package contents before release
---
Read the project release policy. Run the documented checks and report every failure.

Plugins

Open the plugin dashboard with /plugin. Use /plugin install SOURCE, /plugin update NAME, /plugin uninstall NAME, and /plugin list for plugin lifecycle management. Outside a session, copilot plugin enable NAME and copilot plugin disable NAME toggle direct installs. Marketplace subcommands add, remove, list, browse, and refresh registries.

Outside an interactive session, use copilot plugin list --json for a machine-readable plugin inventory. Use copilot skill, copilot mcp, copilot instruction, and copilot lsp for those resource types. Use the singular /plugin command inside a session.

Review a plugin before installation. A plugin can include hooks, MCP servers, agents, skills, commands, rules, and language-server configuration.

Hooks

Hooks live in .github/hooks/*.json. They run deterministic shell commands at defined lifecycle events. Suitable jobs include formatting edited files, checking commands before execution, enforcing path rules, or scanning output for secrets. Review repository hooks before trusting the checkout because they execute code.

Personal hooks can also live in ~/.copilot/hooks/*.json. Preview: declare a hooks event map in a custom agent’s YAML frontmatter to run hooks only while that agent is selected. Agent-scoped hooks run alongside other applicable hooks. Remote or organization-hosted agent definitions do not run them. Repository hooks require workspace trust, and policy restrictions apply.

---
name: formatter
description: Formats changed files
hooks:
  PostToolUse:
    - type: command
      command: ./scripts/format-changed-files.sh
      windows: ./scripts/format-changed-files.ps1
---
Format the files you change.

Use existing scripts at the paths in this example. command is the fallback. windows, linux, and osx select platform-specific commands. Paths resolve from the repository root. Preview: Autopilot denies a preToolUse hook decision of ask during unattended work. Use an explicit allow or deny decision when writing a hook for that workflow.

MCP servers

Persistent personal MCP configuration lives at ~/.copilot/mcp-config.json. Repository and workspace servers can come from .github/mcp.json or .mcp.json. One-session configuration uses --additional-mcp-config=JSON or --additional-mcp-config=@FILE.

Use /mcp list, /mcp show NAME, /mcp add, /mcp edit, /mcp delete, /mcp disable, /mcp enable, /mcp auth NAME, /mcp reload, and /mcp search during a session. MCP tool calls follow the active permission policy. Review the data and operations exposed by a remote server before approving access. When server names collide, session configuration wins, followed by plugin, workspace, and personal configuration.

MCP server configuration changes apply between turns during a session. Enable or disable a server before discovery with /mcp enable NAME or /mcp disable NAME. The server does not need to be running when you change its enabled state. Use /mcp reload when you need an explicit refresh.

copilot mcp add local-tools -- npx -y @example/mcp-server
copilot mcp add --transport http team-api https://example.com/mcp
copilot mcp list --json

GitHub Copilot App Slash Commands

The GitHub Copilot app has its own slash-command set. Type / in the app to see the commands available for the current session and repository context.

VS Code Copilot Chat Reference

Chat modes and inline chat

VS Code slash commands

VS Code Chat Variables

Type # and select a file, folder, symbol, tool, or tool set from the picker. Context items attach information. Tool references request actions. The available list depends on the active agent, extensions, and session capabilities. Tool references follow the same approval rules as other agent operations.

VS Code chat participants

Useful VS Code prompt patterns

/explain #selection
/fix #auth.ts Keep the public API unchanged and add a regression test.
#search/codebase Trace the request from the HTTP route to the database write. List files in execution order.
@terminal Explain the latest test failure and identify the first actionable error.
#cache.ts #cache.test.ts Add tests for expiration and concurrent reads.

Select the actual files from the # picker when entering these examples. To diagnose a failed test, attach its output or use Fix Test Failure in Test Explorer.

VS Code Inline Suggestion Shortcuts

Copilot CLI Workflow Examples

Explore a repository before editing

Start in Standard or Plan mode. Attach relevant files with @ and confirm the working directory with /cwd. Request evidence paths and a concrete architecture summary.

Map the application entry points, request flow, persistence layer, and test layout. Inspect files only. Return file paths and the commands used to verify your findings.

Plan a multi-file change

Review the plan for migration impact, failure behavior, and test scope before switching modes. Run /rubber-duck when the change has a risky assumption or several valid designs.

/plan Add idempotency to payment creation. Preserve the public API, reuse the existing database transaction helper, include rollback behavior, and name the tests that must pass.

Fix a failing test

Grant only the shell commands and paths required for the repair. Avoid global permission bypass for an unfamiliar repository.

Run the failing test in isolation. Find the first product-code defect, apply the smallest correction, rerun the focused test, then run the related test suite. Report commands and changed files.

Review a change set

Inspect /diff, add line comments, and run /security-review for security-sensitive code. Commit after the change passes its required tests.

/review Focus on correctness, security, data loss, concurrency, and missing regression tests. Ignore formatting unless it changes behavior.

Delegate independent work

Use parallel agents when repository areas can be investigated independently.

/fleet Inspect the API, database, and test layers independently. Return one combined implementation risk report. Do not edit files.

Copilot CLI Troubleshooting

Frequently Asked Questions

Does BYOK require a GitHub login?

No. GitHub authentication is optional when Copilot CLI uses an external or local model provider. /delegate, GitHub Code Search, and the built-in GitHub MCP server require a GitHub login. Use GitHub authentication when the session needs those hosted features.

Where does Copilot CLI store sign-in credentials?

OAuth credentials go to the operating-system credential store: Keychain Access on macOS, Credential Manager on Windows, or a supported secret service on Linux. If no credential store is available, Copilot can save the token in plain text at ~/.copilot/config.json, or under the directory set by COPILOT_HOME. Protect that file and avoid the plain-text fallback on shared systems.

How can I keep a Copilot CLI session local?

Start the session with --no-remote, set the remote configuration value to off, or disable remote access through /remote off. This prevents session syncing and remote control. A model provider receives prompts and context unless the session uses an approved local provider in offline mode.

Does /undo replace Git commits?

No. /undo restores conversation state and tracked file changes from a selected turn. Git commits support team review and preserve project history after session data is removed. Commit tested milestones during long or high-risk changes.

Official References

• GitHub Copilot CLI Command Reference
• Slash Commands for the GitHub Copilot App
• GitHub Copilot Chat Cheat Sheet
• VS Code AI Features Cheat Sheet

Related Resources

• Claude Code Commands Cheat Sheet
• Most Popular Agent Skills on GitHub for Coding Agents
• OpenAI Codex Commands Cheat Sheet