Can I build a custom agent using the Copilot SDK and Copilot Cli and run it using business account seat?

[beejay141]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Copilot in GitHub

Body

Can I build a custom agent using the Copilot SDK and Copilot CLI, and then power it with a business account subscription seat? Or is it against the guthub usage policy for the business account?

[RizgarOzan]

Yes, that works. The SDK uses the same login and billing as Copilot CLI, so if you sign in with the account that has the Business seat, your agent's prompts count against that seat's allowance (the README FAQ covers it: https://github.com/github/copilot-sdk). The catch is that your org admin needs to have the Copilot CLI policy turned on, since the SDK runs on the CLI runtime and Business/Enterprise orgs control CLI access with its own policy: https://docs.github.com/en/copilot/concepts/enterprise/policies

It gets murkier if the agent serves other people. The SDK docs don't send everyone through one seat for that. Either each user's session gets its own token (gitHubToken per session, see https://github.com/github/copilot-sdk/blob/main/docs/setup/multi-tenancy.md), or the service authenticates as the org with a GitHub App installation token (or GITHUB_TOKEN in Actions) and usage is billed to the org once "Allow use of Copilot CLI billed to the organization" is enabled: https://github.com/github/copilot-sdk/blob/main/docs/auth/server-to-server-tokens.md

If it's just a tool for yourself on your own seat, I don't see anything in the docs against it. For a shared setup I'd check with your admin first.

[beejay141]

Thank you for your response.

For context, the Agent is a custom PR-Review agent that will run in a container and review PRs using custom instructions/skills. It will be triggered through CI pipelines for every PRs.

[RizgarOzan]

For a CI reviewer I'd skip your personal seat. There's a documented setup for this case where usage is billed to the org instead of a user.

If the CI is GitHub Actions, give the workflow copilot-requests: write and pass the built-in GITHUB_TOKEN to the runtime. You don't need a PAT or any stored secret. The org needs "Allow use of Copilot CLI billed to the organization" turned on, which the docs say is on by default once Copilot CLI is enabled: https://docs.github.com/en/copilot/how-tos/copilot-cli/use-copilot-cli-in-actions

If it's some other CI, create a GitHub App with the "Copilot Requests" repository permission set to read & write and install it on the org (right now it needs All repositories access, and the org has to allow Copilot requests from App installations). Each job mints an installation token and passes it to the runtime as COPILOT_GITHUB_TOKEN. Don't put it in the SDK's gitHubToken option, that one's only for user tokens. The tokens expire after an hour, so minting one per job works out anyway.

Both setups are in https://github.com/github/copilot-sdk/blob/main/docs/auth/server-to-server-tokens.md with SDK snippets for each language.

fwiw the Actions page also recommends GitHub Agentic Workflows (https://github.com/github/gh-aw) over calling copilot directly in a step, might be worth a look for a PR reviewer.