GitHub Copilot Cheat Sheet: CLI & Slash Commands, Variables, and Shortcuts

GitHub Copilot CLI is a coding agent that runs in your terminal. It can inspect and edit files, run commands, manage sessions, delegate tasks, and connect to GitHub and VS Code.

You can use this cheat sheet to find its commands, shortcuts, flags, environment variables, permission controls, and customization options. The VS Code companion section lists Chat commands, context variables, participants, and inline suggestion shortcuts.

Enter /help inside Copilot CLI to open the installed command list. In VS Code Chat, type /, #, or @ to open live lists filtered by extension version, chat context, and organization policy.

Last updated: September 13, 2026.

GitHub Copilot Cheat Sheet

GitHub Copilot CLI Quick Reference

The ! prefix executes one command directly. Enter ! alone to stay in shell mode for several commands, then press Esc or Ctrl+C on an empty prompt to return. A lone $ hands the terminal to $SHELL on Unix or %COMSPEC% on Windows. Exit that shell to restore Copilot CLI.

Start here

Install and authenticate Copilot CLI

Install Copilot CLI with npm, WinGet, Homebrew, the shell installer, or a standalone binary. npm installation requires Node.js 22 or later. Windows installation requires PowerShell 6 or later. Copilot CLI is also included in the default Codespaces image and available as a Dev Container Feature.

Run copilot version after installation. Run copilot update to install an available release. copilot completion bash, copilot completion zsh, and copilot completion fish print shell-completion scripts for those shells.

npm install -g @github/copilot
winget install GitHub.Copilot
brew install --cask copilot-cli
curl -fsSL https://gh.io/copilot-install | bash

Top-level commands

Authentication

On a local terminal, copilot login starts a browser flow. Remote terminals and CI environments use the device-code flow by default. Use --web-flow or --device-code to choose explicitly. Use --with-token to read a token from standard input. Add --host https://HOSTNAME for a GitHub Enterprise Cloud account with data residency.

Copilot checks GitHub credentials in this order:

1. COPILOT_GITHUB_TOKEN
2. GH_TOKEN
3. GITHUB_TOKEN
4. OAuth token in the operating-system credential store
5. GitHub CLI authentication fallback

Copilot CLI slash commands

Conversation, context, and navigation

Sessions, history, and sharing

Models, reasoning, plans, and autonomy

Agents, research, review, and delegation

Compare terminal agents: Claude Code Commands Cheat Sheet

Files, directories, and worktrees

Configuration, extensions, and terminal controls

Maintenance, diagnostics, and account commands

Remote control and scheduled work

Copilot CLI keyboard shortcuts

Global and input shortcuts

Timeline, tasks, sessions, and diff shortcuts

Modes, permissions, and safety

Standard, Plan, and Autopilot

Permission modes and patterns

Permission patterns use Kind(argument). The :* suffix in shell(git:*) matches the command stem followed by a space. Path checks resolve symlinks and ./.. segments before matching.

copilot --allow-tool='shell(git:*)' --deny-tool='shell(git push)'
copilot --allow-tool='github(create_issue)'
copilot --deny-tool='write(secret.txt)'

Sandbox and change review

/sandbox status displays OS-level shell sandbox status. /sandbox policy prints effective filesystem and network rules. /sandbox enable and /sandbox disable change the active setting. Startup flags --sandbox and --no-sandbox apply to one session and require experimental mode.

Use /diff before accepting a large set of changes. Add line comments inside the diff viewer and submit them together. Use /undo immediately after a bad turn. Keep Git commits as durable checkpoints for work that spans several turns or external tools.

Command-line flags for sessions and automation

Session and terminal flags

Agent, tool, MCP, and Autopilot flags

Programmatic mode

-p runs one prompt and exits. -s prints only the agent response. --output-format=json emits JSON Lines for automation. The process waits for background agents and shell commands before exit, subject to COPILOT_TASK_WAIT_TIMEOUT_SECONDS.

Use --secret-env-vars=NAME for extra secrets that need output redaction. GitHub token values receive default redaction. --share=PATH saves a Markdown transcript after a programmatic run, and --share-gist publishes a secret gist. Session transcripts can contain source code, prompts, paths, and tool output. Inspect them before sharing.

Repository-controlled hooks, extensions, and workspace MCP servers stay disabled in prompt mode unless the folder is trusted or the matching opt-in environment variable is set. This protects unattended jobs from executable configuration committed by an untrusted repository.

copilot -sp "Summarize the request flow and list the main entry points"
copilot -p "Fix the failing unit tests and report changed files" \
  --allow-tool='read,write,shell(npm test)' \
  --output-format=json
copilot -C ./services/api --plan -i "Plan the authentication migration"

Copilot CLI environment variables

Authentication, directories, and runtime

Context, skills, plugins, and unattended work

BYOK and offline variables

Copilot CLI can use OpenAI-compatible endpoints, Azure OpenAI, and Anthropic through BYOK. Models must provide streaming and tool calling. The CLI can also use local OpenAI-compatible services such as Ollama.

For reusable multi-provider configuration, use ~/.copilot/providers.json or point COPILOT_PROVIDERS_CONFIG to another registry file. The older COPILOT_PROVIDER_* variables continue to work. A provider registry takes precedence when it defines providers or models.

Logging and OpenTelemetry

Use --log-level=none|error|warning|info|debug|all|default and --log-dir=PATH for local logs. OpenTelemetry is disabled until an enabling variable is present.

Custom instructions, agents, skills, plugins, hooks, and MCP

Custom instructions

Instruction files can import another file with a line that starts with @path. Use /instructions to inspect and toggle loaded sources. Use /env to confirm the effective customization set. --no-custom-instructions disables these files for the session.

copilot init and /init analyze the repository and create or improve .github/copilot-instructions.md. Good repository instructions record build, test, and lint commands, architecture boundaries, generated files, coding conventions, and release constraints.

Copilot CLI merges instructions found in these locations:

• .github/copilot-instructions.md
• .github/instructions/**/*.instructions.md
• AGENTS.md, CLAUDE.md, and GEMINI.md in the Git root and working directory
• $HOME/.copilot/copilot-instructions.md
• $HOME/.copilot/instructions/**/*.instructions.md
• Extra directories in COPILOT_CUSTOM_INSTRUCTIONS_DIRS

Prompt files

Prompt files live in .github/prompts/*.prompt.md and are invoked from supported IDEs. They package a repeatable prompt with variables and context for a focused action, such as test generation or an API review. Prompt files are unavailable as a native Copilot CLI customization type. Use a skill or a command file for a reusable CLI action.

Custom agents

Project agents live in .github/agents/ or .claude/agents/. Personal agents live in ~/.copilot/agents/. The file name becomes the agent ID. The required description tells Copilot when to use it; optional fields set name, model, tools, inference behavior, and MCP servers.

Select an agent with /agent or start directly with copilot --agent=test-reviewer. A read-only agent should omit write and shell tools. Built-in agents handle exploration, command execution, code review, research, security review, and general delegated work.

---
name: test-reviewer
description: Reviews unit tests for missing cases and brittle assertions
tools:
  - view
  - grep
---
Review tests only. Report findings with file paths and line numbers. Do not edit files.

Agent skills and commands

A skill is a directory with SKILL.md. Project skills can live under .github/skills/, .claude/skills/, or .agents/skills/. Personal skills can live under ~/.copilot/skills/ or ~/.agents/skills/. A valid skill declares name and description in YAML frontmatter.

Copilot selects a relevant skill automatically, or you can invoke /release-check. Use /skills list, /skills info NAME, /skills add, /skills remove, and /skills reload for management. Individual Markdown commands under .claude/commands/ provide a lighter alternative. A command has lower precedence when a skill uses that command name.

---
name: release-check
description: Checks version, changelog, tests, and package contents before release
---
Read the project release policy. Run the documented checks and report every failure.

Read More: Most Popular Agent Skills on GitHub for Coding Agents

Plugins

Open the plugin dashboard with /plugin. Use /plugin install SOURCE, /plugin update NAME, /plugin uninstall NAME, and /plugin list for plugin lifecycle management. Marketplace subcommands add, remove, list, browse, and refresh registries.

Outside an interactive session, use copilot plugin list --json for a machine-readable plugin inventory. Use copilot skill, copilot mcp, copilot instruction, and copilot lsp for those resource types. The old /plugins command has been removed.

Review a plugin before installation. A plugin can include hooks, MCP servers, agents, skills, commands, rules, and language-server configuration.

Hooks

Hooks live in .github/hooks/*.json. They run deterministic shell commands at defined lifecycle events. Suitable jobs include formatting edited files, checking commands before execution, enforcing path rules, or scanning output for secrets. Review repository hooks before trusting the checkout because they execute code.

MCP servers

Persistent personal MCP configuration lives at ~/.copilot/mcp-config.json. Repository and workspace servers can come from .github/mcp.json or .mcp.json. One-session configuration uses --additional-mcp-config=JSON or --additional-mcp-config=@FILE.

Use /mcp list, /mcp show NAME, /mcp add, /mcp edit, /mcp delete, /mcp disable, /mcp enable, /mcp auth NAME, /mcp reload, and /mcp search during a session. Every MCP tool call requires permission. Remote servers receive the lowest trust level and always require review. When server names collide, session configuration wins, followed by plugin, workspace, and personal configuration.

copilot mcp add local-tools -- npx -y @example/mcp-server
copilot mcp add --transport http team-api https://example.com/mcp
copilot mcp list --json

Related reference: OpenAI Codex Commands Cheat Sheet (2026)

GitHub Copilot app slash commands

The GitHub Copilot app has its own slash-command set. Type / in the app to see the commands available for the current session and repository context.

Connect Copilot CLI to VS Code

Copilot CLI automatically connects when its working directory matches a trusted workspace open in VS Code. Run /ide to inspect the connection, switch workspaces, or disconnect.

The connection shares the active editor selection, diagnostics, workspace trust, and change-review view. Select code in VS Code, then enter Debug this in the CLI. Proposed edits can open as side-by-side VS Code diffs with accept and reject controls. Elevated edit permission applies changes directly and skips that approval diff.

VS Code’s Sessions view displays CLI transcripts for the current workspace. A saved CLI session can resume in the integrated terminal from that view.

VS Code Copilot Chat cheat sheet

Chat modes

VS Code slash commands

VS Code chat variables

VS Code chat participants

Useful VS Code prompt patterns

/explain #selection
/fix #file:src/auth.ts Keep the public API unchanged and add a regression test.
#project Trace the request from the HTTP route to the database write. List files in execution order.
@terminal Explain the latest test failure and identify the first actionable error.
#file:src/cache.ts #file:test/cache.test.ts Add tests for expiration and concurrent reads.

VS Code inline suggestion shortcuts

Platform and customization matrix

Customization support differs across Copilot surfaces. Preview marks features that GitHub currently labels as preview on that surface.

Workflow Examples

Explore a repository before editing

Start in Standard or Plan mode. Attach relevant files with @ and confirm the working directory with /cwd. Request evidence paths and a concrete architecture summary.

Map the application entry points, request flow, persistence layer, and test layout. Read only. Return file paths and the commands used to verify your findings.

Plan a multi-file change

Review the plan for migration impact, failure behavior, and test scope before switching modes. Run /rubber-duck when the change has a risky assumption or several valid designs.

/plan Add idempotency to payment creation. Preserve the public API, reuse the existing database transaction helper, include rollback behavior, and name the tests that must pass.

Fix a failing test

Grant only the shell commands and paths required for the repair. Avoid global permission bypass for an unfamiliar repository.

Run the failing test in isolation. Find the first product-code defect, apply the smallest correction, rerun the focused test, then run the related test suite. Report commands and changed files.

Review a change set

Inspect /diff, add line comments, and run /security-review for security-sensitive code. Commit after the change passes its required tests.

/review Focus on correctness, security, data loss, concurrency, and missing regression tests. Ignore formatting unless it changes behavior.

Delegate independent work

Use parallel agents when repository areas can be investigated independently.

/fleet Inspect the API, database, and test layers independently. Return one combined implementation risk report. Do not edit files.

Troubleshooting

FAQs

Does BYOK require a GitHub login?

No. GitHub authentication is optional when Copilot CLI uses an external or local model provider. /delegate, GitHub Code Search, and the built-in GitHub MCP server require a GitHub login. Use GitHub authentication when the session needs those hosted features.

Where does Copilot CLI store sign-in credentials?

OAuth credentials go to the operating-system credential store: Keychain Access on macOS, Credential Manager on Windows, or a supported secret service on Linux. If no credential store is available, Copilot can save the token in plain text at ~/.copilot/config.json, or under the directory set by COPILOT_HOME. Protect that file and avoid the plain-text fallback on shared systems.

Do commands entered with ! use Copilot permission rules?

No. The ! prefix runs a command directly in the local shell and bypasses the agent tool approval flow. The command receives the permissions of the user account running the terminal. Read it as carefully as any command copied from another source.

How can I keep a Copilot CLI session local?

Start the session with --no-remote, set the remote configuration value to off, or disable remote access through /remote off. This prevents session syncing and remote control. A model provider still receives prompts and context unless the session uses an approved local provider in offline mode.

Does /undo replace Git commits?

No. /undo restores conversation state and tracked file changes from a selected turn. Git commits record durable project history, support team review, and remain available after session data is removed. Commit tested milestones during long or high-risk changes.