Quick answer
Microsoft Agent Framework can use GitHub Copilot as an agent provider in Python and .NET. The provider exposes Copilot capabilities—shell commands, file operations, URL fetch, MCP, and coding work—through a standard AIAgent, but those operations are disabled until a permission handler allows them.
Squad adds a coordinator and persistent specialists with charters, skills, and MCP configuration under .squad/. The Squad.Agents.AI adapter wraps that team as one Agent Framework AIAgent, so a larger workflow can call it like another agent.
Microsoft announced the GitHub Copilot provider integrations as v1.0 on July 30, 2026. Current Python Learn instructions still show pip install agent-framework-github-copilot --pre, and the Squad adapter installation uses a prerelease flag. Pin and inspect the exact artifacts instead of inferring lifecycle from the announcement alone.
Read the Microsoft Agent Framework guide first if you need the overall architecture.
The three runtime layers
| Layer | Owns | Does not automatically grant |
|---|---|---|
| Agent Framework | Agent interface, sessions, streaming, tools, middleware, workflows, telemetry | GitHub authentication or host permissions |
| GitHub Copilot provider | Copilot runtime and CLI-backed capabilities | Shell, file, URL, or MCP approval |
| Squad | Coordinator, specialist charters, team memory, skills, MCP discovery | Safe persistence, least privilege, or production readiness of the adapter |
An authenticated GitHub Copilot runtime is required. Microsoft recommends a container or development container when enabling shell or filesystem operations. The default provider does not let the agent run commands, read or write files, or fetch URLs without a permission handler.
Configure permissions before capabilities
Start with a disposable container and no write or network permission. Add only the capability required by the test:
- allow reads under the checked-out repository;
- allow a fixed set of test commands with validated arguments;
- allow writes only to the working tree, not credentials or host configuration;
- allow URL fetch only to named documentation hosts when required;
- allow MCP servers by exact transport, command or URL, tool list, and identity;
- require interactive approval for external messages, publishing, deletion, deployment, and secrets;
- expire standing approvals and revoke them when the task or resource changes.
The Microsoft example post uses an approve-all handler to keep a demo short. Do not copy that setting into a normal workstation or production service. Approve-all is reasonable only inside a deliberately isolated, disposable, fully trusted environment whose credentials and network reach are already bounded.
Hosted web search is not the same as URL fetch. Current Learn documentation says the provider does not expose a hosted web-search tool; fetching a URL is a Copilot CLI permission capability and should be controlled as outbound access.
Add Squad as a team agent
Squad discovers configuration from .squad/, including coordinator and specialist charters, skills, and MCP connections. Use one specialist per durable responsibility—for example, implementation, tests, and documentation—and give each the minimum tools and repository paths it needs.
The adapter can present the team as an Agent Framework agent:
dotnet add package Squad.Agents.AI --prereleaseTreat Squad’s persistent decision memory, extracted skills, corrections, and specialist onboarding as capabilities to validate, not automatic guarantees. Decide what may be persisted, where it is stored, which tenant owns it, how a user corrects or deletes it, and whether untrusted repository content can enter trusted memory.
Squad emits OpenTelemetry spans per specialist. Use those spans to reconstruct delegation and tool use, while redacting secrets, personal data, full source files, and sensitive prompts before export.
Validate the combined system
Test the Copilot agent without Squad first. Assert that shell, file, URL, and MCP calls fail closed when the handler denies them. Then add one Squad specialist and verify:
- the coordinator delegates only matching work;
- a specialist cannot inherit broader permissions than its task;
- untrusted repository text cannot silently rewrite charters or persisted memory;
- a revoked MCP credential stops later calls;
- duplicate tool responses do not duplicate external changes;
- cancellation reaches the active specialist;
- traces identify the coordinator, specialist, tool, approval, and result;
- the final response distinguishes proposed work from verified repository state.
For a single configurable long-task runtime, compare this architecture with the Agent Framework Harness and the focused Harness versus Squad guide.
Frequently asked questions
How does GitHub Copilot connect to Microsoft Agent Framework?
The GitHub Copilot provider exposes Copilot CLI and SDK capabilities through the standard Agent Framework AIAgent abstraction in Python and .NET. An authenticated Copilot runtime is required, and shell, file, URL, and MCP operations remain permission-gated.
What does Squad add to Microsoft Agent Framework?
Squad adds a coordinator and persistent specialist roles configured under .squad. The prerelease Squad.Agents.AI adapter can wrap that team as a standard Agent Framework AIAgent, allowing it to participate in a larger workflow.
Should a Copilot permission handler approve every operation?
No. Approve-all is suitable only for a deliberately isolated, disposable, fully trusted environment. Production use should scope shell, file, URL, and MCP permissions by operation, path, destination, identity, and duration, with human review for consequential actions.
Official sources
- Microsoft Developer Blog: Building agent teams with Agent Framework, GitHub Copilot CLI, and Squad
- Microsoft Learn: GitHub Copilot Agent
- Microsoft Learn: Agent Framework overview
Source check: August 3, 2026. Verify current provider and adapter packages, GitHub Copilot authentication, CLI permissions, container boundaries, .squad persistence, MCP configuration, and telemetry before deployment.