GitHub Copilot CLI

GitHub Copilot CLI (copilot) is GitHub’s coding agent for the terminal. E2B provides a pre-built copilot template with Copilot CLI already installed.

Authentication

Copilot CLI reads a GitHub token from COPILOT_GITHUB_TOKEN, GH_TOKEN, or GITHUB_TOKEN, in that order. Create a fine-grained personal access token on an account with a Copilot plan, add the Copilot Requests account permission, and pass it to the sandbox as COPILOT_GITHUB_TOKEN. Without a token, copilot -p exits with an error instead of waiting for a login.

Copilot CLI rejects classic personal access tokens (ghp_), even when a model provider is configured. If you use a classic token for git, pass it only to the git command, not as a sandbox-wide GITHUB_TOKEN, as in the cloned repository example.

To use your own model provider instead of a Copilot plan, set COPILOT_PROVIDER_BASE_URL, COPILOT_PROVIDER_API_KEY, and COPILOT_MODEL. No GitHub token is needed in that mode. For OpenAI GPT-5 models, also set COPILOT_PROVIDER_WIRE_API=responses; for Anthropic, set COPILOT_PROVIDER_TYPE=anthropic. Run copilot help providers in the sandbox for all options.

const sandbox = await Sandbox.create('copilot', {
  envs: {
    COPILOT_PROVIDER_BASE_URL: 'https://api.openai.com/v1',
    COPILOT_PROVIDER_API_KEY: process.env.OPENAI_API_KEY!,
    COPILOT_PROVIDER_WIRE_API: 'responses',
    COPILOT_MODEL: 'gpt-5.6-luna',
  },
})

sandbox = Sandbox.create("copilot", envs={
    "COPILOT_PROVIDER_BASE_URL": "https://api.openai.com/v1",
    "COPILOT_PROVIDER_API_KEY": os.environ["OPENAI_API_KEY"],
    "COPILOT_PROVIDER_WIRE_API": "responses",
    "COPILOT_MODEL": "gpt-5.6-luna",
})

CLI

Create a sandbox with the E2B CLI and pass your token to the terminal session.

e2b sbx create copilot -e COPILOT_GITHUB_TOKEN=$COPILOT_GITHUB_TOKEN

Once inside the sandbox, start Copilot CLI.

copilot

If you did not pass a token, run /login in Copilot CLI to sign in with your GitHub account.

Run headless

Use -p for non-interactive mode and --allow-all-tools to auto-approve all tool calls. Without it, headless runs cannot ask for approval: tools that need it are denied, and the run still exits with code 0. Add -s to print only the final answer. Agent runs often take longer than the default command timeout, so pass timeoutMs: 0 (timeout=0 in Python) to wait until the run completes, and give the sandbox enough lifetime.

Auto-approving tool calls is contained by the sandbox: the agent cannot touch your host machine, local files, or credentials. It can still make outbound network requests — internet access is enabled by default. To limit where an auto-approved agent can connect, configure outbound network rules (allowInternetAccess, plus allow lists by CIDR or hostname and deny lists by CIDR). Hostname rules apply to HTTP(S) traffic only; use CIDR rules for other protocols.

import { Sandbox } from 'e2b'

const sandbox = await Sandbox.create('copilot', {
  envs: { COPILOT_GITHUB_TOKEN: process.env.COPILOT_GITHUB_TOKEN! },
  timeoutMs: 600_000,
})

const result = await sandbox.commands.run(
  `copilot --allow-all-tools -p "Create a hello world HTTP server in Python"`,
  { timeoutMs: 0 }
)

console.log(result.stdout)
await sandbox.kill()

import os
from e2b import Sandbox

sandbox = Sandbox.create("copilot", envs={
    "COPILOT_GITHUB_TOKEN": os.environ["COPILOT_GITHUB_TOKEN"],
}, timeout=600)

result = sandbox.commands.run(
    'copilot --allow-all-tools -p "Create a hello world HTTP server in Python"',
    timeout=0,
)

print(result.stdout)
sandbox.kill()

Select a model with --model, or with COPILOT_MODEL when you use your own provider. To allow only some tools, replace --allow-all-tools with --allow-tool and --deny-tool rules, for example --allow-tool='shell(git:*)' --deny-tool='shell(git push)'.

Example: work on a cloned repository

import { Sandbox } from 'e2b'

const sandbox = await Sandbox.create('copilot', {
  envs: { COPILOT_GITHUB_TOKEN: process.env.COPILOT_GITHUB_TOKEN! },
  timeoutMs: 900_000,
})

await sandbox.commands.run(
  'git clone --depth 1 https://x-access-token:$GITHUB_TOKEN@github.com/your-org/your-repo.git /home/user/repo',
  { envs: { GITHUB_TOKEN: process.env.GITHUB_TOKEN! } }
)
// Remove the token from .git/config so the agent cannot read it
await sandbox.commands.run('git -C /home/user/repo remote set-url origin https://github.com/your-org/your-repo.git')

const result = await sandbox.commands.run(
  `cd /home/user/repo && copilot --allow-all-tools -p "Add error handling to all API endpoints"`,
  { timeoutMs: 0, onStdout: (data) => { process.stdout.write(data) } }
)

const diff = await sandbox.commands.run('cd /home/user/repo && git diff')
console.log(diff.stdout)

await sandbox.kill()

import os
from e2b import Sandbox

sandbox = Sandbox.create("copilot", envs={
    "COPILOT_GITHUB_TOKEN": os.environ["COPILOT_GITHUB_TOKEN"],
}, timeout=900)

sandbox.commands.run(
    "git clone --depth 1 https://x-access-token:$GITHUB_TOKEN@github.com/your-org/your-repo.git /home/user/repo",
    envs={"GITHUB_TOKEN": os.environ["GITHUB_TOKEN"]},
)
# Remove the token from .git/config so the agent cannot read it
sandbox.commands.run("git -C /home/user/repo remote set-url origin https://github.com/your-org/your-repo.git")

result = sandbox.commands.run(
    'cd /home/user/repo && copilot --allow-all-tools -p "Add error handling to all API endpoints"',
    timeout=0,
    on_stdout=lambda data: print(data, end=""),
)

diff = sandbox.commands.run("cd /home/user/repo && git diff")
print(diff.stdout)

sandbox.kill()

Streaming events

Use --output-format json to get a JSONL event stream: assistant.message_delta events with response text, tool.execution_start and tool.execution_complete events for tool calls, and a final result event with the session ID and the files the run changed.

import { Sandbox } from 'e2b'

const sandbox = await Sandbox.create('copilot', {
  envs: { COPILOT_GITHUB_TOKEN: process.env.COPILOT_GITHUB_TOKEN! },
  timeoutMs: 600_000,
})

// Output arrives in chunks that can split a JSON line, so buffer until a newline
let buffer = ''
const handleOutput = (data: string) => {
  buffer += data
  const lines = buffer.split('\n')
  buffer = lines.pop() ?? ''
  for (const line of lines.filter(Boolean)) {
    const event = JSON.parse(line)
    if (event.type === 'tool.execution_start') {
      console.log(`[tool] ${event.data.toolName}`)
    } else if (event.type === 'assistant.message_delta') {
      process.stdout.write(event.data.deltaContent)
    } else if (event.type === 'result') {
      console.log(`\n[done] session ${event.sessionId}, changed: ${event.usage.codeChanges.filesModified.join(', ')}`)
    }
  }
}

await sandbox.commands.run(
  `copilot --allow-all-tools --output-format json -p "Create hello.py that prints hello, then run it"`,
  { timeoutMs: 0, onStdout: handleOutput }
)

await sandbox.kill()

import json
import os
from e2b import Sandbox

sandbox = Sandbox.create("copilot", envs={
    "COPILOT_GITHUB_TOKEN": os.environ["COPILOT_GITHUB_TOKEN"],
}, timeout=600)

# Output arrives in chunks that can split a JSON line, so buffer until a newline
buffer = ""

def handle_output(data):
    global buffer
    buffer += data
    *lines, buffer = buffer.split("\n")
    for line in filter(None, lines):
        event = json.loads(line)
        if event["type"] == "tool.execution_start":
            print(f"[tool] {event['data']['toolName']}")
        elif event["type"] == "assistant.message_delta":
            print(event["data"]["deltaContent"], end="")
        elif event["type"] == "result":
            changed = ", ".join(event["usage"]["codeChanges"]["filesModified"])
            print(f"\n[done] session {event['sessionId']}, changed: {changed}")

sandbox.commands.run(
    'copilot --allow-all-tools --output-format json -p "Create hello.py that prints hello, then run it"',
    timeout=0,
    on_stdout=handle_output,
)

sandbox.kill()

Resume a session

Copilot CLI stores sessions in ~/.copilot inside the sandbox. Use --continue to resume the most recent one, or --resume=<session-id> with the ID from the result event, to give follow-up instructions with the earlier context.

import { Sandbox } from 'e2b'

const sandbox = await Sandbox.create('copilot', {
  envs: { COPILOT_GITHUB_TOKEN: process.env.COPILOT_GITHUB_TOKEN! },
  timeoutMs: 600_000,
})

await sandbox.commands.run(
  `mkdir -p /home/user/app && cd /home/user/app && copilot --allow-all-tools -p "Create a Flask app in app.py with a /health endpoint"`,
  { timeoutMs: 0 }
)

const followUp = await sandbox.commands.run(
  `cd /home/user/app && copilot --continue --allow-all-tools -s -p "Add a /version endpoint that returns 1.0.0"`,
  { timeoutMs: 0 }
)

console.log(followUp.stdout)
await sandbox.kill()

import os
from e2b import Sandbox

sandbox = Sandbox.create("copilot", envs={
    "COPILOT_GITHUB_TOKEN": os.environ["COPILOT_GITHUB_TOKEN"],
}, timeout=600)

sandbox.commands.run(
    'mkdir -p /home/user/app && cd /home/user/app && copilot --allow-all-tools -p "Create a Flask app in app.py with a /health endpoint"',
    timeout=0,
)

follow_up = sandbox.commands.run(
    'cd /home/user/app && copilot --continue --allow-all-tools -s -p "Add a /version endpoint that returns 1.0.0"',
    timeout=0,
)

print(follow_up.stdout)
sandbox.kill()

To keep sessions across sandbox restarts, pause the sandbox instead of killing it.

Build a custom template

If you need to customize the environment (e.g. pre-install dependencies, add config files), build your own template on top of the pre-built copilot template.

// template.ts
import { Template } from 'e2b'

export const template = Template()
  .fromTemplate('copilot')

# template.py
from e2b import Template

template = (
    Template()
    .from_template("copilot")
)

// build.ts
import { Template, defaultBuildLogger } from 'e2b'
import { template as copilotTemplate } from './template'

await Template.build(copilotTemplate, 'my-copilot', {
  cpuCount: 2,
  memoryMB: 2048,
  onBuildLogs: defaultBuildLogger(),
})

# build.py
from e2b import Template, default_build_logger
from template import template as copilot_template

Template.build(copilot_template, "my-copilot",
    cpu_count=2,
    memory_mb=2048,
    on_build_logs=default_build_logger(),
)

Run the build script to create the template.

npx tsx build.ts

python build.py

Cookbook example

Run Copilot CLI on a repository and print the diff

Sandbox persistence

Auto-pause, resume, and manage sandbox lifecycle

SSH access

Connect to the sandbox via SSH for interactive sessions

Agents

MCP gateway

GitHub Copilot CLI

Authentication

CLI

Run headless

Example: work on a cloned repository

Streaming events

Resume a session

Build a custom template

Cookbook example

Sandbox persistence

SSH access

​Authentication

​CLI

​Run headless

​Example: work on a cloned repository

​Streaming events

​Resume a session

​Build a custom template

​Related guides

Cookbook example

Sandbox persistence

SSH access

Authentication

CLI

Run headless

Example: work on a cloned repository

Streaming events

Resume a session

Build a custom template

Related guides