Microsoft Agent Framework ships stable GitHub Copilot Agent for .NET and Python

Microsoft Agent Framework now ships a stable GitHub Copilot Agent for both .NET and Python, giving developers a way to run Copilot's coding harness inside Agent Framework's orchestration surface. The release, announced today, means the Copilot CLI and SDK own the agent loop — model calls, tool invocation, planning, and session state — while Agent Framework supplies instructions, streaming, middleware, observability, and human-in-the-loop approval.

The architecture is a division of labor. Copilot brings its built-in coding-agent abilities: shell execution, file read/write, URL fetching, and MCP tool support. Agent Framework provides the run interface consistent with its other providers, so an agent built this way streams output, participates in OpenTelemetry tracing, and can be governed the same way as agents built on other harnesses.

The central design decision is permission gating. Every sensitive capability — shell commands, file writes, URL fetches, MCP calls, and any tool marked as requiring approval — flows through a permission handler the developer provides. By default nothing runs without oversight; the handler receives each request and returns an approve or deny decision, with options for one-time approval or blanket approval for trusted operations. The code samples show both .NET and Python handlers that log requests and prompt the user.

Custom tools can be registered alongside Copilot's built-ins. In .NET, wrapping a function in ApprovalRequiredAIFunction routes it through the permission handler; in Python, a tool declared with approval_mode="always_require" does the same. Because the Copilot SDK owns tool calling, approval is enforced through its pre-tool-use hook — the agent installs a default hook that routes these tools to the permission handler and warns if a custom hook would bypass it.

Session management is handled automatically. Sessions persist across turns, and an earlier conversation can be resumed by its session ID from a new agent instance. The agent can also be pointed at instruction directories to load project-specific or team-shared guidelines.

MCP servers are configurable in both local (stdio) and remote (http) forms, with examples showing a filesystem server and the Microsoft Learn documentation API.

Practical constraints apply. The agent runs on top of an authenticated GitHub Copilot CLI, so an active Copilot subscription and the CLI installed are prerequisites. .NET requires version 8 or later; Python requires 3.11 or later. CLI configuration is handled through environment variables — GITHUB_COPILOT_CLI_PATH, GITHUB_COPILOT_MODEL, GITHUB_COPILOT_TIMEOUT, and GITHUB_COPILOT_BASE_DIRECTORY — with defaults that can be overridden in code.

The release is positioned as one of several harness options in Agent Framework, with the alternative being a fully custom harness assembled piece by piece. The approval mechanism is documented, but no evidence is offered about behavior under real workloads, or about how the warning against custom hooks plays out in complex deployments.