github · github-actions · Jul 22, 2026
@@ -3,7 +3,7 @@ title: 'Agents and Subagents'
 description: 'Learn how delegated subagents differ from primary agents, when to use them, and how to launch them in VS Code and Copilot CLI.'
 authors:
   - GitHub Copilot Learning Hub Team
-lastUpdated: 2026-07-01
+lastUpdated: 2026-07-22
 estimatedReadingTime: '9 minutes'
 tags:
   - agents
@@ -109,6 +109,18 @@ Then summarize the findings into one recommendation.
 
 By default, subagents do not keep spawning additional subagents. In VS Code, recursive delegation is controlled by the `chat.subagents.allowInvocationsFromSubagents` setting, which is off by default.
 
+### 5. The VS Code agent host and Copilot SDK (VS Code 1.130+)
+
+Starting with VS Code 1.130, agent sessions in VS Code run on a **dedicated agent host** — a separate process that powers Copilot using the same **Copilot SDK** that backs Copilot CLI and the Copilot app. This alignment means:
+
+- Agent behavior and tool capabilities are more consistent across VS Code, the CLI, and the Copilot app.
+- The agent host gives agents access to a richer, unified tool surface.
+- Bugs and improvements to the SDK benefit all Copilot surfaces at once.
+
+You do not need to configure anything to take advantage of this — it applies automatically to agent-mode sessions.
+
+**Assisted tool approvals** (VS Code 1.130+) reduce the number of manual approvals you need to click through during agent sessions. The model evaluates each tool call's risk level before prompting you. Low-risk operations — such as read-only file lookups or well-understood searches — are approved automatically, while higher-risk operations like file writes and shell commands still surface for review. This keeps you in control without slowing down the agent for routine work.
+
 ## Launch subagents in Copilot CLI
 
 In GitHub Copilot CLI, the clearest end-user entry point is **`/fleet`**. Fleet acts as an orchestrator that decomposes a larger objective, launches multiple background subagents, respects dependencies, and then synthesizes the final result.
@@ -217,5 +229,6 @@ Yes. In v1.0.66+, usage-based billing users can configure **subagent concurrency
 - Read [Building Custom Agents](../building-custom-agents/) to design coordinator and worker agents.
 - Revisit [What are Agents, Skills, and Instructions](../what-are-agents-skills-instructions/) for the broader customization model.
 - Keep the [GitHub Copilot Terminology Glossary](../github-copilot-terminology-glossary/) nearby when comparing terminology across products.
+- **VS Code 1.130 release notes**: [The agent host and Assisted tool approvals](https://code.visualstudio.com/updates/v1_130#_the-agent-host) — official documentation for the Copilot SDK agent host and risk-based approval changes.
 
 ---
@@ -3,7 +3,7 @@ title: 'Understanding MCP Servers'
 description: 'Learn how Model Context Protocol servers extend GitHub Copilot with access to external tools, databases, and APIs.'
 authors:
   - GitHub Copilot Learning Hub Team
-lastUpdated: 2026-07-13
+lastUpdated: 2026-07-22
 estimatedReadingTime: '8 minutes'
 tags:
   - mcp
@@ -344,6 +344,29 @@ GitHub organizations can enforce a policy that restricts which third-party MCP s
 
 If you see a warning that an MCP server is blocked, contact your organization administrator to find out which servers are on the allowlist, or switch to an approved alternative.
 
+### MCP Secrets for the Copilot Cloud Agent
+
+When the Copilot coding agent runs in its cloud environment, it cannot access local environment variables from your machine. To pass API keys and connection strings to MCP servers used by the cloud agent, store them as **repository secrets or variables** with the `COPILOT_MCP_` prefix.
+
+Any secret or variable whose name starts with `COPILOT_MCP_` is automatically injected into the cloud agent's environment. For example, if your MCP server needs a `DATABASE_URL`, create a repository secret named `COPILOT_MCP_DATABASE_URL`. The agent will then see it as `DATABASE_URL` in the server's `env` block.
+
+```yaml
+# Example: using a COPILOT_MCP_ secret in .mcp.json
+{
+  "servers": {
+    "mydb": {
+      "command": "npx",
+      "args": ["-y", "@myorg/db-mcp-server"],
+      "env": {
+        "DATABASE_URL": "${COPILOT_MCP_DATABASE_URL}"
+      }
+    }
+  }
+}
+```
+
+Set the secret in your repository under **Settings → Secrets and variables → Copilot**, then prefix it with `COPILOT_MCP_`. The cloud agent picks it up automatically. See [Configure secrets and variables for the coding agent](https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/configure-secrets-and-variables) for details.
+
 ## Common Questions
 
 **Q: Do MCP servers run in the cloud?**
@@ -371,5 +394,6 @@ A: No. Copilot CLI automatically detects Azure DevOps repositories and disables
 - **Build Agents**: [Building Custom Agents](../building-custom-agents/) — Create agents that leverage MCP tools
 - **Explore Examples**: Browse the [Agents Directory](../../agents/) for agents built around MCP server integrations
 - **Protocol Deep Dive**: [MCP Specification](https://spec.modelcontextprotocol.io/) — Learn the protocol details for building your own servers
+- **Cloud Agent Secrets**: [Configure secrets and variables for the coding agent](https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/configure-secrets-and-variables) — Pass MCP credentials using the `COPILOT_MCP_` prefix
 
 ---
@@ -3,7 +3,7 @@ title: 'Using the Copilot Coding Agent'
 description: 'Learn how to use GitHub Copilot coding agent to autonomously work on issues, generate pull requests, and automate development tasks.'
 authors:
   - GitHub Copilot Learning Hub Team
-lastUpdated: 2026-05-13
+lastUpdated: 2026-07-22
 estimatedReadingTime: '12 minutes'
 tags:
   - coding-agent
@@ -109,6 +109,26 @@ steps:
     run: npm test && pytest
 ```
 
+### Controlling Network Access (GA — July 2026)
+
+By default, the coding agent's cloud environment has outbound internet access. You can restrict this using the `allowed-domains` field in `copilot-setup-steps.yml`. This is useful when you want to enforce that the agent only reaches known package registries or internal services:
+
+```yaml
+# .github/copilot-setup-steps.yml
+allowed-domains:
+  - "*.npmjs.com"
+  - "registry.yarnpkg.com"
+  - "pypi.org"
+  - "*.github.com"
+steps:
+  - name: Install dependencies
+    run: npm ci
+```
+
+When `allowed-domains` is specified, all other outbound traffic is blocked. Omit the field (the default) to allow unrestricted internet access. If the setup steps need to download runtimes or tools from multiple sources, add each domain explicitly.
+
+> **Tip**: Start with no restrictions to validate your setup, then progressively tighten `allowed-domains` to match only the services your build actually needs.
+
 ## Assigning Work to the Coding Agent
 
 There are several ways to trigger the coding agent:
@@ -447,6 +467,7 @@ A: Yes. You can specify which agent to use when assigning work — the coding ag
 ## Next Steps
 
 - **Set Up Your Environment**: Create `.github/copilot-setup-steps.yml` for your project
+- **Control Network Access**: [Configure internet access for the coding agent](https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/configuring-copilot-setup-steps) — Use `allowed-domains` to restrict outbound traffic
 - **Create Skills**: [Creating Effective Skills](../creating-effective-skills/) — Build skills the coding agent can use automatically
 - **Add Guardrails**: [Automating with Hooks](../automating-with-hooks/) — Ensure code quality in autonomous sessions
 - **Build Custom Agents**: [Building Custom Agents](../building-custom-agents/) — Create specialized agents for the coding agent to use