← All integrationsINTEGRATION · COPILOTS AND SAAS AI

Kapālins for GitHub Copilot

GitHub Copilot lives in two places: your GitHub organisation and every developer’s laptop. Kapālins reads the organisation audit log for seats, policies and usage, and the device sensor sees Copilot and the other coding agents running in the IDE, under one policy.

See it governed liveSetup in four steps

Seats, policies and usage

The GitHub organisation audit log, filtered to Copilot, attributed to a person from your directory.

The agents on the laptop

The device sensor finds Copilot, Cursor, Claude Code and other coding agents, and agent hooks ask Kapālins before a tool runs.

One policy, both places

The same rules decide what Copilot may do in the organisation and on the device, and a finding opens one incident.

AFTER THE FACT

GitHub Copilot in the same timeline as everything else.

Kapālins reads the GitHub organisation audit log API (GitHub Enterprise Cloud), filtered to Copilot actions every 15 minutes, turns each record into one event shape, and attributes it to a person from your directory.

  • A high-water mark, so nothing is read twice or skipped
  • The raw record kept exactly as it arrived
  • Source label "GitHub Copilot" on every row
Kapālins Logs: one timeline of AI requests and policy verdicts
The Kapālins timeline in the pilot tenant on production. Personal addresses masked.
ON THE LAPTOP

The GitHub Copilot that runs on the device.

The Kapālins sensor finds AI tools, coding agents and MCP servers on enrolled laptops, ranks them by exposure, and enforces the same policy there.

  • Agent hooks ask Kapālins before a tool runs
  • Personal-account use found and coached
Kapālins Shadow AI discovery: AI tools on devices ranked by exposure
Shadow AI in the pilot tenant: the AI tools found on enrolled laptops, ranked by exposure.
DETECT AND ACT

A finding, not a log line.

Rule families and custom checks run on GitHub Copilot events after the fact. What matters opens an incident with the person, the rule and the evidence, and is pushed to your SIEM or ITSM.

  • Mute, risk-accept or escalate from the card
  • Notification clocks start when an incident is reportable
Kapālins incidents: sensitive data stopped before it left
Incidents in the pilot tenant: sensitive data stopped before it reached an AI service. Personal addresses masked.
Setup

Four steps.

  1. Grant a read credentialA token with audit log read on the organisation.
  2. Paste it in KapālinsIntegrations › GitHub Copilot › Create. A live read validates it before anything is stored.
  3. Watch the first sweepLogs shows each event with its source, the person and the rules that fired.
  4. Tune the rulesMute, risk-accept or escalate from the incident card.
Request a briefing

See GitHub Copilot governed in thirty minutes.

Bring the person who holds the credential. We connect it live and watch the first events land.

Request a briefing All integrations
FAQ

Questions buyers ask.

Does Kapālins change anything in GitHub Copilot?

No. The connector reads with the credential you grant, or receives what the platform pushes. Nothing is written back.

How current is the timeline?

Pulled sources are swept every 15 minutes; pushed sources arrive as they happen. Each window overlaps the last, so a late record is caught next time.

Where is the credential kept?

Encrypted at rest with AES-256-GCM, decrypted only inside the ingestion job and the connect-time validation, never returned to the browser or written to a log.