Connect GitHub Copilot to ChatGPT: Analyze Usage and Report on Metrics

If you need to connect GitHub Copilot to ChatGPT to analyze developer usage, track enterprise seat costs, or manage content exclusion policies, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's tool calling capabilities and GitHub Copilot's REST APIs. You can either spend weeks building and maintaining this custom middleware, or use a managed infrastructure platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on connecting GitHub Copilot to Claude or explore our broader architectural overview on connecting GitHub Copilot to AI Agents.

Giving a Large Language Model (LLM) read and write access to GitHub Copilot's administration API is an engineering challenge. The Copilot API is not a simple CRUD interface. Extracting usage metrics requires handling temporary signed download links, and managing content exclusions requires navigating strict, volatile JSON map structures. Every time GitHub updates an endpoint or changes a payload requirement, your custom server code must be updated, redeployed, and tested.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for GitHub Copilot, connect it natively to ChatGPT, and execute complex analytics and administrative workflows using natural language.

The Engineering Reality of the GitHub Copilot API

A custom MCP server is essentially a self-hosted API proxy layer. While the open MCP standard provides a predictable way for models like ChatGPT to discover tools, implementing it against GitHub Copilot's specific administrative API is exceptionally painful.

If you decide to build a custom MCP server for GitHub Copilot, you own the entire API lifecycle. Here are the specific integration challenges that break standard assumptions when working with GitHub Copilot:

Asynchronous NDJSON Dump Retrieval

When an LLM asks "Get me the Copilot usage metrics for the last 28 days," you cannot simply make a GET /usage request and receive a clean JSON array of statistics. The GitHub Copilot enterprise usage endpoints (/enterprises/{enterprise}/copilot/usage) process massive amounts of telemetry. Instead of returning the data directly, the API returns an object containing download_links.

These links are temporary, signed URLs that point to raw Newline Delimited JSON (NDJSON) files. If you build a custom MCP server, you must write logic to fetch the signed URL, make a secondary HTTP request to download the NDJSON blob, stream and parse the file line-by-line, and reformat it into a structured summary before handing it back to the LLM. If you simply pass the raw download URL to ChatGPT, the model will not be able to execute the secondary request to retrieve the actual metrics.

Volatile Content Exclusion Payloads

Enforcing security policies often involves preventing Copilot from reading specific repositories or file paths. The git_hub_copilot_content_exclusions_bulk_update endpoint is notoriously strict.

The request body expects a dynamic map where the keys are repository names (or "*" for all repositories) and the values are arrays of excluded paths.

{
  "octo-repo": ["/src/kernel.rs"],
  "internal-auth": ["/secrets/*"]
}

If an LLM hallucinates duplicate repository keys in the JSON body, or attempts to include JSON comments (which LLMs frequently do when generating configurations), the GitHub API rejects the entire payload. Your custom MCP server must implement strict input sanitization, deduplication, and schema validation before forwarding the LLM's payload to GitHub.

Disjointed Seat Management Mechanics

Provisioning Copilot seats is not a unified operation. The API strictly separates operations for assigning individual users (selected_usernames) versus assigning entire teams (selected_teams). Furthermore, if you attempt to cancel a seat for a user who does not have an active assignment, the API throws specific error codes that can confuse an agentic loop. Your MCP tools must be perfectly scoped so ChatGPT knows exactly which endpoint to call depending on whether it is managing an organization member or a GitHub Team.

Creating the GitHub Copilot MCP Server

Instead of building a Node.js or Python proxy to handle these quirks, you can use Truto to generate a secure MCP server. Truto handles the OAuth credential lifecycle, token refreshing, and JSON-RPC 2.0 protocol translation.

To generate your server, you first connect your GitHub organization or enterprise as an Integrated Account in Truto. Once connected, you can generate the MCP endpoint using either the UI or the API.

Method 1: Via the Truto UI

For teams who want a zero-code setup, you can generate the server directly from the dashboard.

1. Log into your Truto dashboard and navigate to the Integrated Accounts page.
2. Select your connected GitHub Copilot account.
3. Click the MCP Servers tab.
4. Click Create MCP Server.
5. Select your desired configuration. You can optionally restrict the server to specific operations (e.g., methods: ["read"]) or specific functional tags (e.g., tags: ["billing", "metrics"]).
6. Copy the generated MCP server URL. It will look like this: https://api.truto.one/mcp/a1b2c3d4e5f6...

Method 2: Via the API

If you are programmatically deploying infrastructure for your team, you can generate the MCP server dynamically by making an authenticated POST request to the Truto API.

Request:

curl -X POST https://api.truto.one/integrated-account/<INTEGRATED_ACCOUNT_ID>/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Copilot Usage Analytics Server",
    "config": {
      "methods": ["read", "write"],
      "tags": ["metrics", "seats", "policies"]
    }
  }'

Response:

{
  "id": "mcp_8f7d6c5b",
  "name": "Copilot Usage Analytics Server",
  "config": {
    "methods": ["read", "write"],
    "tags": ["metrics", "seats", "policies"]
  },
  "expires_at": null,
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f67890"
}

This single URL encodes the routing, authentication, and specific tool filters for your integrated account.

Connecting the MCP Server to ChatGPT

Once you have your Truto MCP URL, you need to register it with your ChatGPT environment. You can do this through the ChatGPT user interface or via a local configuration file if you are running a custom client.

Method A: Via the ChatGPT UI

If you are using ChatGPT Pro, Plus, Business, Enterprise, or Education, you can connect the server directly in the browser.

1. Open ChatGPT and navigate to Settings.
2. Select Apps and click on Advanced settings.
3. Ensure that Developer mode is enabled (MCP support requires this flag).
4. Under MCP servers / Custom connectors, click to add a new server.
5. Enter a name (e.g., "GitHub Copilot Analytics").
6. Paste your Truto MCP server URL into the Server URL field.
7. Click Save.

ChatGPT will immediately perform an MCP handshake (initialize), request the tool schemas (tools/list), and make them available in your chat interface.

Method B: Via Manual Config File

If you are orchestrating agents locally or using an MCP-compatible CLI client, you can add the Truto URL using Server-Sent Events (SSE).

{
  "mcpServers": {
    "github-copilot": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/a1b2c3d4e5f67890"
      ]
    }
  }
}

GitHub Copilot Hero Tools

Truto automatically derives MCP tools from GitHub's REST API documentation. Here are the highest-leverage tools available for ChatGPT when analyzing Copilot telemetry and managing seats.

Get Enterprise Usage Reports

Tool: list_all_git_hub_copilot_enterprise_usage_reports_latest

This tool retrieves the latest 28-day Copilot usage metrics report for a GitHub enterprise. It returns the report period and the signed download links for the NDJSON files containing the raw telemetry.

Usage Note: Because this returns a download link rather than raw data, you should pair this tool with a Python code execution environment in ChatGPT, allowing the model to download and parse the NDJSON file natively.

"Fetch the latest 28-day enterprise usage report for the 'acme-corp' enterprise. Once you have the download links, use your python tool to download the NDJSON file, calculate the total lines of code accepted across all repositories, and plot a chart of daily active users."

Get Organization Seat Assignments

Tool: list_all_git_hub_copilot_seats

Retrieves a complete list of all users currently assigned a Copilot seat within a specific organization. The payload includes timestamps for when the seat was created, updated, and the user's last_activity_at.

Usage Note: This is the primary tool for auditing seat utilization. If a user has a seat but their last_activity_at is more than 30 days old, they are a prime candidate for offboarding.

"List all the GitHub Copilot seats for the 'acme-engineering' organization. Find any developers whose last activity was more than 45 days ago and list their GitHub handles in a markdown table so I can review them for deprovisioning."

Bulk Revoke Inactive Seats

Tool: git_hub_copilot_seat_users_bulk_delete

Allows the LLM to remove organization members from the GitHub Copilot subscription, revoking their access and cancelling their seat billing. It accepts an array of selected_usernames.

Usage Note: This tool executes state changes. Always ensure ChatGPT provides a confirmation step before executing the deletion to prevent accidental unassignments.

"I've reviewed the list of inactive users: @jdoe, @asmith, and @bwayne. Go ahead and bulk delete their Copilot seats from the 'acme-engineering' organization to save on billing."

Enforce Content Exclusions

Tool: git_hub_copilot_content_exclusions_bulk_update

Replaces all existing Copilot content exclusion path rules for an organization. This prevents the Copilot agent from reading sensitive files or repositories.

Usage Note: This is a destructive replace operation, not a patch. ChatGPT must fetch the existing rules using list_all_git_hub_copilot_content_exclusions first, append the new paths, and then push the updated payload back.

"We need to ensure Copilot never reads our infrastructure secrets. Update the content exclusions for the 'acme-infrastructure' organization to include the paths '/terraform/production/secrets/' and '/k8s/certs/'. Make sure to preserve all existing exclusion rules."

View Billing and Policy Settings

Tool: list_all_git_hub_copilot_billing

Retrieves the high-level seat breakdown and feature policies for a GitHub organization. It returns the current state of policies like ide_chat, platform_chat, cli, and public_code_suggestions.

Usage Note: This is the fastest way for an IT admin agent to verify if public code suggestions have been successfully disabled across the organization to meet compliance standards.

"Check the Copilot billing and policy settings for the 'acme-engineering' org. Confirm what our total seat count is, and verify that the 'public_code_suggestions' policy is strictly set to 'disabled'."

For the complete schema definitions and the full inventory of GitHub Copilot endpoints, visit the GitHub Copilot integration page.

Workflows in Action

When you connect GitHub Copilot to ChatGPT via MCP, you graduate from clicking through dashboards to orchestrating complex administrative tasks using natural language. Here are two real-world workflows.

1. The Automated Seat ROI Audit

Enterprise Copilot licenses are expensive. IT administrators frequently need to audit utilization to ensure they aren't paying for developers who have stopped using the tool.

"Run an ROI audit on our 'acme-engineering' organization. Pull the current billing settings to get the total seat count. Then, list all assigned seats and identify users who have not been active in the last 60 days. Finally, revoke the seats for those inactive users."

Step-by-step execution:

1. ChatGPT calls list_all_git_hub_copilot_billing to understand the current seat breakdown and organization state.
2. ChatGPT calls list_all_git_hub_copilot_seats and filters the returned JSON array, isolating users where the last_activity_at timestamp is older than 60 days.
3. ChatGPT presents the list of inactive users to the administrator in the chat interface and asks for confirmation.
4. Upon confirmation, ChatGPT calls git_hub_copilot_seat_users_bulk_delete, passing the array of inactive handles to execute the removal.

sequenceDiagram
  participant Admin as IT Admin
  participant ChatGPT as ChatGPT
  participant Truto as Truto Proxy
  participant API as GitHub API

  Admin->>ChatGPT: "Audit seats and revoke inactive users"
  ChatGPT->>Truto: tools/call list_all_git_hub_copilot_seats
  Truto->>API: GET /orgs/acme-engineering/copilot/billing/seats
  API-->>Truto: Return 200 OK (User Activity Data)
  Truto-->>ChatGPT: Return JSON Array
  ChatGPT->>Admin: "Found 3 inactive users. Proceed with deletion?"
  Admin->>ChatGPT: "Yes, proceed."
  ChatGPT->>Truto: tools/call git_hub_copilot_seat_users_bulk_delete
  Truto->>API: DELETE /orgs/acme-engineering/copilot/billing/selected_users
  API-->>Truto: Return 200 OK (Seats Cancelled)
  Truto-->>ChatGPT: Success Confirmation

2. Securing Sensitive Repositories

Security engineers must ensure that AI coding assistants do not train on or read from repositories containing proprietary algorithms or hardcoded legacy secrets.

"Review the content exclusions for the 'acme-core' organization. I need you to add a new rule that excludes all '.env' files and everything in the '/legacy-keys' directory across all repositories. Do not overwrite our existing rules."

Step-by-step execution:

1. ChatGPT calls list_all_git_hub_copilot_content_exclusions to fetch the current dynamic map of repositories and their excluded paths.
2. ChatGPT parses the map, iterating through the repositories, and appends "**/.env" and "/legacy-keys/**" to the existing arrays.
3. ChatGPT calls git_hub_copilot_content_exclusions_bulk_update with the newly constructed, merged JSON map, enforcing the policy at the organization level.

Security and Access Control

Giving an LLM access to your enterprise GitHub Copilot environment introduces security risks. Truto's MCP architecture provides several layers of access control to restrict what ChatGPT can do.

• Method Filtering: When generating the MCP server, you can configure it with methods: ["read"]. This ensures the server will only generate tools for GET operations (like listing seats or viewing metrics) and will physically strip write operations (like revoking seats or updating policies) from the server.
• Tag Filtering: You can restrict the server's scope using tags: ["metrics"]. This ensures ChatGPT only sees tools related to usage analytics and remains blind to tools related to billing or user administration.
• Require API Token Auth: By setting require_api_token_auth: true, you force the MCP client (ChatGPT) to pass a valid Truto API token in the Authorization header. This ensures that possession of the MCP URL alone is not enough to execute tools.
• Time-to-Live (Expires At): You can set an expires_at timestamp. Truto will automatically destroy the MCP server and revoke its access at the specified time, which is ideal for temporary audit tasks.
• Rate Limits: Truto does not retry, throttle, or apply backoff on rate limit errors. When the GitHub API returns an HTTP 429, Truto passes that error directly back to ChatGPT. Truto normalizes the upstream rate limit data into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset). ChatGPT is responsible for reading these headers and handling backoff logic natively.

Moving Faster with Managed Infrastructure

Connecting GitHub Copilot to ChatGPT fundamentally changes how IT and engineering teams manage AI developer tools. Instead of downloading CSVs, writing Python parsing scripts, and clicking through GitHub settings panels, administrators can simply converse with their infrastructure.

By leveraging Truto's dynamic MCP server generation, you bypass the friction of writing OAuth refresh logic, handling NDJSON download mechanics, and maintaining JSON-RPC protocol translations. Your team can focus on defining operational policies, while Truto handles the API execution layer.

If you want to stop building boilerplate integrations and start deploying AI workflows, talk to us about Truto today.