GitHub Copilot code review reviews a pull request when you add Copilot as a reviewer, leaves comments labelled High, Medium or Low, and often attaches suggested changes you can commit, according to GitHub’s code review how-to. You can also set it to review pull requests automatically and to re-review new pushes.
Applies to: GitHub Copilot code review on GitHub.com, GitHub CLI and IDEs, per GitHub Docs. Last checked: October 29, 2026.
On this page
Where Copilot code review is available
GitHub lists Copilot code review as available on all paid Copilot plans, and supported on GitHub.com, GitHub CLI, GitHub Mobile, VS Code, Visual Studio, Xcode and JetBrains IDEs, with Azure DevOps in public preview (About Copilot code review). If you get Copilot from an organization, the organization must enable the Copilot code review option in its Copilot policy settings for reviews on GitHub.com or GitHub Mobile.
Copilot Business and Copilot Enterprise organizations can also let members without a Copilot license use code review on GitHub.com. That needs two policies, AI credits paid usage and the sub-policy that allows members without a license to use Copilot code review; the second is disabled by default (About Copilot code review).
Request a review on GitHub
From GitHub’s how-to:
- Create a pull request or open an existing one.
- Under “Reviewers” in the right sidebar, next to Copilot, click Request.
- Wait for the review; GitHub says this usually takes less than 30 seconds.
- Read Copilot’s comments. Each one carries a severity level of “High,” “Medium,” or “Low”.
By default Copilot leaves a “Comment” review, not “Approve” or “Request changes”, so its reviews do not count toward required approvals unless approvals are configured (see below). GitHub also says Copilot is not guaranteed to spot all problems and asks you to validate its feedback and supplement it with a human review (About Copilot code review).
You can request the review through the REST API by requesting copilot-pull-request-reviewer[bot] as a reviewer (how-to).
Request a review from GitHub CLI
GitHub documents these commands for an installed and authenticated GitHub CLI (how-to, GitHub CLI tab). When creating a pull request:
gh pr create --reviewer @copilot
On an existing pull request:
gh pr edit PR-NUMBER --add-reviewer @copilot
Replace PR-NUMBER with the pull request number; if you have the pull request’s branch checked out, you can omit it.
Apply suggestions or hand them to the cloud agent
Where possible, Copilot’s comments include suggested changes. You can accept a single suggestion and commit it, or accept a group of suggestions together in a single commit (how-to).
If both Copilot code review and the Copilot cloud agent are enabled, a review comment shows Fix with Copilot. GitHub says this creates a draft comment where you tell Copilot which feedback to address, and you choose whether it opens a new pull request against your branch or commits to the same pull request. Passing suggestions to the cloud agent is in public preview (About Copilot code review).
Copilot’s review comments behave like human review comments: you can react to, comment on, resolve and hide them. Comments you add under them are visible to people, but GitHub says they are not visible to Copilot and Copilot won’t reply (how-to).
Re-review after new commits
When you push changes to a pull request Copilot has reviewed, it won’t re-review automatically unless automatic reviews are enabled with Review new pushes. To ask again by hand, click the re-request review button next to Copilot’s name in the Reviewers menu (how-to).
GitHub’s note: when re-reviewing, Copilot may repeat the same comments, even ones dismissed with “Resolve conversation” or downvoted with the thumbs down button.
Turn on automatic reviews
GitHub documents three places to switch automatic review on (Configuring code review):
- Your own pull requests: in your Copilot settings, enable Automatic Copilot code review, and optionally Review new pushes and Review draft pull requests. This is available on Copilot Pro, Pro+ and Max, and with a Business or Enterprise license, but not for managed user accounts.
- A repository: create a branch ruleset in the repository settings, add target branches such as Include default branch, and under “Branch rules” select Automatically request Copilot code review, optionally with Review new pushes and Review draft pull requests.
- An organization or enterprise: create a ruleset that targets repositories by pattern (organization) or organizations and repositories (enterprise).
Without push reviews, an automatic review runs when a pull request is created as “Open” or the first time a draft is switched to “Open” (About Copilot code review). User settings and rulesets are evaluated separately; if both apply, Copilot still posts one review, and your own settings cannot turn off push or draft reviews that a ruleset turned on.
Choose the review effort
Copilot code review has three effort levels (About Copilot code review):
| Level | What GitHub says it does | Typical range per review | Approximate average |
|---|---|---|---|
| Lite | Fast, targeted feedback on common issues such as bugs, security vulnerabilities and style inconsistencies | $0.05 USD to $1 USD | $0.25 USD |
| Balanced (default) | Routes the pull request to a higher-reasoning model for longer analysis | $0.25 USD to $5 USD | $1.50 USD |
| Max (public preview) | Multiple high-reasoning models for the most intensive review | $1.50 USD to $25 USD | $10 USD |
The figures are GitHub’s estimates in AI credits; GitHub says consumption generally grows with pull request size and custom instructions, and the estimates exclude GitHub Actions minutes. You pick the level under Reviewers before requesting a review, or set a default in your settings; organization owners set a default for automatic reviews, repositories can override it, and owners can set a “Maximum review effort” (Configuring code review).
Billing and GitHub Actions minutes
GitHub says a review has two cost components: AI credits for the model interaction and GitHub Actions minutes for the agentic capabilities (context gathering and tool use). Automatic reviews are attributed to the pull request author; a manual request is attributed to the person who requested it (About Copilot code review). For how AI credits work on each plan, see GitHub Copilot AI credits.
Code review runs on standard GitHub-hosted runners by default; self-hosted runners do not consume Actions minutes. If an organization has disabled GitHub-hosted runners, the agentic capabilities are unavailable and reviews fall back to a more limited review.
Copilot approvals
Every review includes an approval assessment in the overview comment, which on its own does not count toward merge requirements. Approvals are off by default; when enabled, Copilot can submit an approving review that satisfies a required-approval rule, and the approval is dismissed if new commits are pushed (how-to). In repository settings, under “Auto-approval”, the toggles are Allow Copilot to approve pull requests and Allow Copilot approvals to count toward merge requirements, with optional file-path globs (up to 15) that limit which pull requests count (Configuring code review).
Add review instructions
Copilot code review reads .github/copilot-instructions.md for repository-wide guidance, .github/instructions/**/*.instructions.md for path-specific rules, an AGENTS.md in the repository root, and CLAUDE.md, GEMINI.md and REVIEW.md files if they exist (how-to). The file formats are covered in the Copilot custom instructions guide.
GitHub says Copilot reads instructions and skills from the pull request’s head branch, not the base branch, so you can test changes to them in the same pull request before merging (About Copilot code review).
GitHub’s customization tutorial recommends short, imperative bullet points under distinct headings, and limiting any single instruction file to about 1,000 lines. Its example:
## Security Critical Issues
- Check for hardcoded secrets, API keys, or credentials
- Look for SQL injection and XSS vulnerabilities
- Verify proper input validation and sanitization
The same tutorial lists instructions code review does not support: changing comment formatting, modifying the pull request overview comment, blocking merges or generating changelog entries, following external links, and vague requests such as “Be more accurate”. It suggests starting with 10–20 specific instructions and testing them on real pull requests.
Skills and MCP servers
Code review can use agent skills in .github/skills and MCP servers configured in the repository’s Copilot settings when they are relevant; GitHub suggests a review-focused skill directory name such as code-review (how-to). The GitHub MCP server and Playwright MCP server are enabled by default, and repository MCP configuration applies to both the cloud agent and code review. The repository setting Allow Copilot to use MCP tools when reviewing pull requests is on by default; turn it off to keep MCP servers for the cloud agent only.
To see which skill or MCP server a comment relied on, check the attributions at the bottom of each review comment, or open the linked review session from the pull request timeline and read its logs.
Some files are never reviewed: dependency management files such as package.json and Gemfile.lock, log files and SVG files (About Copilot code review).
