
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
copilot-proxy-api
Advanced tools
Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code and Codex CLI!
[!WARNING] This is a reverse-engineered proxy of GitHub Copilot API. It is not supported by GitHub, and may break unexpectedly. Use at your own risk.
[!WARNING] GitHub Security Notice:
Excessive automated or scripted use of Copilot (including rapid or bulk requests, such as via automated tools) may trigger GitHub's abuse-detection systems.
You may receive a warning from GitHub Security, and further anomalous activity could result in temporary suspension of your Copilot access.GitHub prohibits use of their servers for excessive automated bulk activity or any activity that places undue burden on their infrastructure.
Please review:
Use this proxy responsibly to avoid account restrictions.
This project is a fork of copilot-api by Erick Christian. Thank you for the original work!
Note: If you are using opencode, you do not need this project. Opencode supports GitHub Copilot provider out of the box.
A reverse-engineered proxy for the GitHub Copilot API that exposes it as an OpenAI and Anthropic compatible service. This allows you to use GitHub Copilot with any tool that supports the OpenAI Chat Completions API or the Anthropic Messages API, including to power Claude Code.
/v1/chat/completions, /v1/responses, /v1/models, /v1/embeddings) and Anthropic-compatible (/v1/messages) API.--claude-code).--rate-limit) and a waiting mechanism (--wait) to prevent errors from rapid requests.--manual).--show-token).This proxy is tuned for Claude Code interop. The Anthropic Messages API surface is implemented to the extent Claude Code actually exercises it; server-side / billing-side Anthropic features that Copilot does not provide are deliberately not faked.
What works:
/v1/messages (streaming and non-streaming) with text, image, tool_use, tool_result, and document (PDF) blocks./v1/messages/count_tokens (input tokens only, per Anthropic spec).error.type mapping (invalid_request_error, authentication_error, permission_error, not_found_error, request_too_large, rate_limit_error, overloaded_error, api_error).event: ping every 15 s) so Claude Code's 90 s idle watchdog doesn't tear down slow streams.content_block_stop / message_stop events emitted before the error event so Claude Code's content-block index tracker doesn't throw Content block not found.prompt is too long so Claude Code triggers its built-in compaction flow.response.model (Copilot's internal id is not leaked).request-id / x-request-id response headers.content_filter → refusal (Claude Code has dedicated UX for refusal blocks).document blocks ≤ 3 MB. Password-protected PDFs are rejected with a Claude-Code-recognizable error message.Known gaps (these reflect Copilot's actual capabilities — they are not bugs to file):
claude-opus-4.6-1m, regardless of the model's claimed 1 M token window. The proxy applies an OpenCode-style context-management pass (prune old tool outputs → strip old base64 images → drop oldest messages) and a 2,500,000-byte backstop before sending. Effective ceiling is ~500 K tokens.prompt_tokens_details.cached_tokens counter that the proxy maps to cache_read_input_tokens. There is no cache_creation_input_tokens because Copilot doesn't write caches on our behalf. The proxy strips client-supplied cache_control markers via translation.thinking blocks in responses. Copilot doesn't expose extended thinking. Inbound thinking blocks from the assistant turn history are dropped on the request side rather than promoted to text (which would corrupt turn semantics).computer_use, web_search, code_execution, text_editor, bash, and other Anthropic-hosted tools are not implemented — Copilot has no equivalents.mcp_servers field, organization headers. Claude Code does not depend on these for the proxy use case.pdf-parse. Visual-only PDFs (scans, image-only diagrams) lose their content. For larger / image-heavy PDFs, Claude Code already pre-extracts to images on its side before sending.api.anthropic.com tests in CI. The verify harness (bun run verify) is fixture-based and runs offline.https://github.com/user-attachments/assets/7654b383-669d-4eb9-b23c-06d7aefee8c5
To install dependencies, run:
bun install
Build image
docker build -t copilot-proxy-api .
Run the container
# Create a directory on your host to persist the GitHub token and related data
mkdir -p ./copilot-data
# Run the container with a bind mount to persist the token
# This ensures your authentication survives container restarts
docker run -p 4141:4141 -v $(pwd)/copilot-data:/root/.local/share/copilot-proxy-api copilot-proxy-api
Note: The GitHub token and related data will be stored in
copilot-dataon your host. This is mapped to/root/.local/share/copilot-proxy-apiinside the container, ensuring persistence across restarts.
You can pass the GitHub token directly to the container using environment variables:
# Build with GitHub token
docker build --build-arg GH_TOKEN=your_github_token_here -t copilot-proxy-api .
# Run with GitHub token
docker run -p 4141:4141 -e GH_TOKEN=your_github_token_here copilot-proxy-api
# Run with additional options
docker run -p 4141:4141 -e GH_TOKEN=your_token copilot-proxy-api start --verbose --port 4141
version: "3.8"
services:
copilot-proxy-api:
build: .
ports:
- "4141:4141"
environment:
- GH_TOKEN=your_github_token_here
restart: unless-stopped
The Docker image includes:
You can run the project directly using npx:
npx copilot-proxy-api@latest start
With options:
npx copilot-proxy-api@latest start --port 8080
For authentication only:
npx copilot-proxy-api@latest auth
Copilot API now uses a subcommand structure with these main commands:
start: Start the Copilot API server. This command will also handle authentication if needed.auth: Run GitHub authentication flow without starting the server. This is typically used if you need to generate a token for use with the --github-token option, especially in non-interactive environments.check-usage: Show your current GitHub Copilot usage and quota information directly in the terminal (no server required).debug: Display diagnostic information including version, runtime details, file paths, and authentication status. Useful for troubleshooting and support.The following command line options are available for the start command:
| Option | Description | Default | Alias |
|---|---|---|---|
| --port | Port to listen on | 4141 | -p |
| --verbose | Enable verbose logging | false | -v |
| --account-type | Account type to use (individual, business, enterprise) | individual | -a |
| --manual | Enable manual request approval | false | none |
| --rate-limit | Rate limit in seconds between requests | none | -r |
| --wait | Wait instead of error when rate limit is hit | false | -w |
| --github-token | Provide GitHub token directly (must be generated using the auth subcommand) | none | -g |
| --claude-code | Generate a command to launch Claude Code with Copilot API config | false | -c |
| --show-token | Show GitHub and Copilot tokens on fetch and refresh | false | none |
| --proxy-env | Initialize proxy from environment variables | false | none |
| Option | Description | Default | Alias |
|---|---|---|---|
| --verbose | Enable verbose logging | false | -v |
| --show-token | Show GitHub token on auth | false | none |
| Option | Description | Default | Alias |
|---|---|---|---|
| --json | Output debug info as JSON | false | none |
The server exposes several endpoints to interact with the Copilot API. It provides OpenAI-compatible endpoints and now also includes support for Anthropic-compatible endpoints, allowing for greater flexibility with different tools and services.
These endpoints mimic the OpenAI API structure.
| Endpoint | Method | Description |
|---|---|---|
POST /v1/chat/completions | POST | Creates a model response for the given chat conversation. |
POST /v1/responses | POST | OpenAI Responses API for newer models (e.g., gpt-5.x). |
GET /v1/models | GET | Lists the currently available models. |
POST /v1/embeddings | POST | Creates an embedding vector representing the input text. |
These endpoints are designed to be compatible with the Anthropic Messages API.
| Endpoint | Method | Description |
|---|---|---|
POST /v1/messages | POST | Creates a model response for a given conversation. |
POST /v1/messages/count_tokens | POST | Calculates the number of tokens for a given set of messages. |
New endpoints for monitoring your Copilot usage and quotas.
| Endpoint | Method | Description |
|---|---|---|
GET /usage | GET | Get detailed Copilot usage statistics and quota information. |
GET /token | GET | Get the current Copilot token being used by the API. |
Using with npx:
# Basic usage with start command
npx copilot-proxy-api@latest start
# Run on custom port with verbose logging
npx copilot-proxy-api@latest start --port 8080 --verbose
# Use with a business plan GitHub account
npx copilot-proxy-api@latest start --account-type business
# Use with an enterprise plan GitHub account
npx copilot-proxy-api@latest start --account-type enterprise
# Enable manual approval for each request
npx copilot-proxy-api@latest start --manual
# Set rate limit to 30 seconds between requests
npx copilot-proxy-api@latest start --rate-limit 30
# Wait instead of error when rate limit is hit
npx copilot-proxy-api@latest start --rate-limit 30 --wait
# Provide GitHub token directly
npx copilot-proxy-api@latest start --github-token ghp_YOUR_TOKEN_HERE
# Run only the auth flow
npx copilot-proxy-api@latest auth
# Run auth flow with verbose logging
npx copilot-proxy-api@latest auth --verbose
# Show your Copilot usage/quota in the terminal (no server needed)
npx copilot-proxy-api@latest check-usage
# Display debug information for troubleshooting
npx copilot-proxy-api@latest debug
# Display debug information in JSON format
npx copilot-proxy-api@latest debug --json
# Initialize proxy from environment variables (HTTP_PROXY, HTTPS_PROXY, etc.)
npx copilot-proxy-api@latest start --proxy-env
After starting the server, a URL to the Copilot Usage Dashboard will be displayed in your console. This dashboard is a web interface for monitoring your API usage.
npx copilot-proxy-api@latest start
https://voidsteed.github.io/copilot-proxy-api?endpoint=http://localhost:4141/usage
start.bat script on Windows, this page will open automatically.The dashboard provides a user-friendly interface to view your Copilot usage data:
https://voidsteed.github.io/copilot-proxy-api?endpoint=http://your-api-server/usageThis proxy can be used to power Claude Code, an experimental conversational AI assistant for developers from Anthropic.
There are two ways to configure Claude Code to use this proxy:
--claude-code flagTo get started, run the start command with the --claude-code flag:
npx copilot-proxy-api@latest start --claude-code
You will be prompted to select a primary model and a "small, fast" model for background tasks. After selecting the models, a command will be copied to your clipboard. This command sets the necessary environment variables for Claude Code to use the proxy.
Paste and run this command in a new terminal to launch Claude Code.
settings.jsonAlternatively, you can configure Claude Code by creating a .claude/settings.json file in your project's root directory. This file should contain the environment variables needed by Claude Code. This way you don't need to run the interactive setup every time.
Here is an example .claude/settings.json file:
{
"env": {
"ANTHROPIC_BASE_URL": "http://localhost:4141/",
"ANTHROPIC_AUTH_TOKEN": "dummy",
"ANTHROPIC_MODEL": "claude-opus-4.6-1m",
"ANTHROPIC_SMALL_FAST_MODEL": "claude-sonnet-4",
"DISABLE_NON_ESSENTIAL_MODEL_CALLS": "1",
"CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1"
},
"permissions": {
"deny": [
"WebSearch"
]
}
}
Note: The recommended model is
claude-opus-4.6-1mwhich supports 1M context window. If your tool doesn't support specifyingclaude-opus-4.6-1m, you can useclaude-opus-4.6instead - the proxy will automatically map it to the correct model.
You can find more options here: [Claude Code settings](https://docs.anthropic.com/en/docs/claude-code/settings#environment-variables)
You can also read more about IDE integration here: [Add Claude Code to your IDE](https://docs.anthropic.com/en/docs/claude-code/ide-integrations)
## Using with Codex CLI
This proxy supports the [OpenAI Codex CLI](https://github.com/openai/codex) through the Responses API endpoint (`/v1/responses`). Latest Codex versions use provider configuration from `~/.codex/config.toml`; setting `OPENAI_BASE_URL` alone is not enough.
### Configuration
Add the following to your `~/.codex/config.toml`:
```toml
model = "gpt-5.5"
model_provider = "copilot_proxy"
model_reasoning_effort = "high"
[model_providers.copilot_proxy]
name = "GitHub Copilot via copilot-proxy-api"
base_url = "http://localhost:4141/v1"
wire_api = "responses"
Start the proxy server and run Codex:
# Terminal 1: start the proxy
npx copilot-proxy-api@latest start
# Terminal 2: run Codex
codex
To test the setup non-interactively:
codex exec "Say exactly: proxy ok"
Expected output includes proxy ok and Codex should show provider: copilot_proxy.
To use Codex's default backend again, remove or comment this line in ~/.codex/config.toml:
model_provider = "copilot_proxy"
Or override it for one run:
codex -c model_provider='"openai"'
service_tier = "fast" is ChatGPT-plan-specific. Codex may send it, but Copilot's Responses API rejects it, so the proxy strips it before forwarding.model_reasoning_effort = "high" is supported and is forwarded through the Responses API request./v1/models list format. This does not block normal model calls.The project can be run from source in several ways:
bun run dev
bun run start
--manual: Enables manual approval for each request, giving you full control over when requests are sent.--rate-limit <seconds>: Enforces a minimum time interval between requests. For example, copilot-proxy-api start --rate-limit 30 will ensure there's at least a 30-second gap between requests.--wait: Use this with --rate-limit. It makes the server wait for the cooldown period to end instead of rejecting the request with an error. This is useful for clients that don't automatically retry on rate limit errors.--account-type flag (e.g., --account-type business). See the official documentation for more details.FAQs
Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code and Codex CLI!
The npm package copilot-proxy-api receives a total of 247 weekly downloads. As such, copilot-proxy-api popularity was classified as not popular.
We found that copilot-proxy-api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.