Copilot for Code Review and Security

Copilot as a Code Reviewer

Copilot Code Review is a feature that reviews pull requests automatically or on demand. It reads the diff, understands the context of the changes, and leaves inline comments directly on the PR — just like a human reviewer would, but instantly and without requiring another developer's attention.

This is not just syntax checking. Copilot reads the logic of the code and flags things like: a condition that is always true, a missing null check that would cause a runtime error in a common edge case, a security issue like a SQL injection risk from unsanitised input, or a function that does not handle the documented error codes.

Triggering a Code Review

There are two ways to trigger a Copilot review on a pull request:

• Automatic review — If your repository is configured to request Copilot's review automatically (set this in repository settings → Copilot → Code Review), Copilot will post its review when the PR is opened.
• On-demand review — From any open PR on GitHub.com, click Reviewers and add Copilot as a reviewer. Copilot posts its review within minutes.
• From VS Code — With a PR open in the GitHub Pull Requests extension, you can trigger a Copilot review from the sidebar.

What Copilot Reviews For

Path-Scoped Review Instructions

Copilot Code Review uses the same custom instructions system described in Lesson 7. The .github/copilot-instructions.md file shapes what Copilot looks for and how it comments. Path-scoped .instructions.md files apply when Copilot is reviewing files matching the specified glob.

A review-specific instructions file looks like:

---
applyTo: 'src/api/**'
---
# API Review Instructions

When reviewing API endpoints:
- Verify all input is validated with Zod before use
- Confirm authentication middleware is applied on protected routes
- Flag any endpoint that does not return a typed response object
- Check that rate limiting applies to all public endpoints

Without instructions, Copilot reviews for general correctness. With good instructions, it reviews against your specific standards — catching the kinds of mistakes your team actually makes.

Agent Skills and MCP (Generally Available July 2026)

As of July 2026, Copilot Code Review has agent skills and MCP support. The GitHub MCP and Playwright MCP are enabled by default for code review, allowing Copilot to fetch additional context — issue descriptions, related PRs, external documentation — when reviewing. This makes reviews more accurate for changes that relate to open issues or external requirements.

All MCP tool calls during code review are limited to read-only operations — Copilot cannot modify anything as part of a review.

Responding to Copilot's Review Comments

Copilot's review comments appear as normal PR review comments. You can:

• Dismiss the comment if you disagree — add a reply explaining why
• Apply the suggestion — if Copilot provided a code suggestion, apply it directly with the "Apply suggestion" button
• Ask a follow-up — reply to the comment to get more explanation or alternative approaches
• Resolve — mark the comment resolved after fixing the issue

Try This

Open a recent pull request in one of your repositories — it can be already merged. Go to Reviewers and add Copilot. Read every comment it leaves. For each one, decide: is this a real issue, a matter of style preference, or a false positive? The ratio of real issues to false positives tells you a lot about how well-tuned your custom instructions are for the kinds of changes your team makes.