Security Scanning Moves Left—All the Way to Your Editor

GitHub shipped secret scanning via the GitHub MCP Server to general availability this week, and it's the kind of shift-left move I've been waiting for. You can now ask Copilot to scan your uncommitted changes for exposed credentials directly in VS Code or Copilot CLI—before you commit, before you open a PR, before anyone has to file a post-incident report about leaked AWS keys.

This isn't a new scanning engine. It's the same GitHub Secret Scanning that's been catching credentials in repositories for years, now wired into the Model Context Protocol so AI agents can invoke it as a tool. When you're working on a feature branch and you ask Copilot, "Scan my current changes for exposed secrets," it hands your staged files to the scanning service and returns structured results with file paths, line numbers, and severity.

The GA release also brings push protection customization support, so your MCP-based scans respect the same bypass rules you've already configured at the repo or org level. No surprises, no policy drift.

Dependency scanning via MCP hit public preview on the same day. Same workflow: ask your agent to check for vulnerable dependencies in your diff, and it queries the GitHub Advisory Database for known CVEs in your package changes. The toolset can also run the Dependabot CLI locally to diff dependency graphs before and after your edits, which is especially useful when you're bumping a major version and want to know what you're inheriting.

If you're using the Advanced Security plugin for Copilot, you get dedicated slash commands like /secret-scanning and /dependency-scanning for cleaner invocation. Install it with /plugin install advanced-security@copilot-plugins in Copilot CLI or grab the agent plugin in VS Code.

I covered the foundations of this approach in my article on context engineering—giving agents access to the right tools at the right time changes what's possible in agentic workflows. Putting AppSec tooling directly into the coding loop is a practical example of that principle paying off.

Enterprise Migrations Without the Downtime Tax

Enterprise Live Migrations (ELM) entered public preview this week, and it's purpose-built for the repos that make existing migration tools sweat: massive monorepos with deep history, thousands of issues and PRs, and teams working around the clock across time zones.

ELM continuously syncs data from GitHub Enterprise Server to GitHub Enterprise Cloud while developers keep committing. When you're ready to cut over, it only takes as long as draining the remaining in-flight changes—minutes, not days. No extended code freeze, no "everyone stop pushing" email, no migration window that forces half your team to work at 2 AM.

It runs as a service on your GHES appliance and uses the elm CLI for orchestration. Resource-level progress tracking surfaces failures before you commit to the cutover, so you're not flying blind when you flip the switch. It ships with GHES versions 3.17.14+, 3.18.8+, 3.19.5+, and 3.20.2+.

GitHub positions this alongside GitHub Enterprise Importer (GEI), not as a replacement. Use GEI for straightforward migrations where brief downtime is fine. Use ELM for business-critical repos where a downtime window doesn't exist or the repo is large enough that traditional tooling chokes. You can run both concurrently as part of the same migration strategy.

If you're planning a GHES-to-Cloud migration for a repo that's over 10GB or has more than 50k issues, ELM is worth the evaluation cycle. The documentation is live and there's a community discussion for feedback.

VS Code Copilot Gets Smarter Context and /chronicle

The April releases for GitHub Copilot in VS Code (v1.116–v1.119) brought a wave of context and agent improvements, including an experimental feature that tracks your chat history in a local database.

/chronicle lets you search past Copilot sessions to recall what you worked on, which files you edited, and which PRs you referenced. It's useful when you're context-switching between multiple features or coming back to a codebase after a week away. The data stays local—GitHub isn't collecting it. Enable it with the github.copilot.chat.localIndex.enabled setting.

Semantic indexing now works in all workspaces, not just select repos. Agents can also run grep-style searches across GitHub repos and orgs with the new githubTextSearch tool, which is a meaningful upgrade for agents that need to cross-reference codebases or find usage patterns across an org.

Agents can now read from and write to any open terminal, including running REPLs and interactive scripts. This makes Copilot useful for workflows that involve live debugging sessions, interactive shells, or multi-step CLI tools that require user input along the way.

VS Code also added Bring Your Own Key (BYOK) support for Copilot Business and Enterprise. Teams can connect their own API keys from OpenRouter, Microsoft Foundry, Google, Anthropic, OpenAI, and others, or run models locally with Ollama and similar tools. Admins control access via a policy setting on GitHub.com. This was already available for Copilot Free and Pro users—now it extends to team and enterprise plans.

Repository Rulesets Get Practical Improvements

Repository rulesets added two frequently requested features this week: individual user bypass and branch renaming for org-level rulesets.

You can now add individual users as bypass actors on repository-level rulesets through the UI, REST API, and GraphQL. If you've been creating dedicated teams or roles just to grant bypass access for a single service account, you can skip that step now.

Repository administrators can also rename branches covered by organization or enterprise rulesets, as long as the new name stays within scope of every applicable ruleset. This is especially useful for migrating from master to main when the rename doesn't change which rules apply. If the new name would fall outside the scope of any ruleset, the rename gets blocked and an org or enterprise admin has to handle it.

Org and enterprise admins can disable branch renaming in their settings if they want tighter control. Both features are live now across all plans.

Also Shipped This Week

• GitHub Mobile repo creation: You can now create new repositories directly from the GitHub Mobile app on iOS and Android. Set visibility, add a description, choose a template, and initialize with a README or .gitignore—all from your phone.
• Copilot code review metrics: The usage metrics API now breaks down Copilot code review suggestions by comment type (security, bug_risk, etc.) so you can see which categories are being suggested and applied most often.
• Copilot cloud agent secrets: Dedicated Agents secrets and variables now make it easier to manage shared configuration across repos and orgs for Copilot cloud agent.

The Bottom Line

GitHub's MCP-powered security scanning is the kind of developer experience win that makes agentic workflows practical for teams with compliance requirements. Secret and dependency scanning in your editor—before commit, before PR—closes the gap between "we should be scanning for this" and "we actually catch it before it ships."

Enterprise Live Migrations addresses the pain point that blocks large-scale GHES-to-Cloud moves: the downtime tax. If you're sitting on a migration plan that's been delayed because you can't afford a multi-day code freeze, ELM just changed the math.

VS Code's /chronicle and expanded agent tooling signal where GitHub is heading with Copilot: agents that remember context across sessions, search your chat history, and work with the tools you're already running in your terminal. The Bring Your Own Key expansion to Business and Enterprise plans is a clear acknowledgment that enterprise teams want model flexibility without leaving their existing tooling.

The throughline across all these releases is shift-left with agent support. Security scanning in the IDE. Migrations without disruption. Context that persists across sessions. GitHub is building infrastructure that meets developers where they already work, not where a compliance officer thinks they should work.