Copilot usage metrics API now names your MCP servers and agents
GitHub's Copilot usage metrics API now reports MCP servers, custom agents and skills by name, not as 'other'. Use it to audit what your AI coding fleet runs.
The GitHub Copilot usage metrics API now reports MCP servers, custom agents, and skills by their configured names. Until October 22, that activity showed up as "other" or "custom." Now an org admin can pull a report and see which MCP servers developers actually call, and how often. For a small team with an AI coding agent in every editor, that is the first real inventory of what the agent touches.
What actually happened
Per the GitHub changelog, five arrays in the enterprise and organization reports now carry names: totals_by_skill, totals_by_custom_agent, totals_by_mcp, totals_by_slash_cmd and totals_by_plugin. Each list now holds up to 25 entries per record, up from five. The rest goes into a trailing other bucket.
The details that matter:
- Names come from Copilot CLI, the GitHub Copilot app, ACP integrations such as JetBrains, and the Copilot SDK. Most of these need CLI 1.0.97 or SDK 1.0.21 or later
- An IDE's built-in chat telemetry does not report names
- Names that look like file paths stay grouped as "other"
- Only days processed after the release show names. Older data stays "other"
- The data is client telemetry, and GitHub says it can undercount. Use it for trends, not exact accounting
Access is limited to enterprise owners, billing managers, org owners, and custom roles with "View Copilot Metrics." The usage metrics policy must be on. The endpoints are in the REST docs.
Why it matters for your business
Every MCP server is a connection from your coding agent to something else: your database, your ticket system, your cloud account. Most teams cannot list theirs. A developer adds one in a config file, it works, and nobody writes it down.
This report gives you that list from usage data. Pull it once a month. Compare it to the MCP servers you approved. Anything on the report that is not on your list is a conversation to have this week. Anything on your list that nobody uses is access you can remove.
One caution from GitHub: review the names before you share a report outside the company. A server name can reveal an internal system.
Key takeaways
- As of October 22, Copilot usage metrics name MCP servers, custom agents, skills, slash commands and plugins
- Each list now shows up to 25 entries per record, up from five
- Names need recent clients (CLI 1.0.97+, SDK 1.0.21+); IDE built-in chat does not report them
- Data is client telemetry and can undercount, so use it for trends
- Compare the report to your approved MCP server list every month
You cannot govern connections you cannot list. We set up MCP allowlists, usage reports, and access reviews for small teams running AI coding agents. Tell us what your agents connect to or see how we build it.
Sources: GitHub Changelog, GitHub REST API docs.
- #github-copilot
- #mcp
- #usage-metrics
- #ai-governance
- #developer-tools
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Plex2Shell: update Plex Media Server, then check for miners
Plex2Shell chains four Plex Media Server flaws into remote code execution. CISA lists it as exploited. Update to 1.43.3.10861 and check the box for implants.
Read itBeyondTrust CVE-2026-102764: patched is not the same as clean
BeyondTrust Remote Support zero-day CVE-2026-102764 was exploited from August. The patch closes the hole; it does not remove root access an attacker already got.
Read it