GitHub · GH-600
Agent tools and permissions
GH-600 · Lesson 4 of 16 · 32:36
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-600 exam (GitHub Certified: Agentic AI Developer). In this lesson: identifying the tools a task requires (GitHub API, Actions, shell, MCP servers), the tools property of custom agent profiles (all, none, or a list), tool aliases and MCP tool names, Copilot CLI allow and deny patterns where deny rules always win, programmatic mode, and the credentials behind tools: GITHUB_TOKEN permissions per job, GitHub Apps, the read-only built-in GitHub MCP server, and Agents secrets with the COPILOT_MCP_ prefix. Includes three original practice questions.
Preview the topics
- Contoso’s documentation agent profile has no tools property at all. Which tools can the agent use?
- Contoso runs Copilot CLI in a workflow to update a changelog, and wants every git command allowed, except pushing. Which options fit?
- Contoso’s MCP server for its error tracker needs an API key in the cloud agent. Where should the key live?