What I Learned by Putting GitHub Copilot Behind a MitM Proxy
Curious about how AI-powered desktop apps work under the hood, I set up a man-in-the-middle proxy to intercept VS Code and Copilot's network traffic. I discovered that Copilot sends a surprising amount of data before you even type a keystroke, including OAuth tokens, model discovery, and even your prompts and responses stored in a local SQLite database. I also found that disabling Copilot for secret files like .env doesn't stop it from sending context from other files you're editing.
Turning inline completions off for `.env` itself or any other “secret” extension changes nothing, because the request is not being triggered by it.
- p1llus
One thing I found that I thought was a fun addition, is using eBPF made this even easier. No need to fight with anyone that is using certificate pinning, mTLS or anything else, you just get the raw plaintext data straight of the wire (right before encryption and right after decryption) and works nicely for most of the agents and IDE's.
That will in practice give you everything from telemetry to prompts, and its funny to see just how much some of them collect/run that is not at all related to your own ask..
A handy alternative when certain applications tend to make it harder to apply a MiTM proxy and you can dump it straight into your own scripts/programs to filter out and store it in whichever format you want for more analysis.
- j0selit0
I was curious to understand how Copilot implements its harness, and also how I was exhausting my quota so quickly. End up going down a rabbit hole of intercepting its network traffic with mitmproxy.
A few interesting things I found along the way:
- watched model/capability discovery and routing happen in real time
- looked at what gets injected into context and sent with ghost completions
- found that recent edits can pull in context from files other than the one you're currently editing (including infamous .env)
- found the SQLite session store behind Chronicle, including previous prompts/responses
- watched the model query that history through tool calls
I then went through the VS Code source to reconcile some of what I was seeing on the wire with the actual implementation.
Overall some interesting lessons around how their harness is implemented.
- ameliaquining
Minor factual correction: The Codex client is open source. https://github.com/openai/codex