Running GitHub Copilot through a MitM proxy reveals exactly how

The Setup for Traffic Inspection #

To get this working, you need a tool like Charles Proxy or Proxyman. The trick is that Copilot uses HTTPS, so you have to install a root certificate on your machine to decrypt the SSL traffic.

1. Install your proxy of choice (e.g., Proxyman).

2. Install the SSL certificate to your system keychain and trust it.

3. Configure your IDE or system environment variables to route traffic through the proxy port (usually 9090 or 8888).

4. Filter the traffic for api.githubcopilot.com

or copilot-proxy.githubusercontent.com

.

What the Payloads Actually Look Like #

Once the traffic is flowing, you can see the JSON requests hitting the API. The most interesting part is the context window. Copilot doesn't just send the current file; it sends "snippets" from other open tabs that it deems relevant to your current cursor position.

If you look at the request body, you'll find a structure similar to this:

{
  "messages": [
    {
      "role": "system",
      "content": "You are a helpful assistant..."
    },
    {
      "role": "user",
      "content": "Current file: main.py\nLine 42: [your code]\nRelated snippet from utils.py: [extracted code]"
    }
  ],
  "parameters": {
    "temperature": 0.1,
    "max_tokens": 100
  }
}

Real-World Takeaways for Better Prompting #

Seeing this raw data changes how you approach an AI workflow. First, it proves that keeping relevant files open in your editor tabs directly impacts the quality of the suggestions. The "context" is literally just other open files being fed into the prompt.

Second, it highlights why some suggestions are hallucinated. If you have a file open with a similar function name but different logic, Copilot might be pulling that "wrong" context into the prompt, leading the LLM astray.

For anyone looking for a practical tutorial on optimizing their setup, the best move is to be mindful of your open tabs. Close the junk and keep only the API definitions or helper classes you're actually using. This reduces the noise in the payload and makes the agent more accurate.

The latency you feel sometimes isn't just the model thinking—it's the time spent gathering these snippets from your local workspace and shipping them over the wire. It's a fascinating look at the gap between the seamless UI and the messy reality of LLM agent communication.

Next Claude Code agents fail because we treat them like synchronous →

a library of Claude prompt techniques, with plenty of directly applicable cases.