aca.reference/copilot-under-control

How to deploy

A drop-in governing proxy you run yourself — your infrastructure, your Copilot key, your policy. It is open source; nothing routes through a third party. No full platform required.

1 · Deploy it (one click — you are prompted for your key):

Deploy to Render  Docker / other

Or run it directly:

git clone https://github.com/ai-ankqush/aca-mcp-gateway
cd aca-mcp-gateway
GITHUB_TOKEN=your-key GATEWAY_TOKEN=choose-a-secret node server.mjs   # :8080

2 · Point your apps at it — base URL = your gateway, key = your gateway token (the gateway holds the GITHUB_TOKEN):

new OpenAI({ baseURL: GATEWAY_URL + "/copilot/v1", apiKey: GATEWAY_TOKEN })
# requests go to  GATEWAY_URL/copilot/v1/chat/completions

This model's quickstart: models/copilot · Full guide, scaling to tens of thousands of employees, and per-team policy: docs/DEPLOY.md · Source: ai-ankqush/aca-mcp-gateway

What it is

Deploy Copilot under control — the same ACA gateway with the GitHub Models / Azure OpenAI adapter. Bring your own token; route your apps through the governing proxy and every request and tool call is governed and logged. A Policy Enforcement Point applies ACA's SEE / DECIDE / DO to every action (scope, sensitive-data boundary, human approval, action-class limits, kill switch), writes a tamper-evident evidence log, and ships a passing assurance suite (prompt-injection, data-access-boundary, tool/action-limit, approval-bypass, evidence-reconstruction). Vendor-neutral: one repo, swappable model adapters. Stateless per request, so it scales to tens of thousands of employees behind a load balancer. Zero dependencies, Apache-2.0.

Declared permissions

Scope	Value
reads	mcp-tools
writes	evidence
network	models.inference.ai.azure.com
dataScopes	internal

Shown before install. Open-track add-ons always run sandboxed with a permission prompt.

Trust

Publisher aca.reference · License Apache-2.0 · Content hash 1e7a95c79fb08b51104cd549…

Version	Integrity	Signature	Published
v0.1.0	1e7a95c79fb08b51…	unsigned	2026-09-03