@@ -28,7 +28,7 @@ You do not need a {% data variables.product.prodname_copilot %} license.
 
 You run AI Scan for repositories on demand, and each scan consumes **{% data variables.product.prodname_code_security %} {% data variables.product.prodname_ai_credits_short %}**. This usage is separate from active-committer licensing.
 
-Usage is billed to the account responsible for the organization's billing. 
+Usage is billed to the account responsible for the organization's billing.
 
 {% data reusables.code-scanning.ai-scan-personal-account-billing %}
 
@@ -57,6 +57,7 @@ The alert will only close automatically if the applied fix changes the exact lin
 ## Limitations
 
 * Scans analyze the default branch only.
+* Self-hosted runners are not supported.
 * Scans are manually triggered. Scheduled scans and automatic scans on push are not supported.
 * The agent selects which code to examine within a time budget. A scan does not exhaustively analyze every file or guarantee that it finds every vulnerability.
 * Matching against existing {% data variables.product.prodname_codeql %} alerts is best effort, so duplicate alerts can occur.
 
@@ -187,7 +187,7 @@ The {% data variables.product.github %} MCP Registry is a curated list of MCP se
 
 Agent finder is a discovery service that helps {% data variables.product.prodname_copilot %} find the right capabilities—such as MCP servers, tools, agents, and skills—for a task at runtime, instead of requiring every capability to be configured in advance. Like an MCP registry, it searches a catalog of capabilities and returns ranked matches that {% data variables.product.prodname_copilot %} can use on demand. Agent finder implements the open Agentic Resource Discovery (ARD) specification.
 
-For {% data variables.copilot.copilot_cli_short %} setup, see [Using agent finder](/copilot/how-tos/copilot-cli/customize-copilot/add-mcp-servers#using-agent-finder). The {% data variables.copilot.github_copilot_app %} provides an `af` built-in skill. See [AUTOTITLE](/copilot/reference/github-copilot-app-reference/built-in-skills). To browse the catalog, see [GitHub Agent Finder](https://github.com/agentfinder).
+The {% data variables.copilot.github_copilot_app %} provides an `af` built-in skill. See [AUTOTITLE](/copilot/reference/github-copilot-app-reference/built-in-skills). You can search for more AI resources at [github.com/search?type=ai_resources](https://github.com/search?type=ai_resources).
 
 ## Next steps
 
 
@@ -42,11 +42,16 @@ An administrator configures a model provider for the instance, and users connect
 
 For more information, see [AUTOTITLE](/copilot/copilot-on-ghes/set-up-copilot-cli).
 
+{% ifversion copilot-cli-ghes-ga %}
 > [!NOTE]
-> This feature is in {% data variables.release-phases.technical_preview %} and subject to change.
+> This feature is generally available.
+{% else %}
+> [!NOTE]
+> This feature is generally available starting with {% data variables.product.prodname_ghe_server %} 3.22.3. In earlier 3.22 patch releases, it is in {% data variables.release-phases.technical_preview %}.
+{% endif %}
 
 {% else %}
 
-To use this feature, upgrade your instance to **version 3.22 or later**, where this feature is available in {% data variables.release-phases.technical_preview %}.
+To use this feature as generally available, upgrade your instance to **version 3.22.3 or later**.
 
 {% endif %}
@@ -14,8 +14,13 @@ category:
   - Manage Copilot for a team
 ---
 
+{% ifversion copilot-cli-ghes-ga %}
 > [!NOTE]
-> This feature is in {% data variables.release-phases.technical_preview %} and subject to change.
+> This feature is generally available.
+{% else %}
+> [!NOTE]
+> This feature is generally available starting with {% data variables.product.prodname_ghe_server %} 3.22.3. In earlier 3.22 patch releases, it is in {% data variables.release-phases.technical_preview %}.
+{% endif %}
 
 You can configure {% data variables.copilot.copilot_cli_short %} to work with {% data variables.product.prodname_ghe_server %} in disconnected or air-gapped environments without connectivity to {% data variables.product.github %} Cloud. An administrator configures a model provider for the instance, and users connect {% data variables.copilot.copilot_cli_short %} with their {% data variables.product.prodname_ghe_server %} credentials.
 
 
@@ -41,7 +41,7 @@ You can add MCP servers in the following ways:
 * [Using the `copilot mcp add` subcommand](#using-the-copilot-mcp-add-subcommand)
 * [Editing the configuration file](#editing-the-configuration-file)
 * [Adding per-repository MCP servers](#adding-per-repository-mcp-servers)
-* [Searching and installing from the registry (experimental)](#searching-and-installing-from-the-registry)
+* [Searching and installing from the registry](#searching-and-installing-from-the-registry)
 
 For installation instructions, available tools, and URLs for specific MCP servers, see the [{% data variables.product.github %} MCP Registry](https://github.com/mcp).
 
@@ -52,12 +52,12 @@ For installation instructions, available tools, and URLs for specific MCP server
 1. Next to **Server Name**, enter a unique name for the MCP server. This is the name you will use to refer to the server.
 1. Next to **Server Type**, select a type by pressing the corresponding number. The following types are available:
 
-   * **Local** or **STDIO**: starts a local process and communicates over standard input/output (`stdin`/`stdout`). Both options work the same way. **STDIO** is the standard MCP protocol type name, so choose this if you want your configuration to be compatible with {% data variables.product.prodname_vscode_shortname %}, the {% data variables.copilot.copilot_cloud_agent %}, and other MCP clients.
+   * **STDIO**: starts a local process and communicates over standard input/output (`stdin`/`stdout`). This is the standard MCP protocol type name, so it's compatible with {% data variables.product.prodname_vscode_shortname %}, the {% data variables.copilot.copilot_cloud_agent %}, and other MCP clients.
    * **HTTP** or **SSE**: connects to a remote MCP server. **HTTP** uses the Streamable HTTP transport. **SSE** uses the legacy HTTP with Server-Sent Events transport, which is deprecated in the MCP specification but still supported for backwards compatibility. <!-- markdownlint-disable-line GHD046 -->
 
 1. The remaining fields depend on the server type you selected:
 
-   * If you chose **Local** or **STDIO**:
+   * If you chose **STDIO**:
 
      * Next to **Command**, enter the command to start the server, including any arguments. For example, `npx @playwright/mcp@latest`. This corresponds to both the `command` and `args` properties in the JSON configuration file.
      * Next to **Environment Variables**, optionally specify environment variables the server needs, such as API keys or tokens, as JSON key-value pairs. For example, `{"API_KEY": "YOUR-API-KEY"}`. The `PATH` variable is automatically inherited from your environment. All other environment variables must be configured here.
@@ -201,9 +201,6 @@ The `.vscode/mcp.json` file for {% data variables.product.prodname_vscode_shortn
 
 ### Searching and installing from the registry
 
-> [!NOTE]
-> The `/mcp search` command is currently an experimental feature. To use it, start {% data variables.copilot.copilot_cli_short %} with the `‑‑experimental` command line option, or enter `/experimental on` during a session.
-
 You can discover and install MCP servers directly from the [{% data variables.product.github %} MCP Registry](https://github.com/mcp) using the `/mcp search` command in interactive mode. This lets you browse available servers, view their details, and install them without manually filling out the configuration form.
 
 If your organization has configured a custom MCP registry URL, `/mcp search` connects to that registry instead of the default {% data variables.product.github %} registry.
@@ -219,13 +216,6 @@ If your organization has configured a custom MCP registry URL, `/mcp search` con
 1. Press <kbd>Ctrl</kbd>+<kbd>S</kbd> to save. The server is added to your `mcp-config.json` and started immediately.
 
 
-## Using agent finder
-
-Agent finder searches a catalog of capabilities, including MCP servers, tools, agents, and skills. To make it available in the CLI:
-
-1. Download the [agent finder skill](https://github.com/ards-project/connectors/blob/main/skills/github-copilot/SKILL.md).
-1. Add the skill to your `~/.copilot/skills` directory. For skill directory structure and installation guidance, see [AUTOTITLE](/copilot/how-tos/copilot-cli/customize-copilot/add-skills).
-
 ## Managing MCP servers
 
 You can manage your configured MCP servers using the `/mcp` commands in interactive mode or the `copilot mcp` subcommands from the terminal.
 
@@ -102,6 +102,22 @@ The following examples for macOS and Windows show how to configure hooks that wi
 
 {% data reusables.copilot.cloud-agent.troubleshoot-hooks %}
 
+## Troubleshooting sandboxed hooks
+
+If a hook fails or times out only when sandboxing is enabled, a tool it calls may need access to a configuration file or cache. See [AUTOTITLE](/copilot/reference/hooks-reference#sandboxed-sessions).
+
+Before granting access, remember that user settings apply across CLI sessions and are not limited to this hook. Configuration files such as `.npmrc` can contain credentials. Grant only access you are willing to give to other sandboxed commands. Organization-managed restrictions still apply.
+
+1. Check the hook's or tool's error output and logs for a denied file or directory. If the script suppresses errors, enable diagnostic output without logging credentials.
+1. Run `/sandbox policy` followed by the hook command to preview command-specific developer-tool access in your current directory.
+
+   > [!NOTE]
+   > If the hook sets `cwd` you must run `/sandbox policy` from the configured `cwd` directory.
+
+   This does not inspect script files or include the hook's additional source and data directory permissions. See [AUTOTITLE](/copilot/concepts/security-governance-and-network-settings/understanding-local-sandboxing#checking-what-the-current-policy-allows).
+1. In your user settings, add only the required paths to `sandbox.userPolicy.filesystem.readonlyPaths` or `sandbox.userPolicy.filesystem.readwritePaths`. Use read-only access for configuration files and read/write access only for caches the tool needs to update. See [AUTOTITLE](/copilot/reference/copilot-cli-reference/cli-config-dir-reference#user-settings-copilotsettingsjson).
+1. Start a new CLI session and check whether the hook succeeds when its event next occurs.
+
 ## Further reading
 
 * [AUTOTITLE](/copilot/reference/hooks-reference)