Deconstructing GitHub Copilot: A MitM Proxy Investigation

By Rafael | Aug 04, 2026

Hello! I'm Rafael. As an engineer specializing in AI systems, I spend my weeks exploring the technical hurdles and breakthroughs of the current AI era.

Recently, we've seen an explosion of AI-integrated software. Some are established giants adding new tricks (like Slack), while others are "AI-native" from day one (such as Cursor, Notion, and the desktop clients for ChatGPT and Claude).

As these tools evolved, I felt a growing urge to peek under the hood. My goal was twofold: uncover the underlying mechanics of these AI implementations and sharpen my skills in desktop application development.

The catalyst for my specific experiment with GitHub Copilot was a practical one: I noticed my monthly Copilot credits were disappearing faster and faster. I wanted to know why.

The Common Thread: Electron

When looking at the apps mentioned above, I found a shared architectural foundation: Electron.

Essentially, Electron allows developers to wrap a web application into a desktop executable. This eliminates the need to write separate native code for different OSs (e.g., Swift for macOS or C# for Windows), allowing a single codebase to run everywhere.

Because these apps share this framework, the knowledge I gained from probing one is largely applicable to the others.

Strategy: Traffic Over Source Code

My initial thought was to dive straight into the VS Code source code. However, I realized I didn't have a specific set of questions yet. Sifting through millions of lines of code without a map is a recipe for wasting time or burning through LLM tokens.

"Source code tells you what an app can do; discovering what it actually does at runtime is the real challenge."

While VS Code is largely open-source, others like Notion or Claude are closed. Therefore, I opted for a reverse engineering approach:

1. Passively monitor network traffic.
2. Let the actual requests and responses define the questions.
3. Use the source code only to verify my findings.

Understanding Electron's Network Stack

Since Electron uses Chromium, it has a built-in network stack for HTTP and WebSockets. However, it can also leverage Node.js's native http, https, or fetch modules.

In the case of VS Code, the architecture is decoupled. It utilizes an extension host, which separates the core IDE functionality and the UI from the plugins.

The Man-in-the-Middle (MitM) Approach

To see the data, I used a Man-in-the-Middle (MitM) proxy. The proxy sits between the client and the server, intercepting and relaying traffic.

How it works with HTTPS

Most traffic is encrypted via TLS. To bypass this, the proxy generates its own Certificate Authority (CA). Once the client trusts this local CA, the encrypted connection is split into two distinct segments:

$Connection_{Total} = Connection_{Client \to Proxy} + Connection_{Proxy \to Server}$

This allows the proxy to decrypt the request, let the human inspect it, and then re-encrypt it before sending it to the final destination.

Implementation Guide

If you are interested in replicating this setup, follow these steps:

1. Install the Tooling

On macOS, the fastest way to get mitmproxy is via Homebrew:

brew install mitmproxy

2. Configure VS Code

You must tell VS Code to route its traffic through the proxy.

• Open the Command Palette: Cmd+Shift+P
• Search for User Settings
• Update the following field:
  • Http Proxy: http://localhost:8080

3. Final Checklist

• Install mitmproxy
• Launch mitmproxy on port 8080
• Install and trust the mitmproxy CA certificate on your OS
• Set the proxy URL in VS Code settings
• Restart VS Code