F5 Workforce AI Security supports governance and access control for code copilot applications. These tools integrate directly into developer environments. They enable AI-assisted coding through inline suggestions, chat interfaces, and code generation. Admins can apply the same policy-based controls to code copilots as they do for other generative AI services. These controls include access control, request intercept, and user activity logging.

Code copilots differ from traditional web-based generative AI tools in their integration methods. They also differ in their traffic patterns.

Workforce AI Security currently supports three code copilot services: Cursor, GitHub Copilot, and Claude Code. See the Public Service Catalog for current, per-service intercept support. This includes request, response, license, file upload, and MCP interception. In GOVERN, go to Catalogs > Public Services. Each service's detail page shows its exact intercept support and required additional configuration.

Sensitive Data detection is not currently enabled for code copilots. It will be enabled in a future release.

Cursor supports full access control with request intercept. This applies to both chat interactions and inline code suggestions. Admins can monitor and apply policy to developer prompts and conversations within the Cursor interface.

When using SASE connectors like Netskope, Zscaler, or Cloudflare, Cursor requires specific HTTP compatibility mode settings. This ensures proper traffic interception. Without these settings, requests will fail to reach the Workforce AI Security platform. See the HTTP compatibility requirements for Cursor section below for configuration details.

GitHub Copilot supports full access control with request intercept. This applies to both chat interactions and inline code suggestions. Admins can monitor and apply policy to developer prompts and conversations within supported development environments.

GitHub Copilot does not require any special HTTP compatibility configuration. It works with all Workforce AI Security interception methods. These include TLS proxy, PAC file distribution, and SASE connector integration.

Claude Code supports access control and request intercept for chat interactions. The application communicates directly with the Anthropic API for inference. This means the Anthropic API service is part of the same service definition within Workforce AI Security.

Claude Code Desktop already respects PAC-based proxy configuration. It is governed automatically once traffic reaches it. It requires no additional plugin. Claude Code CLI does not honor PAC proxy URLs by default. Organizations that rely on PAC-based routing need the Claude Code CLI plugin to bring CLI traffic under governance. SASE connectors with header insertion remain the alternative path for CLI traffic without the plugin.

Cursor requires specific HTTP compatibility mode settings when used with certain interception methods. These settings disable HTTP/2 and Server-Sent Events (SSE). This ensures proper traffic interception by the Workforce AI Security platform.

Organizations using TLS proxy interception must configure Cursor to use HTTP/1.1 compatibility mode. Admins can deploy this configuration via MDM. They do this by distributing the appropriate Cursor settings file to managed devices.

The required HTTP compatibility mode depends on the SASE vendor that forwards traffic to Workforce AI Security.

Both Netskope and Zscaler require Cursor to operate in HTTP/1.1 compatibility mode. If this setting is not configured, Cursor traffic will fail to reach generative AI services.

Cloudflare requires Cursor to operate in HTTP/1.1 compatibility mode. If this setting is not configured, Cursor traffic will fail to reach generative AI services.

Admins can distribute Cursor HTTP compatibility settings through MDM solutions. They do this by updating the Cursor settings file on managed devices. The settings file location varies by operating system.

These files will most likely have existing user settings within them. Admins should update or insert the following settings into the existing settings.json file.

Organizations should distribute the following configuration to the settings file via MDM:

Organizations can use their MDM platform to create the settings file. They can then distribute it to managed devices. The file should be created or modified with the appropriate JSON configuration for the organization's interception method.

Cursor does not currently support enterprise policy configuration through its teams platform. As a result, admins must distribute these settings through operating system-level MDM tools. This is done rather than through Cursor's native management interface.

Admins should configure any required HTTP compatibility settings and deploy Workforce AI Security interception. After that, they should verify that code copilot traffic is being properly intercepted and governed.

Admins can verify successful integration by checking the User Activity logs at https://admin.surepath.ai for requests originating from code copilot applications. Successful request intercepts will show the application name and user identity. They will also show any policy actions that were applied to the request.

If code copilot requests are not appearing in the User Activity logs, verify that the required HTTP compatibility settings have been applied. Also verify that the Workforce AI Security integration is functioning correctly for other generative AI services. Organizations can use the Ready tool at https://ready.surepath.ai to confirm that endpoints are properly configured to route traffic through Workforce AI Security.