
MCP Security Scanning: Audit Your AI Agent's Tools
Your team adopted Copilot six months ago. Developers love it. PRs are flying. Sprint velocity looks great on paper. Then the invoice from GitHub arrives, and your Actions bill is up 280%.
This isn't a hypothetical. According to GitHub's own 2025 Octoverse report, pull requests merged on GitHub jumped 29% year-over-year to 518.7 million, while GitHub Actions minutes consumed in public projects alone rose 35% to 11.5 billion. Those two curves aren't coincidentally climbing together. Nearly 80% of new GitHub users tried Copilot within their first week. AI coding agents are creating more code, faster, from more developers. And every pull request is a CI trigger.
The productivity gains from Copilot, Claude Code, and Codex are real. But nobody's talking about the downstream cost: every agent-generated PR runs your full CI suite, and teams using these tools heavily are seeing 3-5x more CI minutes per developer per month than they did a year ago.
Before AI agents, a typical developer might open 3-5 PRs per week. Each one triggers lint, test, build, maybe a deploy preview. With a 15-minute CI pipeline on a standard Linux runner at $0.006/min, that's roughly $1.35-$2.25 per developer per week in Actions minutes alone.
Now add an AI coding agent. The same developer is opening 10-20 PRs per week. Some are agent-generated drafts that get iterated on, re-pushed, and re-run. Some are exploratory branches the agent spins up that never get merged. Each push event fires the full CI matrix. The math changes fast:
Before AI agents:
5 PRs/week × 2 pushes/PR × 15 min × $0.006/min = $0.90/dev/week
Monthly (4 weeks): ~$3.60/dev
With AI agents:
15 PRs/week × 3 pushes/PR × 15 min × $0.006/min = $4.05/dev/week
Monthly (4 weeks): ~$16.20/dev
Multiplier: 4.5xThat's $16/dev/month for a simple Linux pipeline. Scale it to a 30-person team and you're looking at $486/month versus $108/month. But those numbers assume a single-runner, single-OS pipeline. Most real-world teams run something more complex.
Let's model a more realistic scenario. A mid-size team (20 engineers) running a TypeScript monorepo with matrix builds across Node 18 and Node 20, plus a macOS job for native module testing.
Pipeline per PR push:
2× Linux (Node 18 + Node 20): 15 min × $0.006 × 2 = $0.18
1× macOS (native tests): 10 min × $0.062 = $0.62
Total per push: $0.80
Pre-AI (20 devs × 5 PRs × 2 pushes/PR × 4 weeks):
800 pipeline runs × $0.80 = $640/month
Post-AI (20 devs × 15 PRs × 3 pushes/PR × 4 weeks):
3,600 pipeline runs × $0.80 = $2,880/month
Delta: +$2,240/month (+350%)That $2,240 monthly increase might not sound catastrophic in isolation. But remember: GitHub Enterprise Cloud only includes 50,000 free minutes per month. At 15 minutes per run across 3,600 runs, you're burning 54,000 minutes, which means you've already blown past the included quota. And this doesn't account for storage, artifacts, or cache overages.
For teams with macOS or Windows in their matrix, the damage compounds. A macOS runner costs $0.062/min, over 10x the Linux rate. One 10-minute macOS job per PR push on a team with heavy agent adoption can add $2,200/month in macOS minutes alone.
The raw minute cost is only part of the story. Three less-obvious cost vectors accelerate when AI agents are producing high volumes of code changes.
GitHub-hosted runners have concurrency limits. On the Team plan, you get 60 concurrent jobs. Enterprise bumps that to 180. When five developers each have an AI agent pushing PRs every few minutes, you can saturate those limits during business hours. Queued jobs still consume clock time from a developer-experience perspective, even if they don't bill you directly. The feedback loop slows, agents wait for CI results before iterating, and your team's throughput advantage from AI agents stalls behind a runner bottleneck.
Every CI run potentially produces artifacts: build outputs, test reports, coverage files. GitHub's storage billing uses hourly accrual. If your workflow stores a 500MB build artifact with the default 90-day retention, and you're now producing 4.5x more artifacts, that storage cost grows proportionally. Cache storage above 10GB per repository is billed at $0.07/GB per month. AI agents that frequently change dependency files (like package-lock.json) invalidate caches more often, leading to more cache misses and longer reinstall times.
This one's sneaky. An AI agent might open a PR, trigger CI, then the developer decides the approach is wrong and tells the agent to try something different. The first PR's CI is still running. Nobody cancels it. A new PR opens, triggering another full suite. You're now paying for two concurrent pipeline runs for work that will produce one merged PR at best. Multiply this by the natural trial-and-error rhythm of agent-assisted coding, and 20-30% of your CI minutes might be going to work that never ships.
Not every team feels this equally. The teams most exposed to the AI CI tax share a few characteristics:
Before you can fix it, you need to see it. GitHub's billing dashboard shows aggregate minutes, but it won't tell you how much of that usage is agent-driven. Here's a practical approach.
Step 1: Export your Actions usage. Use the GitHub REST API to pull workflow runs for the past 90 days:
gh api repos/{owner}/{repo}/actions/runs \
--paginate \
--jq '.workflow_runs[] | {id, created_at, event, head_branch, run_started_at, updated_at, conclusion}' \
> runs.jsonStep 2: Identify agent-generated PRs. Most AI agents leave fingerprints. Copilot agent PRs use branch prefixes like copilot-. Claude Code Action creates branches like claude/. Codex typically uses codex/. Filter your runs by these patterns.
Step 3: Calculate the split. Group runs by agent vs. human, sum the billable minutes for each, and compute the ratio. A quick jq pipeline:
# Count runs by branch pattern
jq '[.[] | select(.head_branch | test("copilot-|claude/|codex/"))] | length' runs.json
jq '[.[] | select(.head_branch | test("copilot-|claude/|codex/") | not)] | length' runs.jsonFor a more complete picture, pull the timing endpoint for each run to get actual billable milliseconds by runner type. Multiply by the per-minute rates ($0.006 for Linux 2-core, $0.010 for Windows, $0.062 for macOS) and you'll have a dollar figure for your AI CI tax.
The goal isn't to slow down your AI agents. They're producing real value. The goal is to make your CI pipeline efficient enough to absorb the volume.
Use concurrency groups in your workflow to automatically cancel in-progress runs when a new push arrives on the same branch. This is the single highest-impact change for agent-heavy workflows.
concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: trueFor a team producing 3 pushes per PR, this alone can cut your billable minutes by 30-40%, because the intermediate pushes get cancelled before they finish.
Stop running the full test suite when the agent only changed a README or a config file. Path filters are straightforward and especially effective in monorepos:
on:
push:
paths:
- 'src/**'
- 'packages/**'
- 'package.json'
- '.github/workflows/**'Don't run 6 matrix jobs when the code doesn't even compile. Use a fast lint-and-typecheck job (2-3 minutes) as a gate, and only trigger the full matrix build if it passes. Agent-generated code fails lint checks frequently enough that this saves real money.
The default artifact retention is 90 days. For agent-generated PRs that are exploratory or iterative, you don't need 90 days of build artifacts. Drop it to 3-7 days for PR workflows. This cuts your storage accrual dramatically.
- uses: actions/upload-artifact@v4
with:
name: build-output
path: dist/
retention-days: 3This is the leverage play. If your 15-minute pipeline runs in 8 minutes on a faster runner, you've nearly halved your cost per run. That matters a lot when run volume has tripled. GitHub's larger runners (4-core, 8-core) have higher per-minute rates but often deliver better cost-per-pipeline because the wall-clock time drops disproportionately. Or you can go further.
The fundamental problem with GitHub-hosted runners under AI-agent workloads is that you're paying per-minute for ephemeral VMs while your usage is becoming more predictable and continuous. When your CI pipeline runs hundreds of times a day, the economics of per-minute billing start to look like paying for a taxi to commute to work.
Bare-metal runners flip the model. Instead of paying per minute on shared infrastructure, you run on dedicated hardware with predictable costs. Tenki runs GitHub Actions on bare-metal infrastructure with 30% faster builds and 50% lower costs compared to GitHub-hosted runners. For teams that have crossed the AI-agent adoption threshold, this changes the math entirely.
Let's revisit the earlier example. A 20-person team running 3,600 pipeline runs per month at $0.80 each on GitHub-hosted runners pays $2,880. On bare-metal runners that are 50% cheaper and 30% faster, you're looking at roughly $1,440 for the same workload, and each run completes sooner so your agents get CI feedback faster. The savings compound as your team leans harder into agent-driven development.
The speed advantage also matters for agent workflow quality. AI agents iterate based on CI results. If your pipeline takes 15 minutes on a GitHub-hosted runner versus 10 minutes on bare metal, every iteration cycle is 5 minutes shorter. Over a day of agent-assisted coding with 8-10 CI round trips, that's nearly an hour of faster feedback per developer.
Here's a formula you can plug your own numbers into:
Monthly CI cost = developers × PRs_per_week × pushes_per_PR × 4 weeks
× Σ(job_minutes × rate_per_minute) for each matrix job
AI CI tax = (cost_with_agents - cost_without_agents) / cost_without_agents × 100
Variables to estimate:
- PRs/week/dev before agents: typically 3-5
- PRs/week/dev with agents: typically 10-20
- Pushes per PR before agents: typically 2
- Pushes per PR with agents: typically 3-4 (more iteration)
- Minutes per job: your pipeline's actual timing
- Rate per minute: $0.006 (Linux), $0.010 (Windows), $0.062 (macOS)For most teams we've talked to, the AI CI tax lands between 200% and 400% above pre-agent baseline costs. The variance depends on pipeline complexity and how aggressively developers use agent-driven workflows.
The AI coding agent wave isn't slowing down. GitHub's Octoverse data shows PRs up 29%, Actions minutes up 35%, and agent-related projects growing at 178% year-over-year. If anything, the CI cost pressure is going to get worse as agents become more capable and developers delegate more work to them.
GitHub is also changing its pricing model for Actions. Starting March 2026, self-hosted runners will no longer be free to orchestrate. This means the escape hatch many teams relied on for cost control is closing, making the economics of your CI infrastructure more urgent to get right.
Run the audit. Calculate your tax. And if the numbers look like what we've described here, consider whether per-minute billing on shared VMs is still the right model for a team that ships 3,600 CI runs a month.
Recommended for you
What's next in your stack.
GET TENKI