A flag in an alias
copilot --allow-all-tools, --allow-all or --yolo in an alias or script. GitHub: never use an alias for these.
AI coding agents · GitHub Copilot
What GitHub Copilot can do without asking, and how to lock it down
The Copilot CLI asks before edits, risky commands and URLs, until a flag, a setting, an environment variable or an old "don't ask again" answer says otherwise. All of them live in ~/.copilot or your shell.
~/.copilot/settings.json −risky+fixed−"defaultPermissionMode": "allow-all"+"defaultPermissionMode": "manual",+"permissions": { "disableBypassPermissionsMode": "disable" }
Where Copilot keeps its settings
~/.copilot on every OS (Windows: %USERPROFILE%\.copilot); COPILOT_HOME moves it.
| Scope | File | What's in it |
|---|---|---|
| Settings | ~/.copilot/settings.json | defaultPermissionMode, hooks, allowedUrls, permissions.disableBypassPermissionsMode. |
| MCP servers | ~/.copilot/mcp-config.json | Servers it starts: command, args, tools, env. |
| Saved answers | ~/.copilot/permissions-config.json | Your "don't ask again" choices, per repo. |
| Hooks | ~/.copilot/hooks/*.json.github/hooks/*.json | Commands run on events, without asking. |
| Instructions | .github/copilot-instructions.mdAGENTS.mdCLAUDE.md | Read into every session. |
| Admin | /Library/Application Support/GitHubCopilot/managed-settings.json (macOS)/etc/github-copilot/managed-settings.json (Linux) | Settings an administrator enforces. |
What switches approvals off
Each one, from a single run to every session.
| Where | What it does |
|---|---|
--allow-all-tools | Any tool runs without a prompt. |
--allow-all · --yolo | All tools, any path, any URL. --deny-tool rules still win. |
"defaultPermissionMode": "allow-all" | Every new session starts that way. |
COPILOT_ALLOW_ALL=true | The same as --allow-all, and it trusts the current folder, so a cloned repo's hooks and MCP servers start too. |
/yolo · /allow-all | The same, for the session you're in. |
Six things to check
COPILOT_ALLOW_ALL in your shell profile
export COPILOT_ALLOW_ALL=true gives every session full permissions and trusts the folder it starts in.
allow-all as the default
"defaultPermissionMode": "allow-all" in ~/.copilot/settings.json, worse with "defaultMode": "autopilot".
Old "don't ask again" answers
"kind": "write", "commandIdentifiers": ["git:*"] or "kind": "mcp" with every tool, in ~/.copilot/permissions-config.json.
Repo hooks and instructions
.github/hooks/*.json run commands on events; .github/copilot-instructions.md steers the agent. Look for curl … | sh and hidden characters.
MCP servers with every tool on, or a key in the file
"tools": ["*"] or a token in env in mcp-config.json. For the cloud agent, "tools": ["*"] means no approvals at all.
Lock it down
In ~/.copilot/settings.json. Then run /reset-allowed-tools in each repo where you chose "don't ask again".
{
"defaultPermissionMode": "manual",
"permissions": { "disableBypassPermissionsMode": "disable" }
} New sessions ask before anything not already allowed, and --allow-all-tools, --allow-all, --yolo and /yolo are refused. To let one thing through, name it and deny the risky part: copilot --allow-tool='shell(git:*)' --deny-tool='shell(git push)'.
Or check all of it at once
For Copilot, NeuroShield reads settings.json, mcp-config.json, skills and custom agents, each repo's .github hooks, instructions and prompts, and shell aliases: keys in MCP servers, hooks that download, send or approve, and hidden characters.
Read only
It reads settings files and never runs your agents, their MCP servers or their scripts.
Nothing leaves this computer
The check runs locally. No account, no upload, no AI inside: fixed, published rules.
Nothing changes without your OK
Where a safe fix exists, Fix It for Me makes it after you confirm, with a backup and Undo.
Questions
What does copilot --yolo do?
The same as --allow-all: any tool, any path, any URL, without asking. --deny-tool rules still win.
Where is the Copilot CLI config file?
~/.copilot/settings.json. config.json is the CLI's own state; settings left there are ignored.
Does Copilot read AGENTS.md and CLAUDE.md?
Yes, along with .github/copilot-instructions.md. --no-custom-instructions turns that off.
See your own agents
The check is free: how many agents you have and what they can do. Details and fixes come with Shields.