What VS Code's agent can do without asking, and how to lock it down

Q: What is YOLO mode in VS Code?

The setting `chat.tools.global.autoApprove`: it disables manual approval for every tool in every workspace. `/yolo` turns it on for one chat.

Q: Does "rm": false block rm?

No. A `false` rule asks first; it doesn't block. It does win over any `true` rule.

A few chat.* settings decide which tools and terminal commands run without a prompt, and a trusted folder lets its MCP servers start on their own. VS Code itself calls terminal auto-approval "not a security boundary".

settings.json −risky+fixed

−"chat.tools.global.autoApprove": true,−"chat.tools.terminal.autoApprove": { "/.*/": true }+"chat.tools.global.autoApprove": false,+"chat.tools.terminal.autoApprove": { "git status": true }

Where VS Code keeps these settings

User settings apply everywhere; a project's .vscode files override them.

Scope	File	What's in it
You	`~/Library/Application Support/Code/User/settings.json (macOS)%APPDATA%\Code\User\settings.json (Windows)~/.config/Code/User/settings.json (Linux)`	The `chat.*` approval settings.
This project	`.vscode/settings.json`	Overrides yours; the terminal rules are merged.
MCP servers	`Code/User/mcp.json.vscode/mcp.json.mcp.json`	Servers it starts. Repo servers follow Workspace Trust.
Extensions	`~/.vscode/extensions`	What you installed.
Admin policy	`/etc/vscode/policy.json (Linux)`a configuration profile (macOS)Group Policy (Windows)	Wins over every other setting.

The settings that remove prompts

All in settings.json.

Setting	What it does
`chat.permissions.default`	`default` (Manual), `autoApprove` (Allow all: every tool call without confirmation) or `autopilot` (approves everything and answers its own questions).
`chat.tools.global.autoApprove`	`true` approves every tool in every workspace. VS Code's own name for it: YOLO mode. `/yolo` does the same for one chat.
`chat.tools.terminal.autoApprove`	Rules per command or `/regex/`: `true` runs it without asking, `false` asks. A `false` rule asks; it doesn't block.
`chat.tools.terminal.ignoreDefaultAutoApproveRules`	`true` drops the built-in rules that ask before `rm`, `curl`, `chmod` and others.

Six things to check

YOLO mode

"chat.tools.global.autoApprove": true (old name chat.tools.autoApprove): every tool in every workspace runs with no prompt.

A catch-all terminal rule

"chat.tools.terminal.autoApprove": { "/.*/": true }: every command runs without asking.

Allow all or Autopilot by default

"chat.permissions.default": "autoApprove" or "autopilot": every new chat starts there.

A cloned repo's MCP servers

Once you trust the folder, .vscode/mcp.json and .mcp.json servers can start without a separate prompt, and by default when you send a chat message.

Workspace Trust off

"security.workspace.trust.enabled": false turns off Restricted Mode, which keeps agents and repo MCP servers out of unfamiliar folders.

The Claude agent with no checks

"github.copilot.chat.claudeAgent.allowDangerouslySkipPermissions": true bypasses every permission check for the Claude agent in VS Code.

Lock it down

In your user settings.json, and remove any catch-all rule such as "/.*/": true from chat.tools.terminal.autoApprove.

{
  "chat.permissions.default": "default",
  "chat.tools.global.autoApprove": false,
  "chat.tools.terminal.ignoreDefaultAutoApproveRules": false,
  "chat.mcp.autostart": "never",
  "security.workspace.trust.enabled": true
}

New chats start in Manual, no tool is approved everywhere, the built-in rules for rm and curl stay on, no MCP server starts just because you sent a message, and unfamiliar folders open in Restricted Mode. Stricter: "chat.tools.terminal.enableAutoApprove": false.

Or check all of it at once

For VS Code, NeuroShield reads your user settings.json, each project's .vscode/settings.json, mcp.json files and extensions: YOLO mode, catch-all terminal rules (Fix It for Me removes the rule, with Undo), and the MCP checks for keys and downloads.

Read only

It reads settings files and never runs your agents, their MCP servers or their scripts.

Nothing leaves this computer

The check runs locally. No account, no upload, no AI inside: fixed, published rules.

Nothing changes without your OK

Where a safe fix exists, Fix It for Me makes it after you confirm, with a backup and Undo.

Questions

What is YOLO mode in VS Code?

The setting chat.tools.global.autoApprove: it disables manual approval for every tool in every workspace. /yolo turns it on for one chat.

Does "rm": false block rm?

No. A false rule asks first; it doesn't block. It does win over any true rule.

Do MCP servers in a repo I cloned start on their own?

Not in Restricted Mode. Once you trust the folder they can, and by default VS Code starts new or changed servers when you send a chat message.

See your own agents

The check is free: how many agents you have and what they can do. Details and fixes come with Shields.

Download DriveScape One Shields pricing