GitHub Copilot CLI permissions: --allow-tool, --deny-tool, --allow-all-tools and trusted directories

The first time Copilot wants a tool that can modify or execute files, it asks:

1. Yes
2. Yes, and approve TOOL for the rest of the running session
3. No, and tell Copilot what to do differently (Esc)

Option 2 approves that tool with any arguments for the current session only. Approving rm this way lets Copilot run any rm command until the session ends.

• --allow-all-tools: use any tool without approval.
• --allow-tool: allow one tool without approval.
• --deny-tool: block one tool. It takes precedence over both allow options.
• Arguments: 'shell(COMMAND)', 'shell' for all shell commands, 'write' for non-shell file edits, 'MCP_SERVER_NAME' or 'MCP_SERVER_NAME(tool_name)'.
• For git and gh you can target a first level subcommand, such as shell(git push).

copilot --allow-all-tools --deny-tool='shell(rm)' --deny-tool='shell(git push)'

copilot --allow-tool='My-MCP-Server' --deny-tool='My-MCP-Server(tool_name)'

copilot -p "Show me this week's commits and summarize them" --allow-tool='shell(git)'

--allow-all or --yolo enables all permissions at once. In an interactive session you can also control tool permissions with slash commands such as /allow-all and /yolo. Run copilot help permissions for details.

At startup you confirm that you trust the launch folder and everything below it. Do not launch from your home directory. Add another folder during a session with /add-dir.

/add-dir /path/to/directory

GitHub says permission scoping is heuristic and does not guarantee files outside trusted directories are protected.

Enter /sandbox enable to restrict what commands run by Copilot can access on your machine. Or run copilot --cloud to run the whole session in an isolated cloud environment.