Based on GitHub / Microsoft’s official docs, checked October 21, 2026

GitHub Copilot CLI yolo mode: --allow-all and safer tool rules

GitHub Copilot CLI asks before it runs tools that can change or execute files, before it touches paths outside your working folder, and before it fetches URLs. Its “yolo mode” turns all three checks off at once. This guide explains what --allow-all (alias --yolo) and the /yolo slash command do, and how to use narrower --allow-tool and --deny-tool rules instead, based on GitHub’s Copilot CLI docs checked October 21, 2026.

1. 1. Know what yolo mode turns on

   GitHub’s docs say --allow-all, or its alias --yolo, combines --allow-all-tools (skip tool approval), --allow-all-paths (disable path verification) and --allow-all-urls (disable URL verification). In an interactive session, /allow-all or /yolo enables all permissions.

   copilot --yolo

2. 2. Allow only the tools you need

   Use --allow-tool with shell(COMMAND), write, or an MCP server name. For git and gh you can name a first-level subcommand, such as shell(git status). shell with no command allows every shell command.

   copilot --allow-tool='shell(git status)' --allow-tool='shell(npm test)'

3. 3. Block risky commands with --deny-tool

   --deny-tool takes precedence over --allow-all-tools and --allow-tool, so a deny still applies when everything else is allowed. GitHub’s example blocks rm and git push.

   copilot --allow-all-tools --deny-tool='shell(rm)' --deny-tool='shell(git push)'

4. 4. Pre-approve domains instead of all URLs

   By default every URL needs approval. Use --allow-url=DOMAIN for hosts you trust and --deny-url=DOMAIN to block others. HTTP and HTTPS count as different protocols and need separate approval.

   copilot --allow-url=github.com

5. 5. Sandbox anything you auto-approve

   GitHub recommends local or cloud sandboxing, or a VM or container with tight permissions and network access, when you use automatic approval options. Only launch Copilot CLI from folders you trust, and not from your home directory.

What the approval prompt options mean

The first time Copilot wants a tool that can modify or execute files, it offers: Yes (this command, this time), Yes and approve the tool for the rest of the running session, or No and tell Copilot what to do differently.

The session option is broader than it looks. GitHub’s own example: approving rm ./this-file.txt for the session lets Copilot run any rm command, such as rm -rf ./*, without asking again. The approval ends when the session ends and is asked again in new or resumed sessions.

Default limits in Copilot CLI

Paths: the current working directory, its subdirectories and the system temp directory. Use --disallow-temp-dir to remove the temp directory.

URLs: every URL needs approval. This applies to web_fetch and to a set of network commands such as curl and wget.

Trusted directories: you confirm trust for the launch folder at the start of a session; permanently trusted folders are stored in ~/.copilot/config.json.

GitHub notes that path and URL detection in shell commands is heuristic: paths in complex shell constructs, custom environment variables and obfuscated URLs may not be detected.

Business and Enterprise accounts

GitHub’s docs say that on Copilot Business or Copilot Enterprise licenses, an enterprise administrator may block the --allow-all and /yolo commands.

Tips

• Use deny rules for rm, git push and publish commands even when you allow everything else.
• Approve “for the rest of the session” only for read-only tools; it covers every use of that tool.
• In repositories you didn’t write, skip yolo mode; planted files can steer what the agent tries to run.
• For scripts with -p, pass explicit --allow-tool flags rather than --yolo.

Next steps

Sources

• https://docs.github.com/en/copilot/how-tos/copilot-cli/set-up-copilot-cli/configure-copilot-cli · checked 2026-10-21
• https://docs.github.com/en/copilot/concepts/agents/copilot-cli/about-copilot-cli · checked 2026-10-21