GitHub Copilot CLI deactivate tool "web_fetch"

[tom1299]

I wanted to disable the web_fetch tool. So I started the Copilot cli like this:
copilot --deny-tool 'web_fetch'
But it seemed to have no effect:

$ copilot --deny-tool 'web_fetch'
╭──────────────────────────────────────────────────────────────────────────────────────────────────╮
│  ╭─╮╭─╮                                                                                          │
│  ╰─╯╰─╯  GitHub Copilot v1.0.3                                                                   │
│  █ ▘▝ █  Describe a task to get started.                                                         │
│   ▔▔▔▔                                                                                           │
│  Tip: /review Run code review agent to analyze changes                                           │
│  Copilot uses AI, so always check for mistakes.                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯

● 💡 No copilot instructions found. Run /init to generate a copilot-instructions.md file for this project.

● Environment loaded: 1 MCP server

❯ Get the content of the url https://google.com

◐ The user wants me to fetch the content of https://google.com.

○ Fetching web content:  https://google.com

╭─────────────────────────────────────────────╮
│ Fetch web content                                                                                                                                                                                                                                                    │
│                                                                                                                                                                                                                                                                      │
│ Copilot is attempting to access the following URL:                                                                                                                                                                                                                   │
│                                                                                                                                                                                                                                                                      │
│ ╭───────────────────────────────────────────╮ │
│ │ https://google.com                                                                                                                                                                                                                                               │ │
│ ╰───────────────────────────────────────────╯ │
│                                                                                                                                                                                                                                                                      │
│ Do you want to allow this access?

Note that I truncated the output a little bit. It still seems to use the web_fetch tool. So what am I missing here ?

Thanks in advance for any help.

[sepe81]

Confirmed — reproduction shows _copilot --deny-tool web_fetch still prompts to fetch URLs, so the deny flag isn’t being applied. Reproduced on v1.0.3 (macOS): the CLI still requests permission.

This looks like a bug. Can maintainers please triage?