GitHub Copilot CLI deactivate tool "web_fetch"

[tom1299]

Select Topic Area

Question

Copilot Feature Area

General

Body

I wanted to disable the web_fetch tool. So I started the Copilot cli like this:
copilot --deny-tool 'web_fetch'
But it seemed to have no effect:

$ copilot --deny-tool 'web_fetch'
╭──────────────────────────────────────────────────────────────────────────────────────────────────╮
│  ╭─╮╭─╮                                                                                          │
│  ╰─╯╰─╯  GitHub Copilot v1.0.3                                                                   │
│  █ ▘▝ █  Describe a task to get started.                                                         │
│   ▔▔▔▔                                                                                           │
│  Tip: /review Run code review agent to analyze changes                                           │
│  Copilot uses AI, so always check for mistakes.                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯

● 💡 No copilot instructions found. Run /init to generate a copilot-instructions.md file for this project.

● Environment loaded: 1 MCP server

❯ Get the content of the url https://google.com

◐ The user wants me to fetch the content of https://google.com.

○ Fetching web content:  https://google.com

╭─────────────────────────────────────────────╮
│ Fetch web content                                                                                                                                                                                                                                                    │
│                                                                                                                                                                                                                                                                      │
│ Copilot is attempting to access the following URL:                                                                                                                                                                                                                   │
│                                                                                                                                                                                                                                                                      │
│ ╭───────────────────────────────────────────╮ │
│ │ https://google.com                                                                                                                                                                                                                                               │ │
│ ╰───────────────────────────────────────────╯ │
│                                                                                                                                                                                                                                                                      │
│ Do you want to allow this access?

Note that I truncated the output a little bit. It still seems to use the web_fetch tool. So what am I missing here ?

Thanks in advance for any help.

[tom1299]

Hi! This is a known edge case with --deny-tool and MCP servers. Here's what's likely happening and how to fix it:

Root Cause: Your environment has 1 MCP server loaded: ● Environment loaded: 1 MCP server

The web_fetch tool being used is most likely provided by the MCP server, NOT Copilot's built-in toolset.

The --deny-tool flag only blocks Copilot's own built-in tools - it does not currently block tools provided by MCP servers.

Fix 1 - Disable the MCP server entirely: Find your MCP config file (usually at): ~/.config/github-copilot/mcp.json or .github/copilot/mcp.json

Remove or comment out the MCP server that provides web_fetch and restart Copilot.

Fix 2 - Check exact tool name: The tool name may be slightly different. Try: copilot --deny-tool 'fetch' copilot --deny-tool 'web-fetch' copilot --deny-tool 'webfetch'

Tool names are case sensitive and must match exactly.

Fix 3 - Use the /tools command inside Copilot: Once inside the CLI, run: /tools

This lists all available tools with their exact names. Use the exact name shown with --deny-tool.

Fix 4 - Deny all web tools at once: copilot --deny-tool 'web_fetch' --deny-tool 'fetch' --deny-tool 'web_search'

Verify it worked: After applying the fix, run: /tools

The denied tool should no longer appear in the list.

Hope this helps! If web_fetch is definitely coming from the MCP server, disabling the server is the most reliable solution for now.

Same effect with all mcp servers disabled:

$ copilot --deny-tool 'web_fetch' --log-level=all --log-dir=./logs --disable-builtin-mcps --disable-mcp-server 'github-mcp-server'
╭──────────────────────────────────────────────────────────────────────────────────────────────────╮
│  ╭─╮╭─╮                                                                                          │
│  ╰─╯╰─╯  GitHub Copilot v1.0.3                                                                   │
│  █ ▘▝ █  Describe a task to get started.                                                         │
│   ▔▔▔▔                                                                                           │
│  Tip: /skills Manage skills for enhanced capabilities                                            │
│  Copilot uses AI, so always check for mistakes.                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯

● 💡 No copilot instructions found. Run /init to generate a copilot-instructions.md file for this project.

● Environment loaded

❯ Get the content of the url https://google.com

◐ The user wants me to fetch the content of https://google.com.

○ Fetching web content:  https://google.com

╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Fetch web content                                                                                                                                                                                                                                                    │
│                                                                                                                                                                                                                                                                      │
│ Copilot is attempting to access the following URL:                                                                                                                                                                                                                   │
│                                                                                                                                                                                                                                                                      │
│ ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │
│ │ https://google.com                                                                                                                                                                                                                                               │ │
│ ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ │
│                                                                                                                                                                                                                                                                      │
│ Do you want to allow this access?            s

Are there any other tools sources besides mcp servers which could provide such a tool ?

[tom1299]

Thanks. It worked!

[fzihak]

Hey, I ran into this exact issue before — let me walk you through what's actually happening and how to properly fix it.

What's going on

The clue is right here in your output:

● Environment loaded: 1 MCP server

The web_fetch being called isn't Copilot's built-in tool — it's coming from that MCP server. The --deny-tool flag only blocks Copilot's own built-in tools and has zero effect on anything an MCP server provides. So the flag isn't broken, it's just not designed to handle this case.

---

Step 1 — Figure out exactly which server is providing it

Before touching any config, first confirm what you're dealing with. Run this inside the Copilot CLI after startup:

/tools

This lists every available tool — built-in and MCP-provided — with their exact names. Find web_fetch in the list and note which server it belongs to. Tool names are also case-sensitive, so web_fetch and Web_Fetch are treated as completely different tools.

Then check your MCP config to see which servers are loaded:

cat ~/.config/github-copilot/mcp.json

or if you're using a project-level config:

cat .github/copilot/mcp.json

This tells you the exact server name you need to target.

---

Step 2 — Disable just that server

Once you know which server is responsible, remove or disable only that entry from your config — no need to wipe everything. For example, if your config looks like this:

{
  "servers": {
    "my-web-server": {
      "command": "..."
    },
    "some-other-server": {
      "command": "..."
    }
  }
}

Just remove the my-web-server block entirely and save. Then restart Copilot.

---

Step 3 — Verify the fix

Start Copilot again and run:

/tools

If web_fetch no longer appears in the list, you're done. Try the same fetch request — it should either fail or not be attempted at all.

---

What if you still need the MCP server for other tools?

If that server provides other tools you actually use, check its own documentation. Some MCP servers support disabling specific tools through their own config options — but this varies by implementation, so there's no universal field for it. The server's README should mention it if it's supported.

---

This should fully resolve it. The key thing is --deny-tool was never going to work here — the fix had to come from the MCP config side. Let me know if the /tools output shows something unexpected!

[tom1299]

Hey, I ran into this exact issue before — let me walk you through what's actually happening and how to properly fix it.

What's going on

The clue is right here in your output:

● Environment loaded: 1 MCP server

The web_fetch being called isn't Copilot's built-in tool — it's coming from that MCP server. The --deny-tool flag only blocks Copilot's own built-in tools and has zero effect on anything an MCP server provides. So the flag isn't broken, it's just not designed to handle this case.

Step 1 — Figure out exactly which server is providing it

Before touching any config, first confirm what you're dealing with. Run this inside the Copilot CLI after startup:

/tools

This lists every available tool — built-in and MCP-provided — with their exact names. Find web_fetch in the list and note which server it belongs to. Tool names are also case-sensitive, so web_fetch and Web_Fetch are treated as completely different tools.

Then check your MCP config to see which servers are loaded:

cat ~/.config/github-copilot/mcp.json

or if you're using a project-level config:

cat .github/copilot/mcp.json

This tells you the exact server name you need to target.

Step 2 — Disable just that server

Once you know which server is responsible, remove or disable only that entry from your config — no need to wipe everything. For example, if your config looks like this:

{
  "servers": {
    "my-web-server": {
      "command": "..."
    },
    "some-other-server": {
      "command": "..."
    }
  }
}

Just remove the my-web-server block entirely and save. Then restart Copilot.

Step 3 — Verify the fix

Start Copilot again and run:

/tools

If web_fetch no longer appears in the list, you're done. Try the same fetch request — it should either fail or not be attempted at all.

What if you still need the MCP server for other tools?

If that server provides other tools you actually use, check its own documentation. Some MCP servers support disabling specific tools through their own config options — but this varies by implementation, so there's no universal field for it. The server's README should mention it if it's supported.

This should fully resolve it. The key thing is --deny-tool was never going to work here — the fix had to come from the MCP config side. Let me know if the /tools output shows something unexpected!

The name of the tool seems to be indeed web_fetch and be selected as a tool choice. Some lines from the logs:

  {     
    "type": "function",
    "function": {
      "name": "web_fetch",
      "description": "Fetches a URL from the internet and returns the page as either markdown or raw HTML. Use this to safely retrieve up-to-date information from HTML web pages.",
      "parameters": {
        "type": "object",
        "properties": {
          "url": {

            "choices": [
    {
      "index": 0,
      "finish_reason": "tool_calls",
      "logprobs": null,
      "message": {
          { 
            "id": "tooluse_rrmo8mQQ14MvJrjlrYdxkD",
            "type": "function",
            "function": {
              "name": "report_intent",
              "arguments": "{\"intent\": \"Fetching URL content\"}"
            }
          },
          {
            "id": "tooluse_bHdxccFQS5CgaN4n6jzxgl",
            "type": "function",
            "function": {
              "name": "web_fetch",
              "arguments": "{\"url\": \"https://google.com\"}"
            }
          }
        ],
        "parsed": null
      }     
    }       
  ], 

[fzihak]

Hey @tom1299, thanks for the extra testing - this confirms everything now.
To answer your question directly: no, there are no other tool sources besides MCP servers and Copilot's own built-in tools. Since all MCP servers are disabled and web_fetch is still appearing, it's definitely a true Copilot built-in tool.
The reason --deny-tool 'web_fetch' doesn't work is that --deny-tool only accepts specific type qualifiers like shell(command) or MCP_SERVER_NAME(tool_name). Passing a raw built-in tool name like web_fetch isn't a valid pattern for this flag, so it gets silently ignored.
To actually block web_fetch, use --deny-url instead , that's the flag specifically designed to control URL access for built-in tools:
copilot --deny-url '*'
This blocks all URL access entirely. For specific domains only:
copilot --deny-url 'https://google.com'
Note that HTTP and HTTPS are treated as separate protocols, so if you want to block both:
copilot --deny-url 'https://google.com' --deny-url 'http://google.com'
If you want a permanent solution without passing flags every time, you can use a preToolUse hook. Hook config files are loaded automatically from .github/hooks/*.json in your repository. Create a file there like deny-web-fetch.json:

  "preToolUse": [
    {
      "match": { "tool": "web_fetch" },
      "decision": "deny"
    }
  ]
}

This intercepts every web_fetch call before it runs and denies it automatically.
Hope this finally resolves it!

[tom1299]

@fzihak @mubin25s Thanks for your answers. I do not have a /tools command and use version 1.0.3 (latest) of the copilot cli. Which versions are you using ?

[fzihak]

Hey @tom1299, you're right - I apologize for the confusion. /tools isn't a valid command in Copilot CLI 1.0.3. That was my mistake.

Here's what actually works:

Step 1 - Find your MCP server name and its tools

Run this inside the Copilot CLI:

/mcp show

This lists all configured MCP servers with their current status. Then to confirm exactly which tools a specific server provides:

/mcp show YOUR-SERVER-NAME

This will confirm whether web_fetch is coming from that server.

Step 2 - The honest limitation

Unfortunately, in version 1.0.3 there's no way to block a single tool from an MCP server without disabling the entire server. Granular tool-level denial for MCP-provided tools isn't supported yet — so --deny-tool simply won't work for this case regardless of the syntax used.

Step 3 - Disable the server

If blocking web_fetch is important enough that you're okay losing the other tools from that server too, you can disable it for the current session:

/mcp disable YOUR-SERVER-NAME

Or to remove it permanently, either run:

/mcp delete YOUR-SERVER-NAME

Or edit the config file directly at ~/.copilot/mcp-config.json, remove that server's block, and restart Copilot.

Step 4 - Verify it worked

Run /mcp show again - the server should show as disabled or be gone entirely. Then try the same fetch request to confirm web_fetch is no longer available.

Again, sorry for the misleading /tools step in my earlier reply. Hope this clears it up!

[tom1299]

Hey @tom1299, you're right - I apologize for the confusion. /tools isn't a valid command in Copilot CLI 1.0.3. That was my mistake.

Here's what actually works:

Step 1 - Find your MCP server name and its tools

Run this inside the Copilot CLI:

/mcp show

This lists all configured MCP servers with their current status. Then to confirm exactly which tools a specific server provides:

/mcp show YOUR-SERVER-NAME

This will confirm whether web_fetch is coming from that server.

Step 2 - The honest limitation

Unfortunately, in version 1.0.3 there's no way to block a single tool from an MCP server without disabling the entire server. Granular tool-level denial for MCP-provided tools isn't supported yet — so --deny-tool simply won't work for this case regardless of the syntax used.

Step 3 - Disable the server

If blocking web_fetch is important enough that you're okay losing the other tools from that server too, you can disable it for the current session:

/mcp disable YOUR-SERVER-NAME

Or to remove it permanently, either run:

/mcp delete YOUR-SERVER-NAME

Or edit the config file directly at ~/.copilot/mcp-config.json, remove that server's block, and restart Copilot.

Step 4 - Verify it worked

Run /mcp show again - the server should show as disabled or be gone entirely. Then try the same fetch request to confirm web_fetch is no longer available.

Again, sorry for the misleading /tools step in my earlier reply. Hope this clears it up!

Please see my comment above. Works even with all mcp servers disabled.