github / github/copilot-cli

Add `--disable-repo-mcps` flag to skip loading MCPs from `.mcp.json` / `.github/mcp-config.json`

Open
#3,380 2 comments 1 reaction 0 assignees View on GitHub
area:configuration area:mcp
Dominant language
Shell
Stars
11.2k
Forks
1.9k
Avg merge
14h 16m
Merged PRs (30d)
6

Description

### Describe the feature or problem you'd like to solve

Today there is **no clean way to launch `copilot` while ignoring the MCP definitions a repository ships in `./.mcp.json` or `.github/mcp-config.json`** — you can only disable MCPs at a per-name granularity via `--disable-mcp-server ` (repeatable), which requires knowing every name the repo defines and re-typing them on every launch.

This matters in a few real situations:

1. **A repo's MCP config silently shadows my user-level config.** See the related bug report ([#3379](https://github.com/github/copilot-cli/issues/3379)) where `.mcp.json` in a repo overrode my user-level playwright MCP (which was correctly configured with `--browser msedge`) with a default-browser version that tried to launch chrome. I couldn't fix this without:
- Editing `.mcp.json` (a shared tracked file in the repo — I shouldn't commit that change)
- Or temporarily renaming/moving it
- Or remembering to type `--disable-mcp-server playwright --disable-mcp-server --disable-mcp-server ...` every time I launch `copilot` in that repo.

None of these are reasonable workflows.

2. **The repo's MCP definitions require dependencies I don't have installed**, blocking the CLI from starting cleanly.

3. **I trust my own user-level MCP config but not necessarily the MCP servers a freshly-cloned repo brings in** (security/supply-chain consideration). Today the only mitigation is reviewing/editing every cloned repo's `.mcp.json` before first launch.

A prior CLI session also reached the same dead end while researching options — the closest workarounds we could find were:
- Launching from a different cwd (`copilot -C $HOME`) and then `/cwd`-ing in, which is awkward and fights the CLI's workspace-awareness.
- Wrapping `copilot` in a shell alias that hard-codes every repo MCP name to disable, which doesn't scale across repos.

### Proposed solution

Add a CLI flag (suggested name: `--disable-repo-mcps`) that prevents the CLI from loading MCP definitions from any repository-scoped config file. Only built-in MCPs and user-level MCPs (`$HOME/.copilot/mcp-config.json`) would be considered.

Example:

```
copilot --disable-repo-mcps
```

Additional refinements worth considering:

- **Persist as a session setting** the way `--experimental` does, so users who always want this behavior in certain environments can set it once.
- **Show repo MCPs as disabled in `/mcp`** with a note like `(skipped: --disable-repo-mcps)`, so it's discoverable.
- **Allow opt-in re-enablement of specific repo MCPs** via something like `--enable-mcp-server ` for symmetry with the existing `--disable-mcp-server `. (Optional; the headline flag alone covers most cases.)
- **Companion env var** (e.g., `COPILOT_DISABLE_REPO_MCPS=1`) for users who want it set per-shell without editing aliases.

### Example prompts or workflows

Workflow 1 — my user-level MCP setup is canonical and I never want repos to override it:

```
alias copilot='copilot --disable-repo-mcps'
```

...and now `cd`-ing into any cloned repo just works with my own MCP toolchain, ignoring whatever the repo happens to ship.

Workflow 2 — I want to quickly check what a repo defines without it actually loading:

```
cd some-repo
copilot --disable-repo-mcps
/mcp # shows repo-defined entries grayed out / skipped
```

Workflow 3 — troubleshooting #3379-style naming conflicts:

```
copilot --disable-repo-mcps # confirm the user-level config works in isolation
copilot # bring repo MCPs back in to reproduce the conflict
```

### Additional context

- Related bug: [#3379](https://github.com/github/copilot-cli/issues/3379) — MCP naming conflict where `/mcp` UI lists user-level entry but runtime uses repo-level settings. The frustration trail referenced above came from trying to work around exactly that bug without a `--disable-repo-mcps`-style flag.
- The existing `--disable-builtin-mcps` flag is a partial precedent for scope-based disabling; this would be its repo-scope counterpart.
- Affected version: 1.0.49-6.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.