npx -y cc-safety-net@latest install --copilot-cli. It installs the cc-safety-net@cc-marketplace plugin through Copilot CLI’s own plugin marketplace commands. If the plugin was disabled, it enables the plugin in ~/.copilot/settings.json. Then restart Copilot CLI, which picks up the plugin only after a restart.
Install CC Safety Net in GitHub Copilot CLI
1
Run the installer
2
Restart Copilot CLI
Restart Copilot CLI to load the plugin.
3
Confirm the plugin is active
What the GitHub Copilot CLI install changes
- It adds the
cc-marketplacemarketplace if it is not already registered. - It installs the
cc-safety-net@cc-marketplaceplugin. - If the plugin was explicitly disabled, it sets the plugin to
trueinenabledPluginsin~/.copilot/settings.json.
What the GitHub Copilot CLI hook checks
The plugin’s hook runs on Copilot CLI’spreToolUse event. It analyzes bash and powershell tool calls as shell commands and inspects the inputs of other tools for protected paths.
If you add hooks by hand, Copilot CLI support depends on its version. Inline hook definitions in settings files need 1.0.8 or later, and user hook files need 0.0.422 or later. doctor reports the detected version and the hook sources it supports.
What happens when the GitHub Copilot CLI check fails
GitHub Copilot CLI blocks the tool call when the hook crashes, exits non-zero, or cannot start. A hook that times out after the default 30 seconds, or prints invalid output, lets the call proceed.Uninstall CC Safety Net from GitHub Copilot CLI
Troubleshoot GitHub Copilot CLI
doctor checks the plugin and any CC Safety Net hooks you added by hand. COPILOT_HOME defaults to ~/.copilot.
Hooks you added by hand
doctor counts a CC Safety Net hook in any of these files, listed from highest precedence:
<repo>/.github/copilot/settings.local.json<repo>/.github/copilot/settings.json<repo>/.claude/settings.local.json<repo>/.claude/settings.json$COPILOT_HOME/settings.json- The hook files
<repo>/.github/hooks/*.jsonand$COPILOT_HOME/hooks/*.json
.claude file counts only when its command includes hook --copilot-cli or hook -cp. A Claude Code hook alone does not count.
When a hook file or settings entry still runs the CC Safety Net hook, doctor reports it with the method hook config, even if the plugin is disabled.
Hooks or the plugin are switched off
disableAllHooks: truein a repository settings file turns off CC Safety Net in that repository, plugin included.disableAllHooks: truein$COPILOT_HOME/settings.jsonturns off only that file’s inline hooks. Hook files and the plugin keep running.- A hook file that sets its own
disableAllHookstotruedoes not count. The other hook files still do. - For
cc-safety-net@cc-marketplaceinenabledPlugins, the first repository settings file that sets it takes precedence over$COPILOT_HOME/settings.json. A repositorytruere-enables a userfalse.