GitHub Copilot for JetBrains 1.18.0, announced September 22, 2026, adds assisted approvals for Copilot agent sessions, shared organization and enterprise skills/instructions, Codex plan mode, persistent per-tool MCP controls and a separate switch for the built-in GitHub MCP Server. GitHub says assisted approvals are in public preview: low-risk tool calls can be approved automatically while higher-risk actions still require a user decision. Teams should treat that classification as an interaction aid, not as a replacement for repository permissions, sandboxing, secret boundaries, branch protection, review or deployment controls. Before enabling the new workflow broadly, test it with non-sensitive repositories, explicitly review which MCP tools are available, preserve human approval for consequential actions, and verify that plan/re-edit behavior cannot silently carry unwanted file changes into production.
A JetBrains user sees fewer approval prompts in Copilot agent sessions after updating to 1.18.0
An enterprise wants organization-managed skills and custom instructions available in both local and Copilot agent sessions
A team needs persistent allow/deny choices for individual MCP tools instead of approving every call repeatedly
A developer wants to review a Codex agent plan before implementation or rewind a session to edit an earlier request
Possible causes
GitHub introduced assisted approvals in public preview so lower-risk agent tool calls can receive automatic approval
JetBrains 1.18.0 adds organization and enterprise skills plus organization-managed custom instructions to local and Copilot agent sessions
The release adds persistent per-tool MCP controls and a separate enable/disable setting for the built-in GitHub MCP Server
Codex plan mode and message re-editing create new checkpoints where teams can shape or rewind an agent workflow before continuing
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Confirm that the behavior comes from GitHub Copilot for JetBrains 1.18.0 or later and review GitHub's live changelog before standardizing it. The September 22 release introduces assisted approvals as a public preview, so details can change.
Step 2. Inventory the tools an agent can call before turning on automation. Review the built-in GitHub MCP Server separately from manually configured MCP servers, and record which tools can read source, modify files, call external systems, access issues or pull requests, run commands, or trigger consequential side effects.
Step 3. Keep consequential tools human-gated even when low-risk calls can be assisted. Automatic approval should not cover production deployments, destructive database actions, billing changes, secret access, account administration or other operations where an incorrect classification could cause material harm.
Step 4. Use least-privilege repository and platform permissions as the primary control. If an agent cannot perform a sensitive action with its credential or token, a mistaken approval decision has a smaller blast radius.
Step 5. Test assisted approvals in a non-sensitive repository first. Capture which calls auto-approve, which calls prompt, and whether tool behavior changes when project context, MCP configuration or custom instructions change.
Step 6. Review organization and enterprise skills and custom instructions as executable guidance, not merely documentation. Keep them version-controlled where possible, remove stale commands, and avoid embedding secrets, private keys or production credentials in shared instructions.
Step 7. Use Codex plan mode for consequential work. Review the proposed scope, files, migrations, tests and rollback path before allowing implementation, then require the normal typecheck, tests, security checks and human code review afterward.
Step 8. When re-editing an earlier user message, remember that GitHub says Copilot rewinds both the conversation and file changes before the replacement message is sent. Verify the working tree after the rewind so expected changes were not lost and unwanted changes did not survive through another path.
Step 9. Use persistent MCP controls deliberately. A remembered allow/deny choice can reduce interruptions, but it can also outlive the immediate context in which the decision was made. Revisit permissions when repositories, tools, organization policy or task risk changes.
Step 10. Keep the built-in GitHub MCP Server decision separate from manually configured MCP servers. GitHub says the new setting can turn the built-in server on or off without changing manually configured servers, so disabling one does not prove the others are disabled.
Step 11. For JetBrains Gateway or remote development users, account for the release change that hides inline chat and its entry points in those environments. Do not diagnose the missing interface as an authorization failure before checking the supported surface.
Step 12. Re-evaluate older IDE installations. GitHub says JetBrains IDE 2025.1 users receive advance notice to upgrade to 2026.1 or later, although support is unchanged in this release; plan the IDE upgrade separately from agent-permission changes.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
Evaluate the feature with non-sensitive repositories and sandbox/test credentials before broader use.
Keep tool permissions and workflow tokens least-privileged even when assisted approvals reduce prompts.
Audit persistent MCP choices and organization instructions periodically so old approvals do not become invisible long-term access.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not treat GitHub's low-risk assisted-approval classification as authorization to give an agent production credentials or destructive tools.
Do not assume disabling the built-in GitHub MCP Server disables manually configured MCP servers.
Do not store secrets or customer data in shared organization skills or custom instructions.
Do not skip typecheck, tests, human review or rollback planning because a Codex plan was reviewed before implementation.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
What are assisted approvals in GitHub Copilot for JetBrains?
GitHub describes assisted approvals as a public-preview feature where lower-risk tool calls in Copilot agent sessions can be approved automatically while higher-risk actions continue to prompt the user.
Does assisted approval make an MCP tool safe?
No. It changes the approval interaction. Repository permissions, tool scope, secrets, sandboxing, review and deployment controls remain separate safety boundaries.
Can I disable the built-in GitHub MCP Server without removing my other MCP servers?
Yes. GitHub says JetBrains 1.18.0 adds a separate control for the built-in GitHub MCP Server, while manually configured MCP servers remain independently configured.
What does Codex plan mode do?
GitHub says Codex agent plan mode lets you review, refine or approve a plan before implementation. It is a planning checkpoint, not a substitute for testing and code review after changes are made.
Once you know the platform and the verified problem, search the Genesis Code Doctor Code Store for a matching package. If the exact integration or repair is not there, use Request a Code and describe the platform, official documentation, desired behavior, and sanitized error—never send your secret key.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
GENESISCODE DOCTOR AI