How to confirm tool calls before they run

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

# How to confirm tool calls before they run

By default mini-me runs in **yolo mode**: `bash`, file writes and edits run as soon as the model asks for them. This guide shows how to make the agent ask you first, in the terminal, in the window and in an editor. It assumes you already run `mm` with a YAML configuration file.

## Steps

1. Turn yolo off in your configuration file:

   ```yaml
   yolo: false
   bashTool: true
   ```

   `bashTool` (and `editTools`, `fetchContentTool`) still decide which tools **exist**; `yolo` decides whether the ones that exist ask before running.

2. Start `mm` as usual. The banner ends with `yolo: off (tools ask)`:

   ```
   mm v0.2.6 | config: agent.yaml | provider: dmr | model: … | tools: bash, read_file, write_file, edit_file | skills: 3 | yolo: off (tools ask)
   ```

3. Ask for something that runs a command. In the line mode, the tool's line is followed by a question:

   ```
   🛠️  bash: ls -la

   🔐 bash: ls -la
      [a] allow once · [s] allow bash for this session · [r] reject · [n] never bash
      ?
   ```

4. Type one letter and press Enter:

   | Key | Effect |
   |-----|--------|
   | `a` | Run this call. The next `bash` call asks again. |
   | `s` | Run this call and every later `bash` call of this session without asking. |
   | `r` | Do not run this call. The model receives `[command rejected by the user]` and can propose something else. The next call asks again. |
   | `n` | Do not run this call, and refuse every later `bash` call of this session without asking. |

   Anything else shows the legend again. `/abort` or **Ctrl+C** rejects the call and stops the turn.

## Variants

- **In the window (`mm -tui`).** The input box is replaced by `? bash: ls -la` and the same four keys answer it; **Esc** is the same as `r`.
- **In an editor (`mm -acp`, Zed).** The editor's permission dialog offers *Allow once*, *Allow bash for this session*, *Reject* and *Never allow bash in this session*. With `yolo: true`, no dialog is shown at all.
- **For one run only, without editing the file.** `AGENT_YOLO=false mm agent.yaml` (or `AGENT_YOLO=true` to skip the questions once). In an editor, put the variable in the agent's `env` settings next to `AGENT_CONFIG`.
- **With other agents (`mmConfigs`).** The agent you started decides for the agents it asks. With `yolo: false` in your main configuration, a `bash` call made by `/ask-jan` asks *you*, titled `jan · bash: …`, and `s` remembers `jan/bash`, not your own `bash`. The `yolo` written in Jan's own file is ignored while it answers an `/ask`.
- **In a script (`mm -p`, `mm --ask`).** Nobody can answer there, so with `yolo: false` the calls that would ask are rejected, and stderr says so once: `[yolo is off and this mode cannot ask: …]`. Keep `yolo: true` for scripted runs, or remove the tools you do not want with `bashTool: false` / `editTools: false`.
- **MCP tools.** With `yolo: false` every MCP tool asks too. With `yolo: true`, each MCP server keeps its own `permissions` (`ask` by default, `auto` to run unasked).
- **An old configuration with `permissions: ask`.** It still works and means `yolo: false`; the banner warns that the key is deprecated. Replace it with `yolo: false`.

## See also

- Every key and its default: [configuration reference](../reference/configuration.md) (`yolo`, `permissions`).
- What each front end shows: [CLI reference](../reference/cli.md), [ACP reference](../reference/acp.md#sessionrequest_permission-requests-sent).
- Why yolo is the default and why the asking agent wins: [Yolo mode and permissions](../explanation/yolo-and-permissions.md).