Skip to main content

​
What asks first

Each tool the model can use has a policy. allow runs without asking you. ask asks you first. /mcp-server lists every tool with its policy. Every tool from an MCP server you added has the policy ask.

​
Built-in tools that run without asking

When Mochiii’s background service starts, it writes this list to its log. These built-in tools run without asking you: A long task is one started with /task, /fix, /debug, /refactor or /hunt. read_file still asks before it reads a file outside the project. Three more built-in tools can reach the internet: web_fetch, web_search and github. Their policy is allow, but the log says they run without asking only when the call cannot carry what the model has read: a search made before the turn has read anything, or a fetch of an address you typed or a search returned. Any other search or fetch asks first. For example, a fetch of an address you typed in your question runs without asking, and a fetch of an address the model wrote itself asks.

​
The question

The question is one line, saying what will happen. For example: The arguments are shown in full. A line under the question can warn you, for example:
  • NOT SANDBOXED: a separate program with your full access, for a shell command or a tool from an MCP server
  • LEAVES YOUR MACHINE: sent to a third party over the internet, for a web call
  • THE AGENT WROTE THIS ADDRESS ITSELF: you did not type it and no search returned it …, for a web call
  • marked destructive
A tool from an MCP server is named with its server, as server/tool. An MCP server can describe its tools with hints. Mochiii shows marked destructive for a tool the server gives hints for, unless the server says the tool is not destructive. A tool with no hints is not marked, and neither is one whose server says it is not destructive. A tool the server marks only as read-only is still marked destructive.

​
Your answer

The keys are shown under the question: y yes · a yes for this turn · n no. Other keys do nothing while a question is waiting. If the question is longer than the screen, the key line reads ↓ PgDn to read on · 38 more line(s) before yes · n no · esc stop, and y does nothing until you have paged to the end. After you answer, a line stays in the chat, for example:
  • ✓ approved builtin__run_command
  • ✓ approved builtin__read_file for the rest of this task
  • ✓ approved builtin__sandbox_exec for this exact command while this spec is active
  • ✗ denied probe__safe

​
How long a yes lasts

  • y covers this call.
  • a lasts until the turn ends. In a long task the whole task is one turn, and the key reads a yes for this whole task. What it covers depends on the tool:
    • a shell command, a web call, or a tool marked destructive: only the same arguments again. a for ls does not cover pwd.
    • a file outside the project: only that path.
    • any other tool, such as an MCP tool with no hints: every later call to it in the turn.
  • s lasts across turns while the same spec stays active. /spec show lists what you approved this way. It ends when you type /spec off, choose another spec, or quit.

​
Edits and deletes

An edit the model proposes asks first, with Allow propose_edit: … ?. At the end of the turn, Mochiii shows each edit as a diff, with y apply · n skip · q cancel remaining. The file changes only when you press y, and Mochiii keeps a copy of it from before and after in .mochiii/backups/. A delete happens when you answer yes to it. The file is moved to .mochiii/trash/ in the project.