Tool Approval
Control what actions Claude takes during a session
Tool Approval
DorkOS gives you control over what Claude does during a session. When tool approval is active, Claude pauses before running operations and waits for your decision.
This page covers tools inside a session. When an agent asks DorkOS itself to do something that can't be undone, like removing an installed package, a different card appears at the top of Home. See Action Approvals.
How It Works
When Claude wants to use a tool (writing a file, running a command, editing code), a tool approval card appears in the chat. The card shows:
- Tool name: a display name for the operation Claude wants to perform
- Risk indicator: a color-coded shield icon showing the risk level (red for high, amber for medium, gray for low)
- Context details: SDK-provided description, the decision reason, and the blocked file path (when applicable)
- Tool input: parameters for the tool (file paths, command arguments, search terms)
- Action buttons: Approve, Always Allow (when available), and Deny
Review the tool name, risk level, and input to understand what Claude is about to do.
Click Approve to allow this single action. Claude executes the tool and continues.
Click Always Allow (when available) to approve this action and grant a standing permission so similar tool calls won't require approval for the rest of the session.
Or click Deny to reject the tool call. Claude receives a denial and chooses a different approach.
Tool approvals have a 10-minute timeout. If you don't respond, the tool call is automatically denied and Claude continues with a different approach. The countdown timer is synchronized with the server clock, so switching tabs or briefly losing connection won't cause drift.
If you deny a tool call, you can explain why in your next message or ask Claude to try a different approach.
Risk Levels
Each tool approval card shows a shield icon whose color reflects the risk level of the requested operation:
| Risk | Color | Tools |
|---|---|---|
| High | Red | Bash, Write, Edit, NotebookEdit |
| Medium | Amber | WebFetch, WebSearch, unknown MCP tools (mcp__*) |
| Low | Gray | All other tools (read-only operations, DorkOS agent tools) |
High-risk tools can modify the filesystem or execute shell commands. Medium-risk tools have external side effects or come from third-party MCP servers. Low-risk tools are read-only.
Auto-Approved Tools
Certain tools are always auto-approved regardless of permission mode. Two different reasons apply:
Read-only tools cannot change anything: Read, Grep, Glob, LS, NotebookRead, WebSearch, WebFetch
DorkOS agent tools are auto-approved because they are checked by their own rules instead, not because they are read-only: Relay messaging (relay_send, relay_inbox, relay_list_endpoints, relay_register_endpoint), Mesh discovery (mesh_list, mesh_inspect, mesh_discover, mesh_register, mesh_status, mesh_query_topology, get_agent), and UI control tools (control_ui, get_ui_state).
Some of these do change things. relay_inbox with ack: true permanently deletes the messages it returns, and relay_register_endpoint creates a mailbox. They are auto-approved anyway because an agent polls its inbox constantly: a card on every poll would arrive dozens of times an hour, and a person who learns to click through those cards stops reading every other card too. What protects you instead is that the server decides who a call comes from, and an agent can only read or clear an inbox that belongs to it, so the worst an ack can destroy is the agent's own mail. Relay access control (relay/access-rules.json) governs which agents may message each other.
These tools never produce an approval card. That list is short and hand-picked, not a rule about DorkOS tools in general: everything else an agent can ask DorkOS for prompts like any other tool, and the four things an agent cannot take back stop and ask you no matter which permission mode the session is in. See Action approvals.
Always Allow
When an approval card shows an Always Allow button, clicking it does two things:
- Approves the current tool call immediately
- Sends SDK permission updates back to Claude so that similar tool calls are auto-approved for the rest of the session
Not every approval card shows this button: it only appears when the SDK provides permission suggestions for the tool. The keyboard shortcut is Shift+Enter.
Batch Approvals
When Claude fires multiple tool calls concurrently, a batch approval bar appears above the active approval card. It shows the count of pending approvals and provides:
- Approve All: approve every queued tool call at once
- Deny All: deny every queued tool call at once
This is useful during parallel operations (e.g., Claude editing several files at the same time).
Approvals in Chat (Telegram and Slack)
When an agent is connected to a Telegram chat or Slack channel through Relay, approval prompts appear there too, as Approve/Deny buttons under the message. Tapping a button resolves the tool call the same way clicking in DorkOS does.
In group chats, anyone can respond. Approval buttons are not restricted to the person who started the conversation: any member of the bound group chat or Slack channel can approve or deny a tool execution. If that matters to you, bind agents with approval-gated permissions to private chats or DMs instead of shared spaces.
Keyboard Shortcuts
| Action | Shortcut | Context |
|---|---|---|
| Approve | Enter | Approval card |
| Always Allow | Shift+Enter | Approval card |
| Deny | Escape | Approval card |
| Toggle option | 1-9 or Space | Question prompt |
| Navigate options | Arrow Up / Down | Question prompt |
| Navigate questions | Arrow Left / Right or [ / ] | Question prompt |
| Submit answers | Enter | Question prompt |
Shortcuts are active whenever a pending tool approval or question prompt is visible. They are disabled when a text input field is focused (except Enter to submit and arrows to navigate).
Question Prompts
Some tools need more than a yes/no: they need answers. When Claude uses the AskUserQuestion tool, you'll see an interactive question prompt instead of an approval card.
Question prompts support three response types:
- Single-select: choose one option from a list
- Multi-select: choose multiple options
- Free-text ("Other"): type a custom answer when none of the options fit
Your answers are injected into the tool's input. Claude continues with your selections incorporated into its reasoning.
The Trust Dial
Each session has a trust setting — one dial with three stops — that decides how much Claude may do before it checks with you. You can change it at any time from the session's permission picker:
- Ask first: Claude prompts before it edits a file or runs a command. Read-only and agent tools are still auto-approved. This is where every session starts.
- Act: Claude edits files and runs routine commands on its own, and only stops to ask about the risky ones.
- Full autonomy: every tool approval prompt inside the session is skipped. The first time you turn this on, DorkOS asks you to confirm what it means and writes down that you did; after that, the session stops pausing for your approval on each tool call — though the agent still asks when something genuinely needs your call, and still follows anything you have told it to check with you about.
Full autonomy turns off the approval prompts inside the session, so the agent edits files and runs commands without stopping for your OK each time. Nothing waits on an approval tap — the agent still asks when something genuinely needs your call, but it will not halt each action for you to confirm. Only use it in isolated environments where you trust the agent completely.
Plan mode is a separate toggle next to the composer, not a stop on the dial: it puts the session in read-only planning — Claude can investigate and propose a plan but cannot execute tools — and you switch it on for a stretch of work rather than leaving a session parked at it.
This covers tools inside the session, and nothing else. Actions on DorkOS itself, like removing an installed package, still ask you first even at Full autonomy. Those are a separate question with its own setting: see Action approvals. You will see the same reminder next to the permission picker whenever you choose a stop that skips prompts.
A session at Full autonomy gets no banner of its own. The signal lives where the setting does: the permission picker shows the mode in green, and the chat is marked with a green lightning bolt in the agent's Sessions list. The one app-wide line is about unattended work — a chat integration or a scheduled task set to run at full power, which you can't spot by looking at an open chat. It reads Running unattended at full power: and names them, sits under the header as a plain note rather than a warning, and puts a button beside the words that takes you to the integration or the task. It stays until you change the setting.
Auto mode
Auto mode is a research preview. It's available on newer Claude models only, and the experience may change as it evolves.
Auto mode trades constant approvals for autonomy on long-running work. Instead of pausing on every tool call, a safety classifier evaluates each one, auto-approving routine actions and stopping only for risky ones, like deleting files or running unfamiliar commands. It's designed for autonomous runs where approving each step yourself would slow Claude down. It's a toggle that lives inside the Act stop, not a fourth stop of its own — turning it off returns the session to plain Act.
Availability is model-gated. The Auto toggle only appears when the model you've selected supports it. If you switch to a model that doesn't, the session falls back to Ask first automatically. Claude never enters auto mode on a model that can't run it.
A one-time confirmation. The first time you turn on auto mode in a session, DorkOS asks you to confirm:
The agent runs on its own and only checks with you before risky actions, like deleting files or running unfamiliar commands. You can switch back anytime.
After you confirm, the rest of that session runs in auto mode: no approval prompt for the routine steps, but it still checks with you before risky actions like deleting files or running unfamiliar commands. You can leave auto mode whenever you want.
Denials are visible. When the classifier blocks a tool call, a read-only "blocked" chip appears in the chat showing what was denied and why. It's a record, not a prompt: there's no action to take and no re-approval path. This keeps auto mode honest: Claude never silently swallows a denied action.
Common Scenarios
File Operations
Write and Edit tool calls appear when Claude modifies your files. These are classified as high risk and always require approval in default mode. Check the file paths carefully. Claude should be working in the right location.
Command Execution
The Bash tool runs terminal commands. This is classified as high risk. Always review the command before approving.
Review Bash tool calls carefully. Terminal commands can modify files, install packages, or make
network requests. When in doubt, deny and ask Claude to explain its intent.
MCP Tool Calls
Tools from MCP servers (prefixed with mcp__) are classified as medium risk by default. The approval card shows the server name as a badge for identification.
Web Access
WebFetch and WebSearch calls access the internet and are classified as medium risk. Review the URLs or search queries before approving.
Tips
- Read the full input. Tool inputs can be long. Understanding the parameters before approving is worth the extra few seconds.
- Use Always Allow for repetitive approvals. If Claude is performing many similar operations (e.g., editing multiple files), use Always Allow to grant a standing permission.
- Use batch actions for parallel operations. When the batch bar appears, you can approve or deny all pending tools at once instead of handling them one by one.
- Deny when uncertain. If you're not sure why Claude wants a tool, deny it and ask. Claude will explain.
- Check context first. Claude often explains what it's about to do before requesting a tool. Read the assistant message before reviewing the approval card.
- "Other" is always available. In question prompts, you can always provide a free-text answer if the pre-defined options don't fit.