Ripul

Help · Working with agents

Setting what tools an agent may use

Each coding agent has its own permission settings on your Mac. Here is where they are and what each one does.

3 minute read

You decide how much an agent may do without you, once, on the Mac that runs it. Open Ripul Host on that Mac, go to Settings, then Coding Agents. Claude, Codex and Antigravity each have their own group there, because each agent has its own way of asking.

Claude

Skip Permissions
On, Claude uses any tool without asking: files, commands, and tools from Ripul and from MCP servers. Off, Claude Code follows its own permission rules, and a tool those rules do not allow is refused.
Allowed CLI Tools
The built-in Claude Code tools a chat may have at all: Read, Write, Edit, Bash, Glob, Grep, WebFetch, WebSearch, Agent and NotebookEdit. Untick one and no chat on this Mac is given it.

When a chat says Permission denied

A chat shows a Permission denied card, naming the tool, when Claude asked for a tool and nothing on the Mac allowed it. The agent is told no and carries on without that tool, so the work may come out thinner than it should. You have two ways to allow it.

  1. Allow everythingTurn on Skip Permissions. It is the quick answer, and it suits a Mac and a folder you trust the agent with.
  2. Or allow that one toolLeave Skip Permissions off and add the tool to the allow list in Claude Code’s own settings file on the Mac, ~/.claude/settings.json, under permissions, allow. Use the name the card shows when you open it, such as mcp__ripul_tools__ripul_guide.
  3. Send your next messageThe change applies from the next message in a chat. A reply that is already running keeps the permissions it started with.

Codex

Auto-approve
Codex runs commands by itself inside the folder it was given. Writing elsewhere and reaching the network stay restricted.
Ask first
Experimental. Codex uses its own approval flow instead of running commands automatically.
Full access
No sandbox and no approval prompts, with the whole Mac and the network in reach. For work you trust that needs it, such as an Xcode build.

A change to the Codex mode applies from its next turn. A command that is already running keeps the permissions it had.

Antigravity

Antigravity has one switch, Auto-approve. On, every tool call runs without asking. Off, Antigravity uses its own approval flow.