Voxta Tool permissions & review
What a character's tools may do without asking, and the checks that still stand between a tool call and your machine under Allow All.
When a character can call tools — files, the shell, MCP servers, Claude Code, Codex — the chat's tool permission mode decides what runs on its own and what stops to ask you. Under Allow All, or after you click Always, a destructive call runs with nobody reading it. Tool call review puts two readers back in front of it: fixed rules that refuse the catastrophic, and a model that reads the rest.
Permission modes
Set per text generation service under Tool Permissions, and switchable from the chat.
| Mode | What runs without asking |
|---|---|
| Ask (default) | Reading. Anything beyond that asks you. |
| Plan | Reading only. Anything that would change something is refused, and the model ends with a plan for you to approve. Assistant chats only; elsewhere it acts as Ask. |
| Allow Edits | Reading, writing and editing files. Everything else asks. |
| Allow All | Everything. Offered as Allow All (Chat) for this chat only, or Allow All (Always) for every new chat too. |
Tools that only touch the chat itself never ask, in any mode. A chat with nobody there to ask — a bot, a background pass — only runs reading tools and refuses the rest.
When you are asked, Allow runs it once, Always allows that tool for the rest of the chat, Deny refuses it.
Giving a chat a working folder, the shell and the disk tools takes an administrator account with a password. An account anyone who reaches the port can be is not one to hand the machine to.
Hard rules
Checked on every destructive call, in every mode — including one you are about to be asked about. They name commands no chat has a reason to run: rm -rf /, format C:, mkfs, writing over a disk device with dd, fork bombs, deleting shadow copies or system backups, removing boot entries. A match is refused, and nobody can override it.
Commands are read from what the tool is told to run, not from file contents: a file that says rm -rf / is not a command.
Path rules
Checked on every call that can reach outside the chat, reads included — whatever a tool reads is sent to your model provider.
- Refused for any access: places credentials live.
.ssh,.aws,.gnupg,.kube,~/.npmrc,.git-credentials, browser password stores,/etc/shadow, Windows credential stores and the SAM hive,*.kdbxfiles. Named inside a command counts too. - Refused for a file tool that writes: system folders —
/etc,/usr,C:\Windows,C:\Program Filesand the like. Reading them is fine. - Refused: commands that dump the operating system's own secret store — the macOS keychain, the login keyring, the Windows vault,
git credential fill. - Never run unseen: your home folder outside a project (its root, hidden folders like shell history, application data), a project's
.env, private-key-looking files, writes to shell profiles, git hooks, autostart folders or PowerShell profiles, and commands that print a secret (printenv,gh auth token,kubectl get secret, cloud secret-manager reads and similar). The reviewer reads these whatever the mode; with no reviewer, you are asked. Downloads, Documents, Desktop, Pictures and code checkouts are ordinary.
Paths are matched however they are spelled: ../../.ssh and /root/.ssh are the same place.
The model review
The chat's Action Inference service reads a call only when it would run unseen: the mode allows it, or you already said Always for that tool. A call you are about to see yourself needs no second reader. It is told what you last asked for, and when a command runs a script, it is shown the script too.
It answers one of three ways:
- Run — the call goes ahead.
- Ask — you are asked after all, with Flagged by the safety review: and its reason on the card. An earlier Always does not cover this one call.
- Block — refused. The model is told not to try another way, and to explain to you what it meant to do.
Some calls go straight to you instead of the reviewer, because nothing can judge what it cannot read: a command or script longer than 8,000 characters, an encoded PowerShell command, something downloaded or decoded and piped straight into a shell.
The review fails closed: an error, a 60-second timeout or an unreadable answer means you are asked.
Claude Code and Codex
A CLI told to skip permissions never asks, so its calls would never reach these checks. Under Allow All, Voxta starts Claude Code in accept-edits mode and Codex with its "untrusted" approval policy, then answers their questions itself. Allow All still runs everything without asking you — each call just goes through the rules and the review first.
What the CLIs never ask about is not covered: Claude Code reading inside its own folders, Codex running commands it considers safe.
Content from outside
Results from web fetch, web search and MCP tools reach the model marked as outside data, not instructions. That makes prompt injection harder, not impossible.
A steered model can also try to leak data through an image address. Remote images in chat whose address could carry data are held behind a Load image from host button until you click it. Relative and inline images load as usual.
Turning it off
Review Risky Tool Calls on the text generation service, on by default. It needs an Action Inference service; without one, or with it off, only the hard rules and path rules apply — and a flagged path is put to you instead.