config.json Policies
Last updated
The policy keys in
config.json that widen or narrow what tools may touch, and the keys that are no longer read.Policy keys in
config.json. sensitive_path, read_only_command and (since v1.3.10) readable_path merge with values embedded in the binary (user entries add to, never replace, the defaults); the rest exist only as user config:| Key | Embedded source | Purpose |
|---|---|---|
sensitive_path | go-pkg filesystem/jsons/sensitive_path.json (configs/jsons/sensitive_path.json before v1.3.10) | Credential, key-material, shell startup and tool-setting paths (since v1.3.7 also .git, .claude, the shell rc files such as .zshrc / .bashrc, and .mcp.json), for reads and writes alike — reachable only after a per-session grant: a plain confirmation inside $HOME, the system password outside it. Buckets: dirs, files, prefixes, extensions |
read_only_command | configs/jsons/read_only_command.json (532 entries since v1.3.3, 409 after cd was dropped in v1.3.0) | run_command and background_command calls (run_command_background, covered since v1.3.1, was Removed in v1.3.2) that skip the confirm gate (git status, ls, cat, ...). Since v1.0.25 an entry is matched against the binary plus at most its first two arguments (git config --get, docker compose ps), a call with network: true or a sensitive-path argument never matches, and the dedicated read-only command tool is gone |
denied_command | — | Binaries run_command refuses outright, inside sh -c too |
denied_path | — | Paths permanently off limits for reads and writes; no prompt can approve them. Entries must be absolute or start with ~/; the filesystem root is refused |
readable_path | go-pkg filesystem/jsons/readable_path.json | Since v1.3.10. Absolute paths outside $HOME that read_files and find_files read without a prompt; user entries add to the built-in system and package locations (/usr, /bin, /sbin, /lib, /lib32, /lib64, /libx32, /opt, /snap, /etc, /srv, the package databases /var/lib/dpkg, /var/lib/rpm and /var/lib/pacman, /Applications, /System/Library, /System/Applications, /Library, /Users/Shared and /dev/null). Entries must be absolute or start with ~/, and the filesystem root is dropped. A denied or sensitive path stays blocked even when listed; writes, open_file, file_history and rm still need the password |
net_white_list | — | Hosts exempt from the http_request SSRF guard |
Three keys are no longer read:
sensitive_map (renamed sensitive_path), white_list (removed — commands run unless listed in denied_command), and path_white_list (removed — paths outside $HOME are approved per session). Up to v1.1.1 their presence logged a startup warning; v1.1.2 dropped the warning, so they are now ignored silently.v0.35.0 dropped the last pre-v0.28.9 compatibility paths:
limits.max_skill_iterations (superseded by limits.max_tool_iterations) and planner_model (superseded by dispatcher_model; up to v1.1.1 it was deleted from config.json on the next save, since v1.1.2 it is simply left in place) are no longer honoured, and the legacy api_tools/ / script_tools/ directories are no longer read — tools live under tools/script/ (tools/api/ itself was Removed in v1.3.2; see Configuration).