What problem does it solve?
Prevents accidental or malicious side effects from AI-invoked tools by enforcing a declarative permission gate that runs before any tool's call method is executed, ensuring destructive actions require explicit approval or match pre-approved rules.
Core Features & Use Cases
- Declarative permission gate: checkPermissions is invoked by the framework before call and can return allow, deny, ask, or passthrough to control execution flow.
- Three permission modes: default (prompt), bypass (silent allow), and auto (match allow rules) let you balance safety and automation for CI or interactive sessions.
- Per-input rules and typed validation: Zod validation occurs before permission checking so rules can safely inspect typed fields; supports per-tool flags like isDestructive and isReadOnly and integrates with app-level toolPermissionContext and settings.json allow/deny rules.
- Use Case: Add this pattern when introducing tools that run shell commands, modify the file system, or make network requests so users are prompted for destructive operations while safe reads are approved.
Quick Start
Add a checkPermissions implementation that delegates to checkWritePermissionForTool and mark the tool as isDestructive so the framework prompts for destructive operations while allowing safe reads to auto-approve.
