Folder Trust and Security

Every tool call passes three checks, in this order:

1. Folder trust. In a folder you haven't trusted, the agent can't touch your project at all. No mode overrides this.
2. Agent profile. The planner and reviewer profiles can't edit files or run commands in any mode.
3. Permission mode. SAFE, TRUST, FULL or YOLO decides which of the remaining actions run on their own and which ask you first.

On top of these, some protections apply in every mode: sensitive files can't be read, execution-control files ask before edits outside FULL and YOLO, and URL fetches can't reach private network addresses.

Folder trustCopy Anchor Link

Folders are untrusted until you trust them. In an untrusted folder the agent can only:

• search the web and fetch URLs
• ask you questions
• list its tools
• read and answer messages from other sessions, and read shared state

Everything else is blocked in every mode: reading, searching, editing and creating files, running commands, MCP tools and subagents. MCP servers are not started and skills are not loaded. The agent is told the folder is restricted and will point you to trust it.

Trust a folderCopy Anchor Link

VS Code

• Open Settings → Trust & Security and select Trust Workspace, or type /trust in chat.
• Confirm Allow Andromity to edit files and run commands in <folder>? with Trust Folder.
• VS Code must trust the folder first. If VS Code is in Restricted Mode, Andromity says so and offers Manage Workspace Trust.

Terminal app

• When you start in an untrusted folder, the Untrusted Folder prompt offers Trust Folder or Not now (Esc).
• Or type /trust at any time.

Headless

• andromity run --yes trusts the current folder permanently and approves every action for that run.

Revoke trustCopy Anchor Link

• VS Code: Revoke Trust on the current workspace card, Revoke on any folder under Trusted Project Directories, or /untrust in chat.
• Terminal app: /untrust, or Revoke in Settings → Trust & Security.

Revoking takes effect immediately and does not ask for confirmation.

How trust is storedCopy Anchor Link

Trust is saved in config.toml, one table per folder:

[trusted_projects.p3f9a1c27b04e8d]
path = "/home/you/code/my-app"
trusted_at = "2026-10-15T09:12:44.512830+00:00"

The table name is p plus the first 15 hex characters of the SHA-256 of the folder's resolved path.

Trust applies to that exact folder only. Its parent and its subfolders are not trusted by it, so open and trust the repository root. If you start the terminal app from a subfolder, that subfolder needs its own trust. Inside a trusted folder, the agent can write only within that folder.

In a VS Code window with several workspace folders, the Trust & Security tab shows and changes the first one.

Command and domain allowlistsCopy Anchor Link

In TRUST mode, commands and URL fetches run without asking only when they are on an allowlist. Both lists live under [default] in config.toml, and each session can add its own entries.

[default]
allowed_commands = ["npm run", "npm test", "npm list", "npm run dev", "git status", "git diff", "git log", "ls", "dir", "cat", "echo"]
allowed_domains = ["docs.python.org", "*.github.com"]

The commands above are the defaults written when config.toml is created. There are no default domains, so every fetch asks in TRUST mode until you add some.

How commands match

• The command's words must start with an allowlisted entry's words. git diff allows git diff --stat but not git difftool.
• A command containing any of ; & | ` $ ( ) { } < > % ^ or a line break never matches, so chained or redirected commands always ask.
• A command never matches if an argument after the allowlisted words is a sensitive file, so cat .env asks even though cat is listed.

How domains match

• example.com matches example.com and any subdomain, such as api.example.com.
• *.example.com matches the same.

Adding entries

• From an approval card: for a command or URL fetch, choose Always allow (Ctrl+Shift+Y) to add the exact command or the URL's host to config.toml. Allow for remainder of this session (Ctrl+Alt+Y) adds it to the current session only. Both need a trusted folder.
• Terminal app: /mode trust add <command prefix>, /mode trust list and /mode trust clear.
• By hand: edit config.toml.

Subagents in TRUST mode use only the global command list, not the session's.

Protected filesCopy Anchor Link

See Permission Modes for the full lists. In short:

• Sensitive files, such as .env, SSH keys, config.toml and anything in .git, .ssh, .aws or .gnupg, can't be read with read_file in any mode, and any tool that targets one asks first in SAFE and TRUST.
• Execution-control files, such as package.json, .envrc, and anything in .git, .andromity, .vscode or .husky, always ask before an edit outside FULL and YOLO, because changing them can make later commands run something else.

NetworkCopy Anchor Link

• fetch_url refuses private, loopback, link-local and cloud metadata addresses, including when a redirect leads to one.
• Web search and URL fetches go from your machine. Commands the agent runs, such as package installs, can reach the network too.

Air-gap modeCopy Anchor Link

Set ANDROMITY_AIRGAP=1 in the environment Andromity starts in to block the agent's own network use:

• web search and URL fetches are refused
• commands that look like network use (curl, wget, ssh, git clone/fetch/pull/push, pip install, npm install, PowerShell web requests, URLs and the like) are refused
• other commands run with their proxy set to an unreachable address
• update checks and the automatic ripgrep download are skipped

Air-gap mode does not affect the connection to your model provider. For fully offline work, combine it with Ollama or another local endpoint.

SecretsCopy Anchor Link

• Provider API keys are stored in plain text in config.toml; see Where keys are stored.
• The agent can't read config.toml or files such as .env, and provider key variables are removed from the environment of commands it runs and MCP servers it starts.
• Andromity does not redact secrets from command output or from files the agent is allowed to read. Keep secrets in files with sensitive names such as .env, and approve commands that print the environment with care.
• Anonymous telemetry never includes prompts, code, file paths or keys, and key-like strings are scrubbed from error reports. See Preferences to turn it off.

LogsCopy Anchor Link

Andromity writes a debug log, andromity.log, next to config.toml (rotated at 5 MB, three files kept). At debug level it records each tool call with its arguments cut to 80 characters. In the terminal app, /logs prints the log's path. Session history, including tool calls and their results, is stored on your machine in the same folder.

There is no separate audit log of approvals.

Recommended setupCopy Anchor Link

• Trust only repositories you'd be comfortable running npm install or make in yourself.
• Start new or unfamiliar projects in SAFE. Move to TRUST once you've reviewed the allowlists.
• Keep FULL and YOLO for disposable environments, containers, or cron jobs whose prompt and folder you control.