Tools & approvals

Mel's agent asks before it edits a file or runs a command that could change something, and you approve each step on a card in the conversation (or let a kind of step through for the whole conversation). The file and command tools it uses execute locally on your machine, in the working directory of the pane hosting the conversation. Mel's backend only relays the model's *request* to use a tool — your client runs it and sends the result back. The exceptions do their work on Mel's backend: web_search and web_fetch (see Web search), remember and recall (see Project memory) and the built-in connectors. This page lists the toolset and explains how approvals keep you in charge.

The toolset

Conversations with project memory enabled add remember and recall; orchestration adds worker-management tools.

Approvals

Tools split into two classes:

• Reads (read_file, list_dir, grep, find_files, web_search) run without gating — they can't change anything.
• Writes and commands (write_file, edit_file, run_command) pause the run on an inline approval card showing exactly what the agent wants to do. A command Mel can prove only reads (ls, git status, cat README.md) runs without a card unless you turn on Ask before read-only commands too in Settings ▸ Agent mode; and even hands-off, Mel always stops for your approval before a command Mel recognises as impossible to undo, reading a file that holds credentials, writing outside the project, or acting in a connected app.

A recursive delete is judged from the folder it runs in, and Mel follows each cd earlier on the same line. cd / && rm -rf * always stops for your approval, even hands-off; cd src && rm -rf build, which stays inside the project, is an ordinary command. A cd Mel cannot place (a bare cd, cd ~, cd "$DIR") counts as outside the project. The full list of steps that always stop for you is in Security & privacy.

Each card offers:

• Run command, Allow edit, Allow read or Send (for a connector) — do this one call. An edit card shows the unified diff of exactly what will be written.
• Always allow … in this conversation — a checkbox that approves this *kind* of action (file edits, or commands and background processes) for the rest of the conversation. It is not offered on a connector call, a credential file, a write outside the project or a step that cannot be undone.
• Deny (or Esc) — refuse; the agent is told and adjusts course.

Enter does not approve by accident. A bare Enter approves only when the message box is empty and nothing else has focus; Shift or Alt with Enter never approves; Allow ignores clicks and keys for a moment after a card appears or the window comes back to the front; and a step that always stops for your approval (a credential file, a write outside the project, a connector call or a step that cannot be undone) needs a click or Ctrl+Enter (⌘Enter on a Mac). Esc and Deny always work at once (v0.1.62).

"Always allow" is scoped per kind and per conversation — approving edits doesn't approve commands, and a new conversation starts fresh. The transcript says when a conversation stops asking; type /always-ask to make it ask again. To skip approvals entirely for a run, use autonomous mode.

Approval keys

Settings → Agent mode

Settings → Agent mode (called Profiles before v0.1.62) holds Mel's profile and permissions: one Default card that sets the models a conversation starts on and what the agent may do without asking. Click Edit to change it. A change applies at once, in running conversations too, and the A⁺ toggle in a conversation overrides it for that conversation (see Autonomous mode). Mel has one profile; there is no second profile to switch to.

The models

What you can change

Under Execute commands there are two lists of regular expressions:

• Command allowlist: commands the agent may run without asking, for example npm test.*. Empty by default.
• Command denylist: commands that ask whatever else you chose. It is checked first. It starts with shells and interpreters run directly (bash, sh, zsh, fish, pwsh, eval, exec, source), network tools (curl, wget, ssh, scp, rsync, telnet, nc, dig, nslookup, host), rm, and their Windows equivalents (powershell, cmd, del, rd, Remove-Item, Invoke-WebRequest and others). Delete an entry if you want it to follow your other settings. Always allow does not skip it. Hands-off mode and ▶▶ skip the default list, but not one you have edited.

What Mel decides for you

These rows on the page are fixed and say why:

What always asks, whatever you choose

No setting, allowlist or hands-off mode lets these through without you. The first row is a fixed list Mel recognises, not every command that could do harm. They offer no "always allow", and with nobody at the computer to answer they are refused by name:

• a command Mel recognises as impossible to undo (a recursive delete outside the project, git push --force, git reset --hard, sudo, a script piped from the internet into a shell, PowerShell or an interpreter, a delete run through xargs, fd -x or parallel, a package published to any registry (npm, cargo, bun, poetry, uv, twine, gem, dotnet nuget), a delete run on another machine or in a container through ssh or docker exec, an rsync --delete, a disk or partition erase, and any of these typed into a running background job);
• reading a file that holds credentials, such as an .env file or a private key, and running a command that names one (cat .env, curl -F f=@.env to upload it, or a line typed into a terminal);
• writing outside the project and the temp folder, and, with Stay in this folder on, a file tool or a plain reading command (cat, grep) reading a named path outside the project;
• using a connector or an MCP server, which reaches outside your computer.

See Security & privacy for the full list.

A command on your Command denylist is held to a card as well, but it is your list and can be changed. A denylist you have edited still asks in hands-off, under ▶▶ and with mel agent --yes (with nobody at the computer it is refused by name). The default list applies when you are approving commands yourself, for example under Always allow; in hands-off, under ▶▶, with --yes and in an unattended run it does not, so a run does not stall or fail on curl or rm because of a list you never wrote.

In the settings file

The page writes these keys in ~/.mel/settings.json: edits_mode (agent_decides, always_allow or always_ask), commands_mode (always_allow or always_ask), perm_agents (never, always_allow or always_ask), ask_readonly_commands, cmd_allow, cmd_deny, default_model_base and default_model_full_terminal.

Plan mode

Approvals gate actions one at a time. Plan mode gates the whole approach: the agent can read, search and browse, but *every* tool that would change something is refused until you approve a plan. Ask it to "plan this first", or let it decide a change is large enough to show you the shape of it, and it switches into plan mode itself.

While plan mode is on you'll see:

• a ✦ Plan mode chip beside the agent input, for as long as the mode lasts;
• the finished plan in the ✦ Plan side panel, labelled with its state — *Awaiting your approval*, *In progress*, *Completed* or *Abandoned* — and with the prompt it was written for;
• an approve/keep-planning decision in the transcript when the agent is ready.

Approving ends plan mode and the agent carries the plan out immediately. Choosing Keep planning leaves it on so the agent can revise. Typing a reply revises the plan with your feedback; only the Approve button approves. You can also edit the plan's steps in the panel before approving — see Planning.

Plan mode is a mode, not a per-turn setting. It survives from one turn to the next, so a plan can be researched across several exchanges. That also means it can outlive the question that would have ended it: if you type a new prompt instead of answering the approval, the decision is dropped, plan mode stays on, and the transcript says so. Two ways out at any time — click the ✦ Plan mode chip beside the input, or Exit plan mode in the plan panel's header. Either one leaves immediately, including mid-run.

The plan panel stays open after the plan is done, because it's the record of what was agreed — a finished plan says *Completed* rather than disappearing. Close it with the ✕ in its header; that closes the panel only, and doesn't change the mode.

Reopening a saved conversation does not restore plan mode: the agent is told plan mode ended with the previous session, and the plan comes back as a read-only record.

Diff cards

Every applied write_file or edit_file produces a diff card in the transcript: the file path, green +N and red -N counts, and the changed lines rendered as red/green monospace rows (long diffs are truncated for display). The turn's usage summary totals files changed and lines applied, and you can open the full change set in code review.

The agent's working discipline

The system prompt enforces habits that make tool use trustworthy:

• Read before edit — the agent reads a file before modifying it, so edit_file's exact-match semantics catch stale assumptions instead of corrupting files.
• Verify after change — after editing, it re-reads the file or runs the build/tests rather than declaring victory.
• Continue until done — multi-step work runs to completion instead of stopping at the first plausible answer. A task that stops making progress ends with a report of what was done and what is left, and running the same command a third time with nothing changed is stopped.
• Check with the project's own command — the agent reads the test or check command from the project (a line in AGENTS.md wins) and uses it to verify a change. Starting a dev server or reading a file back does not count as checking.

FAQ

How do I approve AI agent commands in Mel? Each command that could change something shows an approval card. Click Run command (or press Enter with the message box empty) to run it once, tick Always allow to let that kind of step through for the rest of the conversation, or Deny to refuse.

How do I stop the agent asking before every command? In Settings → Agent mode, set Execute commands to Always allow, or add the commands you trust to the Command allowlist. Commands on the denylist still ask under Always allow. In hands-off mode the default list is not applied, but a list you have edited still asks. The default list starts with shells, curl, ssh, rm and similar; remove an entry if you do not want the card.

Can I make the agent ask before everything, even ls? Yes. Turn on Ask before read-only commands too in Settings → Agent mode.

Is there a setting that lets the agent delete files or force-push without asking? No. Commands Mel recognises as impossible to undo (force-push and deletes outside the project among them), credential files (read, or named in a command), writes outside the project and connector calls wait for you, whatever you set.