InterviewLab

AI agents

Kimi Code CLI

Permissions and Approvals

The three permission modes

Renamed in 0.41.0; the config values remain manual/yolo/auto.

ModeConfig valueBehavior
Always Ask (formerly Manual)manualDefault. Read-only ops run automatically; every edit/command asks one by one
Ask When Needed (formerly YOLO)yoloAuto-approves regular tool calls; still asks for sensitive files (.env, SSH keys), dangerous commands (shutdown, rm -rf), and Plan-mode exits; the agent may still ask questions
Never Ask (formerly Auto)autoFully unattended; everything decided automatically, agent never asks questions

How to switch: /permission in the TUI; /yolo (alias /yes) and /auto preselect the latter two; launch flags -y/--yolo and --auto; persistent default via default_permission_mode in config.toml.

WARNING — do not make yolo/auto your default. --yolo skips approval for regular tool calls including file writes and shell commands; the official docs say to use it only in trusted working directories. Never Ask (--auto) is stronger still: since 0.41.0 it no longer blocks dangerous commands or commands that cannot be statically analyzed, and the agent never asks questions. Keep default_permission_mode = "manual"; enable yolo/auto per-session, for a bounded task, in a directory you trust — never as a blanket recommendation.

Dangerous-command guard

Added in 0.40.0 ([permission] dangerous_command_guard, default true): commands like shutdown, reboot, rm -rf are blocked/asked in Always Ask and Ask When Needed modes. In Never Ask mode they run without interruption (0.41.0: “Auto permission mode no longer blocks dangerous commands and commands that cannot be statically analyzed”). Disable with dangerous_command_guard = false or KIMI_CODE_DANGEROUS_COMMAND_GUARD=false — not recommended.

Default approval per tool

  • Auto-allowed (read-only): Read, Grep, Glob, ReadMediaFile, WebSearch, FetchURL, TodoList, Agent, AskUserQuestion, Skill, TaskList, TaskOutput, WaitFor, CronList, EnterPlanMode, ExitPlanMode (auto-allowed but the user still confirms the plan).
  • Require approval: Write, Edit, Bash, TaskStop, CronCreate, CronDelete.
  • AgentSwarm: auto-allowed in swarm mode; requires approval in manual mode otherwise.

Approval panel keys: arrows/1–9 select, Enter confirm, Esc/Ctrl-C/Ctrl-D reject, Ctrl-E expand the diff preview. “Approve for this session” auto-approves the same kind of call for the session.

Permanent rules: [[permission.rules]]

In ~/.kimi-code/config.toml:

[[permission.rules]]
decision = "allow"                 # allow | deny | ask
scope = "user"                     # turn-override | session-runtime | project | user (default)
pattern = "Bash(git status*)"      # ToolName or ToolName(arg-pattern)
reason = "read-only git"

[[permission.rules]]
decision = "deny"
pattern = "Bash(rm -rf*)"
reason = "never recursive-delete without asking"

[[permission.rules]]
decision = "allow"
pattern = "mcp__github__*"         # MCP tools match by name; wildcards * and **

First match wins. MCP tools and AgentSwarm match by name only (arguments are not part of matching).

Non-interactive mode

kimi -p runs with the auto permission policy by default — no human approval. Static deny rules still apply.

Sandbox status

? Unable to verify: no OS-level sandbox feature is documented for Kimi Code CLI. The documented safety model is permission approvals plus hooks — and hooks are fail-open (non-zero exits other than 2, timeouts, and crashes all allow the action), so the docs warn they “should not be used as the sole security barrier”. Whether any sandboxing exists internally is unverified.

Related: untrusted folders show a workspace trust prompt before enabling project-level MCP servers (default answer: “Trust this folder”).

Last verified: 2026-09-07

Official sources:

AI coding tools evolve quickly. If you find outdated information, please open an issue or pull request.

View this doc on GitHub