sassy_permission
Manage the permission engine for shell and file tools. Set safety modes, configure sandbox roots, and add access rules to control what actions are allowed, confirmed, or denied.
Instructions
View and control the permission engine (sassymcp.policy).
Single front door for the four-mode safety system that gates the shell and file tools. The future Control Panel UI writes the same config keys this tool does.
action: status (default) show effective mode, how it was derived, the sandbox roots, and the active allow/ask/deny rules. set_mode set permission.mode. mode= one of: strict — block destructive patterns everywhere confirm — destructive patterns need a confirm token sandbox — relaxed gating INSIDE the sandbox roots; anything resolving outside is refused bypass — allow all except protected paths "" — clear the override; derive from the legacy interceptor.destructiveAction setting add_root add path= to permission.sandboxRoots (the jail) remove_root remove path= from permission.sandboxRoots add_rule append rule= (JSON: {"action","tool","path","command"}) to permission.rules; first match wins, evaluated before the mode default clear_rules remove all rules
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | ||
| path | No | ||
| rule | No | ||
| action | No | status |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |