How VibeFree's AI agent handles permissions and security

VibeFree's VS Code extension is an agentic coding assistant: it can read and edit files in your open workspace, run shell commands, and connect to MCP servers you configure. It asks for your explicit permission before doing the things capable of reaching beyond your immediate editing session, rather than running them silently - unless you tell it not to, by always allowing a command or switching on Auto-allow agent mode.

  • Running a shell command: VibeFree shows you the exact command line and asks - allow once, allow for this session, always allow, or deny. A command you have already allowed is not asked about again.
  • Accessing a file outside your open workspace folder: VibeFree names the exact path and asks first.
  • Fetching a URL from a host it has not already asked about: VibeFree names the host and asks first.
  • Searching the web: the agent can run a web search when it needs current information. The query is written by the model out of your conversation and is sent to TinyFish (United States) via VibeFree's servers, so your IP address is never sent. Private and internal addresses are always refused, by both search and fetch.
  • Editing files inside your open workspace: shown as inline diffs in the chat panel as they happen, so you can see and undo any change.
  • MCP servers: VibeFree connects only to servers you configure yourself in a local file on your own machine - it does not ship or auto-connect to any MCP server on your behalf. The one way a server is added for you is a sponsored install, which shows you exactly what would be added and waits for you to confirm it.
  • Denying a request is final for that request: the agent is instructed not to try a different tool to work around a "no". That is an instruction to the model, not a technical block.
  • Auto-allow agent mode (off by default, in the account menu) skips every prompt above except the private-address check, and a turn started by a sponsored suggestion still asks before every command. Remote Control can switch auto-allow off, but never on.

Content a tool returns - a file's contents, a command's output, a fetched web page, or an MCP result - is treated as data, not instructions. The agent is instructed not to follow a command hidden inside something it reads; like the rule above, that is a safeguard on the model's behaviour, not a guarantee.

This page covers the coding agent's tool permissions. For where your chat messages themselves are processed, see VibeFree privacy and AI providers; for how the ads shown in the same chat panel are funded, see how VibeFree stays ad-funded.

Frequently asked questions

Does VibeFree's VS Code extension run shell commands without asking me?

Not unless you tell it to. Before it runs a command it shows you the exact command line and asks: allow once, allow for this session, always allow that command, or deny. A command you have already allowed runs without asking again, and if you switch on Auto-allow agent mode it stops asking altogether - except during a turn a sponsored suggestion started, when it asks for every command. Auto-allow is off by default and can be switched off again from the account menu.

Can it read or edit files outside the folder I opened in VS Code?

Only if you approve it, or have switched on Auto-allow agent mode. It names the exact path and asks first before touching anything outside your open workspace folder. Editing files inside your workspace happens as inline diffs you can see and undo in the chat panel.

Can VibeFree connect to an MCP server I have not set up myself?

No. It only connects to MCP servers listed in a configuration file on your own machine, which you create and edit yourself - VibeFree does not ship or auto-connect to any server on your behalf. The one way a server is added for you is a sponsored install: you see exactly what would be added and confirm it first.

What happens if I deny a permission request?

The agent is instructed to treat your answer as final for that request, and not to try a different tool to work around a "no" - for example, not to fall back to a raw shell command after a fetch was denied. That is an instruction to the model rather than a technical block, so a denied action can still be asked for again in another form, and you can deny that too.

Related pages