How VibeFree's AI agent handles permissions and security

VibeFree's VS Code extension is an agentic coding assistant: it can read and edit files in your open workspace, run shell commands, and connect to MCP servers you configure. It asks for your explicit permission before doing the things capable of reaching beyond your immediate editing session, rather than running them silently.

  • Running a shell command: before any command executes, VibeFree shows you the exact command line and asks you to approve or deny it.
  • Accessing a file outside your open workspace folder: VibeFree names the exact path and asks first.
  • Fetching a URL from a host it has not already asked about: VibeFree names the host and asks first.
  • Editing files inside your open workspace: shown as inline diffs in the chat panel as they happen, so you can see and undo any change.
  • MCP servers: VibeFree connects only to servers you configure yourself in a local file on your own machine - it does not ship or auto-connect to any MCP server on your behalf.
  • Denying a request is final for that request - the agent does not try a different tool to work around a "no".

Content a tool returns - a file's contents, a command's output, a fetched web page, or an MCP result - is treated as data, not instructions. The agent will not follow a command hidden inside something it reads.

This page covers the coding agent's tool permissions. For where your chat messages themselves are processed, see VibeFree privacy and AI providers; for how the ads shown in the same chat panel are funded, see how VibeFree stays ad-funded.

Frequently asked questions

Does VibeFree's VS Code extension run shell commands without asking me?

No. Before it runs any command, it shows you the exact command line and asks you to approve or deny it - the command only executes if you say yes.

Can it read or edit files outside the folder I opened in VS Code?

Only if you approve it. It names the exact path and asks first before touching anything outside your open workspace folder. Editing files inside your workspace happens as inline diffs you can see and undo in the chat panel.

Can VibeFree connect to an MCP server I have not set up myself?

No. It only connects to MCP servers listed in a configuration file on your own machine, which you create and edit yourself - VibeFree does not ship or auto-connect to any server on your behalf.

What happens if I deny a permission request?

The agent treats your answer as final for that request. It will not try a different tool to work around a "no" - for example, it will not fall back to a raw shell command after a fetch was denied.