{"slug": "your-coding-agent-cli-may-approve-its-own-tool-calls-by-default", "title": "Your coding agent CLI may approve its own tool calls by default", "summary": "A developer building Styx, a multi-agent coding tool, found that coding agent CLIs differ sharply in their default tool-call approval behavior: Goose's default mode auto-approves tool calls unless a wrapper explicitly sets the approval mode per process, while Amp keeps approvals inside its own terminal because its streaming output offers no documented external approval channel. The developer also found Goose's chat-only mode disables all tools including file reads, and recommends running any new agent CLI once in an empty directory to observe its default tool-call behavior before wiring it up.", "body_md": "I added Goose and Amp to a tool that runs several coding agents. The most useful thing I learned wasn't about the protocol. It was the defaults.\n\nGoose's default mode approves tool calls automatically. If you start it through a wrapper that doesn't set a mode, it runs commands without asking anyone. So I set the mode per process instead of relying on whatever is in the user's Goose config. Default, accept-edits and auto all use Goose's approval mode, so tool calls ask. Only the permission mode literally called bypass picks automatic approval, and none of it touches the user's own Goose configuration.\n\nThe second surprise was Goose's chat-only mode. It disables all tools, reads included. A plan mode you'd expect to still read your files doesn't, so mapping 'plan' to it means the agent can only talk.\n\nAmp went the other way. Its streaming output has no documented way to answer an approval from outside, so approvals stay in its own terminal. Its plan and don't-ask modes reject every tool, reads included, and only bypass asks for automatic approval.\n\nWhat I do with any new agent CLI now: before wiring up anything else, run it once in an empty directory and see what it does with a tool call by default. Two agents gave me two very different answers, and neither was in the first page of the docs.\n\nWhich of your agent CLIs would run a command without asking, if you started it the way you usually do? I'm building Styx, where this came from.", "url": "https://wpnews.pro/news/your-coding-agent-cli-may-approve-its-own-tool-calls-by-default", "canonical_source": "https://dev.to/nicholasflemmer/your-coding-agent-cli-may-approve-its-own-tool-calls-by-default-5dfd", "published_at": "2026-10-27 15:06:03+00:00", "updated_at": "2026-10-27 15:12:38.831342+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": ["Goose", "Amp", "Styx"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/your-coding-agent-cli-may-approve-its-own-tool-calls-by-default", "markdown": "https://wpnews.pro/news/your-coding-agent-cli-may-approve-its-own-tool-calls-by-default.md", "text": "https://wpnews.pro/news/your-coding-agent-cli-may-approve-its-own-tool-calls-by-default.txt", "jsonld": "https://wpnews.pro/news/your-coding-agent-cli-may-approve-its-own-tool-calls-by-default.jsonld"}}