Session modes
The session mode sets what the AI in a chat session may change. It applies to the AI only. Your own actions in the app are not restricted.
The three modes
| Mode | Reading | Files | Shell | Write tools of Tracemoor |
|---|---|---|---|---|
| Read-Only | Files, text search, all query tools | no | no | no |
| Safe | as Read-Only | Edit and create files inside the project and the exploration | Only programs on an allow list, no shell operators | no |
| Brave | everything | everything | everything | yes |
Write tools of Tracemoor are the MCP tools that change state: projectdocs,
specs, documents in the Docs View, tickets, changelists, work packages, pull
request replies, the Workflow Policy, run configurations, syncing the
exploration, starting a new chat from an entry, and the input tools for
operating an app. Query tools, and starting a
re-analysis with reanalyze_project, work in every mode. In Read-Only and Safe mode they
answer with a message that the session needs Brave mode. The AI then asks you
to switch.
Several write tools also show a preview that you approve before anything is
written, for example tickets_create, workpackage_open_pr and
pr_reply_comment. The preview appears in Brave mode as well.
Set the default
- Choose AI › AI Settings….
- On the General tab, choose Default Permission Mode.
- Click Save.
New sessions start in this mode. The options are Read-Only (safest), Safe (sandboxed writes) and Brave (full system access).
Change the mode of a session
- In the chat input bar, choose the mode in the mode list next to the model, or
- choose AI › Change Permission Mode › Read-Only, Safe or Brave.
The change applies from the next tool call. The session keeps running. The mode is shown above the conversation, next to the session name.
How the modes are enforced
- Claude (CLI): In Read-Only and Safe mode, Tracemoor registers a hook that checks every tool call before Claude runs it. In Brave mode Claude runs without permission checks.
- API providers (Anthropic, OpenAI, OpenCode, Ollama, custom): Tracemoor runs the tools itself and checks each call. A refused call is returned to the model as an error. With these providers, reading in Read-Only mode is limited to the project, the exploration and the reference projects, because everything read is sent to the provider.
- External MCP servers: each server has a trust level. A server with Brave-only (run in Brave mode only) is available only in Brave mode. See External MCP servers.
Limits
- Brave mode has no checks. The AI can run any command your user account can run, including commands outside the project.
- Safe mode limits paths and programs, not what a program does with them. An
allowed program such as
gitcan still change the repository.