What the agent can do

The agent works through tools. These come with every session; MCP servers and plugins add more. To make a tool wait for a person, name it under approvals.

Tool	What it does	Can wait for approval
bash	Runs a shell command in the sandbox and returns its output.	Yes
read	Reads a file in the sandbox: text, or an image the model can look at.	Yes
write	Writes a whole file in the sandbox, creating it and its folders if needed.	Yes
edit	Changes a file in the sandbox by replacing exact text.	Yes
publish	Pushes the committed work as a branch and opens a pull request, from your server with its own token. Only when a code host is connected.	Yes
ask	Asks you a question, with choices or for a written answer, and waits for your reply.	No. It already waits for a person.
save_flow	Proposes a flow: a task saved to run again, by hand, on a schedule or on a webhook.	Always. Nothing is saved until someone who may build flows presses Save.
propose_plan	Proposes a plan as numbered steps, in plan mode, for you to run or change.	No. It changes nothing: you decide whether the plan runs.
name_session	Names the session in a few words once it knows the task; a name you gave stays.	No. It only names the session.
wait_until	Puts the session to sleep until a time, then wakes it with a message.	No. It changes nothing; the session just sleeps.
wait_for	Puts the session to sleep until a signed webhook arrives for a key it names, then wakes it with the body.	No. It changes nothing; the session just sleeps.
subagent	Hands tasks to helper agents, each in its own session and sandbox, and waits for their answers.	No. Each helper's own calls wait for approval under its agent's rules and the server's.
codemode	Runs a short script that calls the other tools in one go, in an isolated interpreter with no network.	No. Each tool the script calls waits for approval as if the agent had called it.
load_skill	Reads the instructions of one of the agent's skills.	No. It only reads.
run_skill_script	Runs a script that ships with one of the agent's skills, in the sandbox.	No. Choose which skills an agent has instead.

bash, read, write, edit and run_skill_script act in the session's sandbox. The rest run on your Pistis server, which keeps the keys they need: publish pushes with the code host's token, and the sandbox never sees it.

Tools from elsewhereCopy Anchor Link

Plan modeCopy Anchor Link

In Plan mode the agent only reads and searches, then replies with a plan. Tools that would change something, such as editing files or running commands, are refused.