Tools and Approvals

Tools and Approvals

Artemis works through tools: files, web, memory, notes, terminal, computer control, the browser and connectors. You choose which tools it may use, and anything that changes something asks you first on an approval card.

How to use

1. Open Settings (Cmd/Ctrl+,) → Tools & safety and switch on the tool groups you want.
2. In a chat, use the Tools pill next to the model picker to turn tools on or off for that chat. Off sends much smaller requests, which small local models and free tiers need.
3. Use the permission pill next to the message box to pick Ask first or Auto-allow for that chat.
4. When Artemis wants to act, an approval card appears in the chat. Read it, then press Allow (Cmd/Ctrl+Enter) or Deny (Esc).
5. For a file write or edit, the card shows the file path and a preview (a diff for edits). Open folder shows the file in Finder.
6. Some kinds of action show Allow for this task. Allowing them once covers that kind of action until the current task ends.

Approval rules

Action	How often it asks
Writing or editing a file	Every time, unless Auto-allow is on
Deleting a file	Every time, even with Auto-allow
Terminal commands, computer control	Once per task
Browser control	Once per site per task
Running JavaScript in a browser page	Once per task
Notes and Files library (browse, search, read)	Once per task; writing a note asks every time
A connector (MCP server)	Once per task per server; read-only tools have a separate "read" approval
Scheduled tasks (create, change, delete)	Once per task for each kind
Reading a folder outside the project	Once per folder per task (read-only)
Reading credentials, browser profiles or Artemis's own data	Every time
Looking up your location from your IP	Once per task

Settings

Setting	Where	What it does
Tools on by default in new chats	Tools & safety → Tools	Files, memory, notes, web and terminal are on in new chats.
Auto-allow all in new chats	Tools & safety → Tools	Off by default: every action asks. On: file edits, agent file writes, web, terminal, computer control, Make and connectors run without asking. Deleting files always asks. Phone messages follow this, but only file edits are auto-allowed there.
Memory	Tools & safety → Tools	Lets Artemis save and use durable facts.
Web search and page fetch	Tools & safety → Tools	Turns on web_search and web_fetch.
Notes knowledge base	Tools & safety → Tools	Artemis can search and read your notes after you approve.
Terminal commands	Tools & safety → Tools	Shell commands and the integrated terminal. Asks once per task.
Computer control (macOS)	Tools & safety → Tools	Screen, mouse and keyboard. Asks once per task. Emergency stop: Cmd+Shift+Esc.
Browser control	Tools & safety → Tools	Artemis can open pages, click, type and fill forms in the integrated browser. Asks once per site per task; never runs in scheduled or phone tasks.
Connectors (MCP servers)	Tools & safety → Tools	Lets Artemis use your MCP connectors.
Full file access	Tools & safety → Tools	Files anywhere on the computer, not only in the project folder. Asks once per outside folder for reading, every time for keys and credentials, and for every change.
Switch heavy tools on only when needed	Tools & safety → Saving tokens	Computer control, browser, terminal, media, phone, scheduling, helper agents and Make are sent only after the assistant asks for them. Files, web, memory and notes are always sent.
Switch connectors on only when needed	Tools & safety → Saving tokens	Connector tools are sent only after the assistant asks for that app.
Skills / Let Artemis learn by itself / Search my earlier chats	Tools & safety → Skills and learning	See Skills and Chat and Projects.
What Artemis may use	Access	The same switches in one list, plus Agents and a status line for Phone (Telegram).
Approve everything in new chats	Access	Same as Auto-allow all in new chats.

Web search and page fetch

• web_search needs a search engine chosen in Settings → Tools: the Brave Search API (your own key) or an AI search model on one of your providers. Artemis does not scrape DuckDuckGo or Bing.
• web_fetch reads one page. It refuses local and private network addresses.
• Text from web pages is treated as untrusted data; Artemis does not follow instructions found there.

Reading outside the project folder

File tools work inside the project folder (or the default files folder for chats without a project). Writing outside it is always blocked unless Full file access is on, and then every change asks.

Reading outside is allowed after you approve:

1. Ask Artemis to read an absolute path or a ~ path, for example ~/Downloads/report.csv.
2. The card names the real file and folder (and the link target, if the path is a symlink).
3. Allow for this task lets it read that folder for the rest of the task.

Locations that may hold secrets (for example .ssh, .aws, .env files, .git-credentials, browser profiles, Keychains and Artemis's own data folder) ask every time and are never covered by a session or auto approval.

The Access page

Settings → Access shows everything Artemis can reach in one place:

• macOS permissions: Microphone, Screen Recording, Accessibility, Automation (System Events), Notifications, Camera and Touch ID, each with a status and an Allow or Test button.
• Security: a summary of app lock, voice recognition, Touch ID, Telegram alerts and the alert photo, with Open to jump to Security.
• Folders Artemis can reach: the default files folder, each project folder and the Notes folder, with Show to open them in Finder. Terminal and computer control are listed as "Any folder" when on.
• What Artemis may use: the tool switches.
• Let other apps control Artemis (MCP server): see MCP.

Tips

• Keep Auto-allow off until you trust a model and a project.
• If a small local model struggles, turn off tool groups you do not need or keep "Switch heavy tools on only when needed" on. With every group on, the tool list alone is about 10,000 tokens.
• Cmd/Ctrl+Enter allows and Esc denies the newest pending card.

Limits and safety

• Approvals are the real guard. The terminal blocklist is not a sandbox (see Terminal).
• Sub-agents never get shell, computer control, file deletion or memory.
• Touch ID can be required before sensitive approvals; see Security and App Lock.

See also

• Terminal
• Browser
• Computer Control
• Files and Attachments
• MCP
• Security and App Lock