Agents and MCP | ToshLLM Documentation

Agent mode

Give the model capabilities, not blind control.

Enable Local agent tools in Chat Settings to let a compatible model request file, search and command operations. ToshLLM presents sensitive calls for approval before execution and keeps tool results inside the conversation.

ReadRead a file, find files by pattern, search file contents and inspect the current date or time.

ModifyCreate or edit files only after the requested operation passes the permission flow.

ExecuteRun a shell command locally or in the configured isolated runtime.

CalculateRun JavaScript in an isolated worker without DOM or page access when the optional sandbox is enabled.

Tool support depends on the model and chat template. A model that can describe a tool is not necessarily reliable enough to choose arguments or recover from an error.

Permission model

Review the exact operation before it runs.

A permission card identifies the tool, whether it reads or writes data, and the arguments supplied by the model. You can deny it, allow it once or remember permission for that tool. MCP tools can also be trusted only for the originating server.

01Model requests a tool

→

02You inspect arguments

→

03ToshLLM executes or denies

Use Revoke persistent permissions in Chat Settings to clear remembered decisions. Treat a permanent permission as access granted to future prompts that can persuade the model to call the same tool.

Isolation

Move execution away from the Mac when needed.

The Isolate tools in field accepts a runtime target. Leaving it empty executes built-in tools in the app's environment. A target routes execution through the selected container or SSH destination.

docker:alpine
podman:alpine
docker-container:existing-container
ssh:user@trusted-host

Isolation changes where code runs, not whether it is safe.

Use a disposable container, limit mounted files and review every write or command. An SSH target can affect the remote machine with the privileges of that account.

MCP servers

Connect tools, resources and prompts.

ToshLLM supports Model Context Protocol servers over Streamable HTTP, server-sent events and WebSocket, with an Automatic option that selects the connection route. Add servers from Chat Settings, enable them individually and test the connection before using them.

Tools become callable by the model and use the same permission cards as local tools.
Resources can be browsed and attached to the open conversation.
Resource templates request their required values before ToshLLM reads the resolved resource.
Prompts can be selected, completed with arguments and inserted into the composer.

Optional HTTP headers are entered as a JSON object. Authentication headers are stored in macOS Keychain rather than plain application preferences.

Safe setup

Start with one server and one tool.

Add the MCP URL and choose Automatic transport.
Add only the authentication headers required by that server.
Use Test and confirm the number of discovered tools.
Open a new conversation with a model known to support tool calling.
Try a read-only action before allowing writes or commands.
Set a maximum agent-turn count so a failing tool loop stops predictably.

Remote MCP requests leave the Mac and follow the privacy policy of that server. Do not attach private resources or authorize a remote tool unless you trust its operator.