# Permission modes

> Safe Edit and Full Control, and what each one allows.

Source: https://www.godotmcpstudio.com/docs/permission-modes

Every tool is tagged with a risk level, and the mode you pick decides which
tools stop and ask you before they run. There are two modes: Safe Edit and Full
Control. You set the mode in the app; the MCP server enforces it, so the model
can't exceed it no matter what it asks for.

## Safe Edit

The recommended default. Creating and editing (files, nodes, scripts, scene
changes) just happens. Anything destructive or anything that runs code, such as
deleting a file, running the project, enabling a plugin, or an arbitrary editor
script, stops and asks you first, with a sentence saying what is about to
happen. Say yes and it runs; say no and the AI is told you declined. Nothing is
off the table, and nothing irreversible happens without a human beat in
between.

The same question protects `project.godot`, `export_presets.cfg`, the `.godot/`
cache, and the Godot MCP Studio addon itself. Structured editor tools such as
setting the main scene, window settings, autoloads, and input actions never
ask, because they change `project.godot` through the editor's own settings API
instead of rewriting the file.

## Where the question appears

Questions go to Godot MCP Studio, so they look the same whichever AI client you
use. Approve or deny in the app and the tool continues. Keep the app running
while you work with the AI.

If the app is not running, the question goes to your MCP client instead. Some
clients cannot show one, and a few answer it themselves without showing you
anything. There, the tool reports that it could not ask, and you can open the
app or switch to Full Control for that one call.

A tool waits about 90 seconds for an answer. After that it tells the AI the
approval is still waiting; the question stays in the app for an hour, so
approve it whenever you get to it and ask the AI to try again, and the second
call goes through on the answer you already gave.

Installing an add-on that ships native code always asks, in every mode.

## Auto-approval

The Approvals list has one Auto-approval row covering everything it can answer
for you: editor actions and, in the full edition, Image Studio generation. Turn
it on and a long run of edits stops asking at every delete. You pick what is
allowed, how many, and how long the session lasts, 15 minutes, an hour or four,
and you can pause it at any time. It is stored on this device and never leaves
it.

Add-ons with native code are excluded unless you pick them, because they run
code inside the editor. Even then they come only from the reviewed list and are
checked against their source and checksum before anything is written. Image
generation has its own credit limits, per image and per session, so automation
cannot spend more than you allow.

The editor half follows your permission mode. In Safe Edit it covers edits and
deletes, which is what Safe Edit stops for. In Full Control those already run
without asking, so the only editor question left is the native add-on install,
and that is all the row offers there.

## Full Control

Everything, including deletes and running editor code, and it never asks.
Picking Full Control is the decision to let the AI work unattended, so use it
when you trust the workflow and want it to move fast. Drop back to Safe Edit
when you want to be asked again.

## Risk levels, briefly

- **Read**: never changes anything.
- **Write**: creates or edits.
- **Destructive**: deletes or overwrites; Safe Edit asks, Full Control runs.
- **Execute**: runs editor code or launches processes; Safe Edit asks, Full
  Control runs.

Generated client configs do not include a mode. The mode is set only in the
desktop app and applies on the next tool call, with no client restart and no
config change. Servers started from older configs that still pass `--mode` use
that value only as a fallback until the app sets a mode. When in doubt, stay in
Safe Edit; you can always switch to Full Control for a single task.