Skip to content

Unsafe Mode

Unsafe Mode is a switch in the desktop app, in Settings under Run defaults, from Agentry Desktop 0.6.28. It is off until you turn it on. While it is on, a QuickAgent run on your computer can use commands your computer has not approved. From Agentry Desktop 0.6.35, it is also the only way such a run can use a declared MCP server with a known vulnerability the registry's gate rates high or critical. Even then, each run needs your consent. It is one switch for every run the app starts on your computer, not a setting for one QuickAgent.

What it changes

A QuickAgent's manifest declares the commands its run_command tool may call. With the switch off, your computer's approved command list, exec.packages in the runner policy, has to name each of them. A QuickAgent that declares a command the list does not name is refused before it starts, and the refusal names the command (What a run enforces).

With the switch on, a run on your computer differs in these ways:

  • The approved list is not asked. Each declared command is installed from Kali Linux's repository, one package at a time, onto an image built for that QuickAgent. A tool Kali does not package as a command comes from a short list kept in the Unsafe Mode image: a PyPI distribution at a fixed version, or a program inside a Kali package.
  • The QuickAgent's image keeps everything the build installed. With the switch off, the build deletes every executable in the image's program directories except the declared commands and Agentry's own runner. In Unsafe Mode it deletes nothing.
  • A command's PATH is the image's own. With the switch off, it holds the declared commands and nothing else. In Unsafe Mode a declared command can start any program the image holds.
  • A declared MCP server the gate rates high or critical can run, with your consent for the run. With the switch off it is refused (below).

The build starts from the Unsafe Mode image: Kali Linux with an index of which package ships each command, and no security tools of its own. The runner policy's images.unsafe can name another image, pinned by digest, and that image then decides what is installed and from which repository.

The first run of a QuickAgent builds its image, and later runs reuse it. The versions are whatever the repository holds on the day of the build, and the run's receipt records them. A PyPI tool's own version is fixed, its dependencies' versions are not, and its archive's SHA-256 is recorded without being checked against a known value.

The build runs on Docker's ordinary network, outside a run's limits, and each package's install scripts run in it as root. The run's own network limits are unchanged.

For a QuickAgent that declares no commands, nothing is downloaded or built. It runs exactly as it does with the switch off, unless it declares an MCP server the gate rates high or critical.

A declared MCP server the gate rates high or critical

This applies from Agentry Desktop 0.6.35. Before then, any run on your computer could take the consent for such a server, with the switch on or off. The runner policy's mcpServers.allowVulnerable let every run through without it.

Before a run, the app asks the registry what its scan recorded for each MCP server the QuickAgent declares, at that exact version. Each advisory is weighed at the gate's rating, where the registry's answer carries one:

  • An advisory of Critical severity is rated critical.
  • An advisory of High severity is rated high when its CVSS score is 8.5 or more, or when it has no score. Below 8.5 it is rated medium.

A registry that serves no gate rating has each advisory weighed at its own severity, so there a High advisory below 8.5 counts as high.

With the switch off, a run that declares a server the gate rates high or critical is refused before it starts. The run setup shows the refusal, and Run stays unavailable. The refusal names the server, the advisories behind it with the gate's rating and any CVSS score, the versions that fix them, and Unsafe Mode as the way through. The other way is a release that pins a fixed version.

With the switch on, the run setup offers Allow vulnerable MCP servers for this run, and names only the servers rated high or critical. Tick it, and the consent dialog asks again before the run starts. Answer Yes and the run starts with those servers. Without the tick and the Yes, the run does not start. The consent covers one run, and the next run asks again.

A server the gate rates medium or low runs with neither the switch nor a consent.

What stays

  • run_command takes only the declared commands. A call to any other name is refused, whether or not the image holds that program. The limit is on what is called, not on what a called command does. A declared interpreter such as python3, or any declared command that starts other programs, can run anything the image holds, with arguments the agent chooses.
  • The rest of the run is compiled as before. The network limits, the file grants, the secrets, the declared MCP servers and the containers' isolation are the ones the same QuickAgent gets with the switch off. What can use them is not the same. The file grants, the secrets and the declared network hosts belong to the tools container, which runs as root with the switch on or off, and in Unsafe Mode every program the image holds can run there.
  • Every consent still asks. The app asks each time you run a release with no attestation or a release the registry admitted without a scan. The consent for a declared MCP server the gate rates high or critical is the exception: from 0.6.35 the app offers it only in Unsafe Mode (above).
  • A run In Agentry never uses it. The run setup shows no Unsafe Mode line for a run In Agentry, and nothing about the switch is sent with one. For a declared MCP server the gate rates high or critical, a run In Agentry has no way through. With the switch on or off, Run stays unavailable.
  • The CLI has no flag for it, and no runner policy key turns it on. agentry run of the same QuickAgent on the same computer compiles without Unsafe Mode and is held to the approved list as before. The policy's images.unsafe turns nothing on, but with the switch on a changed value applies at the next run, without a new confirmation.
  • The CLI's way through for a declared MCP server the gate rates high or critical stays: --allow-vulnerable-mcp, or the policy's mcpServers.allowVulnerable (Declared MCP servers). From 0.6.35 the app does not take that policy key. When the policy sets it, the app's refusal names the key, and the run is still refused.

Turning it on and off

The app asks before it turns the switch on, in a dialog titled Turn on Unsafe Mode? that says what changes. From 0.6.35 it also says that a declared MCP server the gate rates high or critical can run too. Each such run asks you first. Answer No and nothing changes. Answer Yes and the app downloads the Unsafe Mode image, a few hundred megabytes, showing the download's progress in the card. An image already on your computer is not downloaded again.

The switch reads On only once the image is on your computer and its index has been read. It stays off when the download fails, when Docker is not running, when the policy's images.unsafe names an image with no digest, and while another run, image setup or knowledge build is in progress.

While it is on, the window says so:

  • A red edge runs round the whole window, over the app's own dialogs. It does not move, and clicks pass through it.
  • An Unsafe Mode badge sits at the foot of the sidebar, so the state is also in words. Clicking it opens Run defaults at the switch.

Turning it off needs no dialog and removes nothing. It applies from the next run or chat: one already started finishes as it began. From Agentry Desktop 0.6.30 the window keeps saying so while a run or chat in Unsafe Mode is still going. The red edge stays, and the badge reads Unsafe Mode: running, until it ends. Then both go. In 0.6.28 and 0.6.29 they went at once, so a chat started earlier stayed in Unsafe Mode without them.

The images stay on your computer until you remove them. Docker images, lower in Run defaults, lists every image Agentry put on your computer, and Remove Agentry's Docker images removes them after a confirmation. On Windows the uninstaller removes them too, unless you tick Keep my Docker images.

Removing takes all of Agentry's images, not only Unsafe Mode's. The next run downloads or builds what it needs again, the Unsafe Mode image included where the switch is still on.

What a run says

Review and start shows an Unsafe Mode paragraph for every run on your computer while the switch is on. It opens with the same sentences for any QuickAgent:

Unsafe Mode is on: every command this QuickAgent declares is installed from Kali Linux's repository or PyPI without asking this computer's approved list, and each runs with the image's own PATH, so it can start any program that image holds. run_command still takes only the declared commands. A declared MCP server the registry's gate rates high or critical can run too, only with your consent for the run.

The last sentence arrived in 0.6.35. After those sentences, it lists the commands the release declares ("As resolved, it declares: …") and the ones that cannot be placed ("Not available in Unsafe Mode's image: …"). Each list holds at most forty entries and counts the rest. Where the Unsafe Mode image is not on your computer, or its index cannot be read, the paragraph says the second list could not be read, and why.

For a release from a registry, the lists are read from the registry's answer before the release is downloaded and checked, which is why the paragraph says "As resolved". For a QuickAgent installed from a folder on your computer, they are read from that install's manifest.

When a run accepts something that needs your consent, the consent dialog carries the same paragraph above its question. A run with nothing to accept raises no dialog, and Unsafe Mode does not add one: for that run, Review and start is where you read the paragraph.

The record of what was installed comes from the run itself:

  • The run log prints the plan's exec line, which begins UNSAFE MODE:. It names the image by digest, the declared commands, and where each one comes from.
  • The result has a section headed by an Unsafe Mode badge and This run's commands. It says whether every package installed, and shows the receipt's exec line.
  • The receipt carries that line as capabilities_enforced.exec. It adds every package the build installed with its version, dependencies included, each PyPI distribution with its archive's SHA-256, and anything that did not install.

A run that took the consent for a declared MCP server the gate rates high or critical says so in its receipt. Its line capabilities_enforced.mcpServers.vulnerabilities names Unsafe Mode and each server the run let through, with the advisories rated high or critical.

A command that cannot be installed

A command that cannot be installed does not stop the run, which goes on without that tool. There are two cases:

  • Not placed. Neither the index nor the short list names a package for the command, or several packages ship it and the index does not choose between them. Review and start names the command before the run, with those packages where there are several.
  • Not installed. The command's package fails to install. The build records the failure and goes on to the next package. The receipt's exec line says NOT installed at image build, with the package or the short-list tool, the installer's error and the commands left without it.

A declared name that is not a plain command name is never placed and cannot be called. Review and start counts such names and does not show them.

In both cases the command is absent from the run unless the image already holds it: the Unsafe Mode image carries a few programs of its own, and another command's package can bring one in. A call to an absent command is answered command "<name>" not present in image.

An image with a failed install is built again on the QuickAgent's next run, so a tool that an outage at the repository kept out is tried again. A package the repository does not carry fails on every run, and each of those runs builds the image again.

You cannot type a package name anywhere, and a manifest cannot name one either. The Unsafe Mode image's maintainers add a tool that no Kali package ships to its short list.