io-auto-mode: the missing security layer for autonomous agents

Useful and dangerous are the same setting

An agent running autonomously, without you approving every tool call, is genuinely useful. It's also genuinely dangerous, because right now your only two options are "approve everything by hand" or "let it do absolutely anything." Neither is a real answer. io-auto-mode is a third option: a three-layer tool-call classifier that lets the agent run free while catching the small percentage of calls that actually need scrutiny. Most calls clear instantly. Only the genuinely risky ones get a second look.

Useful and dangerous are the same setting.

The problem nobody talks about enough

The moment you give an agent autonomous operation, so it can work without you sat there approving every command, you've handed it real trust. That's fine until it isn't. Prompt injection, a bad loop, a tool call that goes somewhere you didn't intend, and an unsupervised agent can delete your repository, wipe your drive, hand out your passwords, read your secrets. It doesn't need malicious intent on the agent's part. It just needs one bad moment.

Right now, without something like io-auto-mode, you've got two options, and both are bad.

Option one: write down every permission you're willing to give it in advance, then sit there approving each tool call by hand as it comes up. This sounds responsible. In practice there's always a call you didn't think to list. You either stop the agent to add it, defeating the point of autonomy, or you approve it in the moment anyway, defeating the point of the list.

Option two: run it in dangerously-skip-permissions mode. The name is doing you a favour by being honest. It means the agent can do absolutely anything on your machine, no questions asked, no gate at all. If it ever gets hit with prompt injection, or just goes wrong on its own, there's nothing between that moment and real damage.

Neither of these is a security model. One doesn't scale, the other doesn't protect you.

Neither of these is a security model. One doesn't scale, the other doesn't protect you.

What I built instead

io-auto-mode is a tool-call classifier that sits in front of every action an autonomous agent tries to take, and decides, in three layers, whether it's safe to let through.

Layer one is a plain allowlist. A set of commands and operations that are just fine, no LLM involved at all. You can inherit a sensible default set or add your own. Anything on the list runs immediately. This is deliberately the fast, cheap layer, and in practice it catches almost everything: the vast majority of what an agent does day to day is completely mundane, reading a file, running a known-safe command, and it should never need a model call to prove that.

Layer two is a quick pass from Gemini Flash Lite. Anything that doesn't clear the allowlist gets a fast, cheap classification: does this specific command look dodgy, on its own, out of context? Most of what reaches this layer gets waved through here. This is the layer that catches the "not on my allowlist but obviously fine" cases without paying for a bigger model.

Layer three is Gemini Flash proper, with context. If layer two flags something as uncertain, it escalates one more step, to a model that actually gets given the history: what led up to this operation, what the agent's been doing, why this call is happening now. That context is the whole point of this layer. A command can look fine in isolation and still be wrong given what came before it, or look alarming in isolation and be completely reasonable in context. Only with that history does the model make the actual call: block it, or let it through.

A command can look fine in isolation and still be wrong given what came before it, or look alarming in isolation and be completely reasonable in context.

The shape of it in practice

Most tool calls get allowed at layer one. Only around 6% of calls make it as far as layer two. Of those, most get approved there too, it's genuinely rare for something to need the full context pass at layer three. That's the shape you want: cheap and fast for the overwhelming majority of normal operation, with real scrutiny reserved for the small slice of calls that actually warrant it.

It's stopped every genuinely stupid or dangerous tool call I've thrown at it, without ever making me sit there rubber-stamping routine work.

Where it's been running

I built the first version as a hook plugin for OpenClaw, back when that's what I was using day to day, because Claude Code's enterprise plan had shipped something similar (their own AutoMode) and I wanted the equivalent for myself. When I moved over to Claude Code, it wasn't available on the plan I was on either, so I built a Claude Code port and ran that for a while, until native auto mode eventually landed on the Max plan and I switched to using Anthropic's own version there.

Since then I've kept porting the idea wherever I've needed it: into Codex, because I've got an agent running there too, and most recently into Antigravity, so an autonomous Antigravity agent gets the same three-layer protection as everything else. Same classifier, same three layers, wherever the agent actually runs.

It's the same protection guarding the agent team behind Inkie, so this isn't a lab experiment, it runs against a live product every day.

A few common questions

What percentage of tool calls actually need layer three? Not many. Around 6% of calls get past the allowlist and reach layer two, and most of those are waved through there too. Layer three, the full-context read, only ever sees what's left after both of those.

Is io-auto-mode tied to Claude Code specifically? No. It started as an OpenClaw hook plugin, got a Claude Code port next, and has since landed in Codex and Antigravity too. Same three layers, wherever the agent actually runs.

Why not just use Claude Code's own AutoMode? I do, on Claude Code itself, since native auto mode landed on the Max plan I'm on. But I also run agents in Codex and Antigravity, and neither has its own version of this, so io-auto-mode is what covers the gap and keeps the same protection everywhere I run something autonomously.

Is it free? Yes, no catches. It's fully open source, so you don't have to take my word for any of this, you can go read the classifier logic yourself.

Try it

It's free and open source. Link's in my bio. If you're running any agent autonomously, this is the piece that's missing.