Tools & Approval

How gating works

• Each approval shows the exact command and working directory — approve or deny per call.
• Autonomous mode (per conversation) skips the prompts when you want full freedom.
• MCP-server tools are gated per server with a “require approval” toggle.
• The dispatcher fails closed: a gated tool with no approval handler is denied, not run.

Built-in tools

• Terminal — a real shell, streamed output.
• Filesystem — read, write, list, search; patch files with diffs.
• Python — run scripts for data work and chart generation.
• Word, PowerPoint, Excel — attach a .docx, .pptx or .xlsx and ask about it; slides and sheets are labelled, and spreadsheets come back as tables. Read on your Mac, with nothing to install (Pro).
• PDF — attach a document and ask about it: page-by-page text, scanned pages read on-device, merge and split. Charts and diagrams can be looked at rather than only read (Pro, and it asks first).
• Documents, read once. A long PDF, proposal or spreadsheet is read by the reading model (Settings ▸ Models), which writes notes — what it is, the facts that matter with their page or slide, open questions — under the project's naseem/reading folder. The conversation, and any helper Naseem delegates to, works from those notes instead of each re-reading the file. Unchanged files are never read twice. Word, PowerPoint and Excel are Pro; PDFs and text files work on Free.
• Vision — attach images; vision-capable models describe and analyze them.
• Images — ask for a logo, banner, illustration or any picture, in your own words or language, and the image model makes it; ask for a change and it edits that image, or one you attach. It asks before each image unless the chat is Autonomous, saves it in your Outputs folder, shows it under the answer and lists it in Artifacts. Set the model in Settings ▸ Models ▸ Image model (Pro).
• Web search — live results with your own free Tavily/Brave key (Settings → Tool APIs).
• Query data (jq) — the agent queries a large JSONL/JSON file (logs, event histories) with a jq filter and gets back only the matching records — no loading the whole file into context.

Slack

• Read your workspace. "What happened in #incidents overnight?", "Find the thread about the pricing change", "Who asked about the release date?" Naseem reads Slack as you, so it sees the channels you are in and nothing else, and there is no bot to invite anywhere.
• Post, once you have read it. Ask for a message and Naseem writes it in the conversation first. Sending it asks you every time, even in a chat set to run without asking, because everyone in the channel sees it and it cannot be taken back.
• Setting it up. Create a Slack app in your own workspace at api.slack.com/apps, add the scopes listed in Settings ▸ Integrations ▸ Slack under User Token Scopes, install it, and paste the token beginning xoxp-. The token lives in your Keychain and goes only to Slack. (Pro)

Your Mac's apps

• Naseem can read and write Mail, Calendar, Reminders, Notes and Contacts on this Mac, once you turn each one on in Settings ▸ Integrations. See the Your Mac's apps chapter for what to ask for, what asks you first, and how permissions work.