The search finds words. In a conversation you go through the whole topic.You get an answer from the documentation and the page it comes from.
exec0
How exec0 checks tool calls
exec0 checks every tool call an AI agent makes before it runs, on the device. This page lists what is checked, how a decision is made, which rules apply without the model, and what is stored where.
~5 min read · exec0
What is checked
Tool
Checked
Note
Bash
yes
Shell commands
Write, Edit, NotebookEdit
yes
File writes and edits
WebFetch, WebSearch
yes
Web requests
MCP tools
yes
Every call to an MCP server
Read, Grep, Glob
no
Reading stays free. What the agent read is context for the next check.
Subagents
yes
Their own tool calls are checked like any other
Agent
Status
All popular coding agents, including Claude Code, Codex, Cursor and Gemini CLI
supported
What the check sees
Input
Content
Request
The last request you sent the agent
Session
Earlier tool calls of the same session: name and truncated arguments
Read content
The content of the last file, web page or MCP response the agent read
Call
Tool name and arguments of the call about to run
Decisions
Decision
When
Effect
allow
No sign of harm
The call runs.
ask
The case is unclear
The PoisonZero dialog opens. The call waits for your answer.
block
A fixed rule matches, or Melira AI sees clear harm
The call does not run. The agent receives the reason.
The call counts, not who asked for it. A clearly harmful call is blocked whether it came from a web page, a file, injected text or your own request, and without asking first. Clear harm: data sent to a third-party destination, a security function switched off, credentials taken, destruction.
Fixed rules
Checked first, without the model. A match blocks at once, even when the engine is not running.
Rule
Example
Delete the root, home or system folders
rm -rf on /, ~ or /usr
Format or overwrite a disk, write to /dev
dd onto a disk device
Run code from the internet directly
curl … | sh
Read the system keychain
Dumping stored passwords from the keychain
Send a secret to a third-party host
A GitHub token sent to example.com. The same token sent to api.github.com is not blocked by this rule.
Calls that are sometimes legitimate go to Melira AI with a note instead:
Writing agent settings and hooks
Writing to credential folders, for example ~/.ssh/authorized_keys
Allowed calls (allow): entry in the local journal, without content
On the device
On the device
Interventions (block, ask): audit entry, without content
On the device and in the console
On the device
An audit entry holds only these fields:
Field
Content
Time
When the intervention happened
Action
block or ask
Tool
Only the tool name, for example exec0:Bash
Reason
Name of the fixed rule, or Melira AI
Category
Name of the detected category
Danger value
Value from 0 to 1, when Melira AI decided
Never in the audit: command, arguments, file paths, file contents, URLs or your request. In Private mode, the audit does not go to the console either; the device only fetches its license about every 30 days.