Tools & Security
Apis AI gives the AI controlled access to your system. You decide what is allowed: shared folders, a terminal sandbox and a confirmation requirement for deletions.
Internal Tools
Besides MCP servers, Apis AI ships its own tools that the AI can use in the tool loop:
| Category | Tools |
|---|---|
| File system | local_* – read, write and edit files in shared folders. Every edit is shown in the chat as a Git-style diff. |
| Shell | shell_cmd – execute commands, by default inside the sandbox. |
| Task management | task_* – create and manage tasks. |
| Charts | create_chart – create diagrams in chat. |
| Math | math_resolve – evaluate mathematical expressions (plain or LaTeX), single or as a batch with a table. Every result is labelled exact (integer/fraction), float (approximation), undefined (domain) or NaN, so a guessed value is never mistaken for a computed one. Poles such as tan(pi/2), sec(pi/2), cot(0) or csc(0) are reported as undefined instead of a huge float. |
| Screen | list_screens, capture_screenshot – list monitors and take a screenshot. Only offered to vision-capable models in chat (see Images & Screenshots). |
| Scripts | script_list, script_run – run shared scripts. |
In workflow nodes these categories can be switched off individually (see Workflows). The same applies per model: on the card Tool Selection per Model you decide which MCP servers and which of these groups a model receives at all – see Settings.
Shared Folders
The AI may only access folders that you add under Settings, then System & Prompts, then Shared folders. Without sharing, no file access is possible. Clicking Add folder (home) starts in the home directory.
Deleting Files
The Can delete files on its own option controls the behavior:
- Enabled – the AI deletes files without asking.
- Disabled (default) – a confirmation appears before every deletion; you can confirm or reject.
Terminal Sandbox
The terminal sandbox is active by default. Then the AI only executes allowed, read-only commands via shell_cmd. If you disable it, the AI gets full system access with arbitrary commands.
Every command has a time limit – 30 seconds by default. You can change it under
Settings → Parameters (1–1800 seconds); it applies to sandboxed and full-access mode alike.
This value is the ceiling: for a single call the AI may ask for a shorter limit with the
timeout_seconds argument, never for a longer one. When a command exceeds the limit, it is
terminated together with its child processes, the output read so far is returned instead of being
discarded, and the call is reported as a separate timeout error – so a hanging command is not
mistaken for a failing one.
rm, chmod, sudo) and
interpreters (sh, python …) are never
allowed in the sandbox – not even via the list. For such commands you would have to
deliberately disable the sandbox.
Whitelist / Blacklist
As long as the sandbox is active, a command list controls what is allowed (one command per line):
| Mode | Behavior |
|---|---|
| Whitelist | Only the listed, read-only commands are allowed – for tight sandboxes. |
| Blacklist | All individual commands except the listed ones are allowed (without chaining or redirects). |
If the list stays empty, the system default of the respective mode applies. Use Reset to system default to restore it.
Per-Chat/Node Override
The global sandbox setting can be overridden per chat via the Sandbox pill and per workflow node in its properties. The options are:
- Default (global) – adopts the global setting.
- Sandbox on – only allowed, read-only commands.
- Sandbox off (full access) – arbitrary commands.