Models & settings

Settings are split into Client and Gateway groups. Client preferences stay on this machine; gateway settings live on the active gateway host.

Models (BYO)

Settings → Models: add custom providers (name, BaseURL, API Format: Chat Completions or Responses, API Key) and model catalogs; set a global default; per-assistant overrides are available.

Bring your own providers: requests go to the endpoints you configure; connection tests are available. Compatible gateways are fine. OkBot does not host inference.

Tool permissions

Settings → Tool permissions: web search and auto-approval rules (AAR) (allow / ask first, keywords) stay visible. The per-tool Tools management list (enable / allow / ask for shell / files, read_skill, manage_schedule, manage_task_progress, manage_note, manage_memory, web_fetch / web_search, image generation, and more) appears only with Developer mode on; when hidden, defaults remain enabled + auto-allow — including run_shell / write_file / edit_file. HITL cards appear when you set a tool to ask.

Web search supports Tavily / Brave / Serper / custom. web_fetch blocks private addresses by default (optional allow in settings).

Forced confirm (regardless of tool prefs or AAR): schedule create / delete, memory forget. MCP tools are never auto-approvable; every MCP call asks when MCP is on.

Security protection

Settings → Security has Tool | Agent tabs (both under the master switch):

• Tool: intercept mode, home-directory limits, allow/deny path prefixes, editable dangerous-shell regexes.
• Agent (all off by default): optional input checks (empty input, length cap, jailbreak/override heuristics, injection-marker hygiene, secret/PII paste); optional tripwire when a final reply looks like it contains secrets; optional redaction of secrets in run_shell / read_file tool results before they return to the model.

Path prefixes and the dangerous-command denylist are soft guards, not isolation: run_shell uses the local (or selected runtime computer) shell and user environment — not an OS sandbox (no seatbelt/container by default). HITL/AAR only participate when a tool is set to ask (or forced-confirm / MCP). Turn on Agent guardrails as needed. Tighter posture: set dangerous tools to ask, keep LAN bind off, leave MCP off, and tighten allowed paths.

Assistant / squad work root: relative read_file / write_file / edit_file paths default under the current member data dir (~/.okbot/data/<memberId>, or the same folder under a custom data root). When run_shell omits cwd, it defaults to temp/ under that root. Put library deliverables in resources/…; throwaway scripts and outputs in temp/…. Writes/edits and cheap shell redirects block overwriting durable owner-state files such as session.jsonl / resources.jsonl / tasks.jsonl / memory.md / bot.json / SOUL.md — still soft guards, not an OS sandbox; absolute paths and ~/… remain available.

MCP extensions

Settings → MCP extensions: master switch on by default (an existing explicit enabled: false stays off). Add local command (stdio) or HTTP servers; Marketplace connector presets write entries but still need you to enable that server. After restore from backup the master switch is forced off until you re-enable it.

MCP tools always require approval; auto-approval rules apply only to built-in tools, and MCP cards do not offer “always allow”. Tools only — no MCP resources / prompts.

Client: Gateway list

Settings → Client → Gateway list: local and saved remote gateways; switch the active one (restart may apply). See Gateway.

Gateway service and tokens

Settings → Gateway → Gateway service: port, LAN, Web UI, multiple named gateway tokens (user / admin, message and token quotas, per-token usage), Computers entry, backup. See Gateway.

Other common items

• General: theme, language, timezone (fallback for schedules), translucency, microphone, hardware acceleration, system notifications, close-window behavior; Developer mode under Advanced (off by default; when on, shows System instructions — editable templates plus a read-only Other tab of hardcoded prompts — the Tools management list under Tool permissions, and debug entries such as bot-form Advanced, session request address, view context, usage stats, and trace)
• Global memory: entries shared across assistants
• Usage analytics: light token stats with Members and Models breakdown tabs (including per gateway token)
• Auto-update: check / download / install (desktop app)
• Context compression: see Context
• Run Watchdog (settings.json → watchdog, on by default): in-turn transient model retries (transientRetries, default 3) and poll interval (intervalMs, default 30000). No dedicated settings panel yet — edit that file when you need to tune it.

Secrets stay in gateway-host settings files with tightened permissions. Backups can exclude secrets.