What it can do
You decide which kinds of tool the agent has. Each is a group you switch on or off:
- Files and folders. Read, write, search, move and delete files inside the folder you choose.
- Shell and system. Run commands and short scripts, and read basic information about your computer.
- Documents. Read PDFs, Word, PowerPoint and Excel files; write PDFs, Word documents and presentations.
- Memory. Look up what was said in your earlier conversations.
- Web and browser. Search the web and read pages. Off until you switch it on.
- Screen and applications. See the screen, open apps, click and type. The most powerful group, and off until you switch it on.
You can also connect your own tools: any server that speaks the Model Context Protocol (MCP) adds its tools to the list.
Things to ask it
- “Sort my Downloads folder into subfolders by file type.”
- “Rename the photos in this folder by the date they were taken.”
- “Read these six PDFs and write a one-page summary as a Word document.”
- “Total the amounts in these invoices and tell me which ones are overdue.”
- “Turn my meeting notes into a short presentation.”
- “Find three recent articles on this topic and summarise them, with links.” (with Web switched on)
How you stay in control
- One folder. The agent works inside a folder you choose. A path that leads outside it is refused before any permission is asked, so no approval can widen it. Choose a project folder, not a whole drive.
- It asks first. Reading inside the folder is the only thing it does without asking. Changing a file, running a command or going online stops and waits for you. For each tool you can choose Ask, Allow or Deny, and Revoke all puts everything back to asking.
- It checks its own work. When it changes files, it is asked to run what it changed before it finishes, and a command that fails sends it back to fix the cause instead of calling the job done.
- It keeps a record. Every request, every decision you made and every result goes into an activity log you can read.
The agent can still make mistakes, and what you approve is up to you, so keep a backup of anything you can’t afford to lose.
Set it up in five minutes
- In Models, load a model badged Agent. These were trained to use tools.
- Open Agent in the side bar and choose a workspace folder, then Enable.
- Under Tool groups, switch on what this job needs and switch off the rest.
- Under Permissions, leave tools on Ask until you trust them.
- In the chat, switch on Agent in the message box and describe the task.
As it works you see each step, and a card whenever it needs your yes or no.
Which model to use
Any model badged Agent will work. On an everyday laptop, start with Qwen2.5 7B or Qwen3 8B: good at following instructions and using tools, and small enough to be patient with. For work that is mostly code, try Qwen2.5 Coder 7B or 14B. Llama 3.1 8B and Mistral Nemo 12B are good too. Bigger models make fewer mistakes, and take longer over each step; what speed to expect.
Tips for good results
- Switch off groups you don’t need. Every group is described to the model at each step, so fewer groups make it faster and less forgetful.
- Say what done looks like. “A Word file called Summary.docx in this folder” works better than “summarise these”.
- One job at a time. Several small tasks go better than one sprawling one.
- Read the cards. Each one says exactly what it is about to do.
Questions
Does the agent work offline?
Yes, everything except the Web group. When you let it search or read pages, those requests go to the search engine and the sites it opens. Your files stay on your computer.
Can it see my whole computer?
No. Files and commands stay inside the folder you chose. Seeing the screen and using other apps is a separate group that stays off unless you switch it on.
Is it safe to let an AI run commands?
Each command waits for your approval unless you’ve chosen to allow it, it runs inside the workspace folder, and it is recorded. Read the card before you say yes, as you would before running a command yourself.
Can I add my own tools?
Yes, through MCP. Every MCP tool starts on Ask, because a server can’t prove what its tool will do.