The agent drives Clauder
The agent in any chat can do what you do by hand in the interface: start new chats with a task, write to them, wait for and read the reply, rename, hide and stop them, look at projects and their settings. These are tools of the built-in clauder MCP server; every chat has them, nothing to connect.
The agent has exactly the rights of the key the chat was started with: a guest with a single-project key does not see other projects, a read-only key cannot change anything.
What you can ask
| Phrase | What the agent does |
|---|---|
“Start a separate chat in /var/www/site, have it update the dependencies, then tell me what it did” | chat_create → chat_wait → chat_read |
| “Who is working right now, and on what?” | agents_list |
| “Find yesterday's chat about auth and ask where it stopped” | chat_list with search → chat_send → chat_wait |
| “Stop the chat that runs the tests” | chat_stop |
| “Name this new chat ‘Item physics’” | chat_rename |
| “Hide all the test chats” | chat_archive |
| “Fork that chat and try another approach in the branch” | chat_fork |
| “What are the project's new-chat settings? Make Sonnet the default” | project_open, project_settings |
| “Create a folder for a new project” | project_create |
Tools
Chats: chat_create, chat_send, chat_status, chat_wait, chat_read, chat_stop, chat_rename, chat_archive, chat_delete, chat_list, chat_fork, chat_resume, agents_list.
Projects: project_list, project_create, project_open, project_settings.
A chat the agent starts is linked to it as its parent, so the list shows where it came from.
What it asks you first
The agent will not do dangerous things without you. Today that is deleting a chat, and starting a chat or setting a project to the “ask nothing” mode (bypassPermissions). For these you get the usual permission card: “Allow”, “Always allow” for the rest of this session, “Deny”. It arrives as a push and in Telegram like any agent question, and it asks even when the chat itself runs without questions.
What the agent cannot do
- Raise its own rights. A new chat gets a permission mode no looser than its parent's. Safe mode and the sandbox are inherited and cannot be switched off for the child.
- Recurse forever. A “chat started a chat” chain is limited in depth (3), and one chat can have at most 4 live children.
- See the key. The tools reach their own server with an internal pass the agent never sees; no tool returns secrets.
- Change these rules. Only the owner sees and changes the policy and the log; a request from the agent is refused.
Log and rules
Every call is logged: when, from which chat, with which key, what was done and how it ended. The owner can switch off individual tools, drop the confirmation for deleting, and change the limits. For now this is done through the API (/api/agent/control/policy, /api/agent/control/log); a “What the agent can do” page in settings comes next.