Human-in-the-Loop Task Manager for AI Agents
Checked October 30, 2026 | All YOLO Mode guides

How to Enable YOLO Mode in Kilo

To run the Kilo CLI in YOLO mode, start it with kilo --auto. kilo --yolo works too, as a hidden alias. In a running session, /auto-approve turns it on, and in VS Code the shield button in the prompt controls does the same. Unlike most YOLO switches, /auto-approve is saved to your global config, so it reaches every Kilo client.

This page is one of our YOLO mode guides, and part of our guide to YOLO mode in every coding agent. Everything below was checked against the Kilo source and docs (Kilo-Org/kilocode, version 7.8.25, commit 0a9faef) on October 30, 2026.

Animated sketch of YOLO mode in AgentRQ: claude waits to run go test, YOLO is flipped on for the task, and every later edit and test run lands auto-allowed in the Trajectory view

What YOLO Mode Turns Off in Kilo

Kilo sets each tool to allow, ask or deny, and YOLO turns every ask into allow. A rule set to deny still blocks.

Kilo asks less than you might expect out of the box. Most tools default to allow, including file edits outside JetBrains. What asks by default:

  • → Shell commands, except read-only ones and a short list such as mkdir, cp, mv, tar and tsc
  • → Files outside the project (external_directory)
  • → Reading .env files
  • → The doom-loop guard, when the agent keeps failing the same way
  • → File edits in the JetBrains plugin

YOLO does not touch Kilo's sandbox, covered below.

How to Enable YOLO Mode in Kilo

Where YOLO Halfway
CLI kilo --auto (alias --yolo)
One-shot run kilo run --auto "..."
CLI session /auto-approve approve a pattern at the prompt
VS Code shield button, or Settings → Auto Approve per-tool Allow / Ask / Deny
JetBrains Settings → Tools → Kilo Code → Auto-Approve per-tool rules
kilo.jsonc "permission": { "*": "allow" } per-tool and glob rules
bash 
kilo --auto

The help text calls --auto "auto-approve permissions that are not explicitly denied (dangerous!)". For one-shot runs it matters even more: without --auto, kilo run has nobody to ask, so it rejects every request that would have prompted and exits with an error.

/auto-approve Is Global

/auto-approve (also /approve-all) is not a session switch. It saves an allow-everything rule to your global config, and Kilo's own description says it is "shared with every client": VS Code, JetBrains and headless runs stop asking too. Run it again to remove the rule. The VS Code shield button is the runtime version: it approves pending and new prompts while it is highlighted.

The Halfway Option: Pattern Rules

Kilo's permission rules take glob patterns, and the last matching rule wins. A common middle ground is to allow the commands you run all day and keep asking about the rest:

json 
{
  "permission": {
    "bash": {
      "*": "ask",
      "git *": "allow",
      "npm test": "allow",
      "rm -rf *": "deny"
    }
  }
}

When the CLI asks about a command, you can also save a pattern from the prompt as an allow rule in your global config.

Kilo's Sandbox

Kilo has an operating-system sandbox, off by default, for macOS and Linux. Turn it on in VS Code under Settings → Sandboxing, or in the global kilo.jsonc:

json 
{
  "sandbox": { "enabled": true, "network": "deny" }
}

It limits where tools can write and blocks outbound network access from model-run commands, and it applies even when a tool passes the permission checks. So --auto with the sandbox on is a much safer YOLO than --auto alone. Reads are not restricted, and Windows has no sandbox.

How to Enable YOLO Mode in Kilo Through AgentRQ

Kilo's own YOLO switches cover a session, or with /auto-approve, everything. AgentRQ lets you make the decision per task, and answer from somewhere other than the terminal.

Approve From the AgentRQ Task Instead of the Terminal

Connect Kilo to an AgentRQ workspace through the ACP Gateway (Kilo setup guide). Log in once, then start the bridge:

bash 
npx @agentrq/acp-gateway@latest --login --agent kilo
npx @agentrq/acp-gateway@latest --agent kilo

kilo acp has no --auto flag, but it does read your saved rules. If you ever ran /auto-approve, run it again to remove the allow-everything rule, or Kilo approves every call before AgentRQ sees it. Then decide which tools should reach you: with Kilo's defaults, that is mostly shell commands. Set "edit": "ask" in kilo.jsonc if you want to see edits too.

Kilo's ACP session modes are its primary agents, such as code, plan, debug and ask. They change what the agent does, not how it asks: ask answers questions without changing your code, and code is the one that edits.

Each permission request now shows up in the AgentRQ task on the web, on your phone or in Slack, together with the command or edit it is asking about. Answer Allow Once, Always Allow or Deny from wherever you are, and Kilo carries on. If nobody answers within 30 minutes, the gateway cancels the turn instead of guessing. Change the limit with --permission-timeout.

Turn On YOLO for One Task

Flip the YOLO toggle on a task, or when you create it, to put just that task in YOLO mode. Every permission request in it is approved automatically and Kilo never waits, while every other task in the workspace still asks. Scheduled tasks, event triggers and workflow steps have the same switch, so an unattended job can run in YOLO while your interactive work stays supervised.

The YOLO toggle on a task in AgentRQ being switched on, then off again

Turn YOLO On or Off in Workspace Settings

To make YOLO the default for a whole workspace, open the workspace, go to Settings, choose the Automations tab and flip YOLO Mode (Execute All). Click Update Workspace to save. Switch it off the same way. The switch is off by default, and every permission request in the workspace is approved automatically while it is on.

Workspace Settings in AgentRQ: the YOLO Mode (Execute All) switch turned on and saved, then off and saved

A Safe YOLO Setup for Kilo

  • → Turn on Kilo's sandbox. It keeps working when AgentRQ approves everything, so a YOLO task still cannot write outside the workspace or reach the network.
  • → Keep deny rules for the worst commands. A deny rule in kilo.jsonc blocks a command before any approval is asked for.
  • → Allow the boring tools, not everything. Always Allow adds the tool to the workspace's auto-approved list, so the routine calls stop asking and the risky ones still do. Prune that list in workspace settings now and then.
  • → Leave the workspace-wide switch off. Turn YOLO on per task instead, so it never outlives the job you trusted.
  • → Read the record. The tool call history lists every call the task made, including the ones that were auto-approved.

FAQ

How do I enable YOLO mode in Kilo? Start the CLI with kilo --auto. kilo --yolo is a hidden alias for the same flag.

What does /auto-approve do in Kilo? It saves an allow-everything rule to your global config, which stops every Kilo client asking. Run it again to remove the rule.

Why does kilo run reject my commands? Without --auto, a non-interactive run cannot ask anyone, so it rejects every request that would have prompted. Add --auto.

Does Kilo ask before editing files? Not by default, except in the JetBrains plugin. Set "edit": "ask" in kilo.jsonc to make it ask.

Does Kilo have a sandbox? Yes, an opt-in one for macOS and Linux. Set sandbox.enabled to true to limit writes and block network access.

How do I approve Kilo commands remotely? Connect Kilo to AgentRQ through the ACP Gateway. Its permission requests show up in the task on the web, your phone or Slack.

For every other agent, see what YOLO mode is and how to turn it on in every coding agent.

Start Free