How to Enable YOLO Mode in Cortex Code

Q: Does Cortex Code have a YOLO mode?

Yes, it is called bypass mode. Start it with cortex --bypass or type /bypass in a session.

Q: What is --dangerously-allow-all-tool-calls in Cortex Code?

The long name for --bypass. Both approve every tool call without asking.

Q: Can Cortex Code still ask before SQL writes in bypass mode?

Yes. Set the environment variable COCO_DANGEROUS_MODE_REQUIRE_SQL_WRITE_PERMISSION to 1 and it asks before every SQL write, even in bypass mode.

Snowflake's Cortex Code (CoCo) calls its YOLO mode bypass mode. Start the CLI with cortex --bypass, or its long alias --dangerously-allow-all-tool-calls, or type /bypass in a running session. Shift-Tab switches between bypass and the default, and a red >> shows while bypass is on.

This page is one of our YOLO mode guides, and part of our guide to YOLO mode in every coding agent. Everything below was checked against Snowflake's Cortex Code CLI documentation (docs.snowflake.com, CLI 1.1.87 changelog) on October 30, 2026.

Animated sketch of YOLO mode in AgentRQ: claude waits to run go test, YOLO is flipped on for the task, and every later edit and test run lands auto-allowed in the Trajectory view

What YOLO Mode Turns Off in Cortex Code

In its default mode, Confirm actions, CoCo sorts each action by risk. Safe commands such as ls or cat and read-only SQL such as SELECT run on their own. File edits, SQL writes, USE ROLE, and commands such as rm, curl or sudo ask. Bypass mode approves all of them.

Two things can still stop it:

→ SQL writes. Set the environment variable COCO_DANGEROUS_MODE_REQUIRE_SQL_WRITE_PERMISSION to 1 (Snowflake's table also shows true) and CoCo asks before every SQL write, even in bypass mode. For an agent that works on your Snowflake account, this is the guard to keep.
→ Your administrator. In a managed setup, dangerouslyAllowAll is false by default, which blocks the bypass flag.

How to Enable YOLO Mode in Cortex Code

Where	Bypass (YOLO)	Back to asking
Command line	`cortex --bypass`	`cortex`
In a session	`/bypass`	`/bypass-off`
Keyboard	Shift-Tab	Shift-Tab
ACP	`cortex acp serve --bypass`, or mode `bypass`	mode `standard`

bash

cortex --bypass

Plan mode is a separate toggle: --plan, /plan or Ctrl-P. It presents a plan before taking any action. --auto-accept-plans accepts those plans without asking.

The Halfway Options

→ Pre-approve tools. --allowed-tools "Bash(git *)" lets matching tools run without asking, and --disallowed-tools removes tools from the model's reach.
→ Remember your answers. At a prompt you can save your choice. CoCo keeps these in ~/.snowflake/cortex/permissions.json. Delete the file to reset them.
→ Sandbox auto-allow. Turn on the local sandbox with /sandbox runtime on, then /sandbox mode auto. Commands that can run inside the sandbox go ahead without asking, and the rest fall back to the normal prompts. The sandbox uses sandbox-exec on macOS, bubblewrap on Linux and restricted tokens on Windows. It is marked experimental.

How to Enable YOLO Mode in Cortex Code Through AgentRQ

CoCo's bypass covers a whole session. AgentRQ lets you make the decision per task, and answer from somewhere other than the terminal.

Approve From the AgentRQ Task Instead of the Terminal

Connect Cortex Code to an AgentRQ workspace through the ACP Gateway (Cortex Code setup guide):

bash

npx @agentrq/acp-gateway@latest --agent cortex-code --allow-unverified-agent

Leave out --bypass. In ACP mode CoCo routes its permission prompts to the client in the standard and plan modes, and its own docs warn that in bypass "no prompts are sent". Each permission request now shows up in the AgentRQ task on the web, on your phone or in Slack, together with the command or edit it is asking about. Answer Allow Once, Always Allow or Deny from wherever you are, and CoCo carries on. If nobody answers within 30 minutes, the gateway cancels the turn instead of guessing. Change the limit with --permission-timeout.

Turn On YOLO for One Task

Flip the YOLO toggle on a task, or when you create it, to put just that task in YOLO mode. Every permission request in it is approved automatically and CoCo never waits, while every other task in the workspace still asks. Scheduled tasks, event triggers and workflow steps have the same switch, so an unattended job can run in YOLO while your interactive work stays supervised.

For scheduled work this is a useful difference: cortex exec, CoCo's own non-interactive mode, rejects every prompt automatically, so anything that would ask simply fails. Through AgentRQ the same job can run with YOLO on, or wait for your answer.

The YOLO toggle on a task in AgentRQ being switched on, then off again

Turn YOLO On or Off in Workspace Settings

To make YOLO the default for a whole workspace, open the workspace, go to Settings, choose the Automations tab and flip YOLO Mode (Execute All). Click Update Workspace to save. Switch it off the same way. The switch is off by default, and every permission request in the workspace is approved automatically while it is on.

Workspace Settings in AgentRQ: the YOLO Mode (Execute All) switch turned on and saved, then off and saved

A Safe YOLO Setup for Cortex Code

→ Guard SQL writes. Set COCO_DANGEROUS_MODE_REQUIRE_SQL_WRITE_PERMISSION, and use a Snowflake connection whose role can only touch what the task needs.
→ Allow the boring tools, not everything. Always Allow adds the tool to the workspace's auto-approved list, so the routine calls stop asking and the risky ones still do. Prune that list in workspace settings now and then.
→ Leave the workspace-wide switch off. Turn YOLO on per task instead, so it never outlives the job you trusted.
→ Use the sandbox. Turn on CoCo's local sandbox, or run tools in a Snowflake-managed container with --cloud.
→ Commit first. Start every YOLO task from a clean git tree, so any change is one git reset away.
→ Read the record. The tool call history lists every call the task made, including the ones that were auto-approved.

FAQ

Does Cortex Code have a YOLO mode? Yes, it is called bypass mode. Start it with cortex --bypass or type /bypass in a session.

What is --dangerously-allow-all-tool-calls in Cortex Code? The long name for --bypass. Both approve every tool call without asking.

Can Cortex Code still ask before SQL writes in bypass mode? Yes. Set the environment variable COCO_DANGEROUS_MODE_REQUIRE_SQL_WRITE_PERMISSION to 1 and it asks before every SQL write, even in bypass mode.

Why can't I use bypass mode in Cortex Code? Your administrator's managed settings block it. In managed mode dangerouslyAllowAll defaults to false.

How do I approve Cortex Code actions remotely? Connect Cortex Code to AgentRQ through the ACP Gateway, without --bypass. Its permission requests show up in the task on the web, your phone or Slack.

For every other agent, see what YOLO mode is and how to turn it on in every coding agent.