---
title: "How to Enable YOLO Mode in Kilo | AgentRQ Guidelines"
url: https://agentrq.com/guidelines/yolo-mode/kilo
description: "Kilo YOLO mode: kilo --auto (--yolo is a hidden alias), /auto-approve, the VS Code shield button and kilo.jsonc permissions. Plus its opt-in sandbox."
---

![](https://agentrq.com/assets/agent-icons/kilo.svg) Checked October 30, 2026 | [All YOLO Mode guides](https://agentrq.com/guidelines/yolo-mode/)

# How to Enable YOLO Mode in Kilo

To run the Kilo CLI in YOLO mode, start it with `kilo --auto`. `kilo --yolo` works too, as a hidden alias. In a running session, `/auto-approve` turns it on, and in VS Code the shield button in the prompt controls does the same. Unlike most YOLO switches, `/auto-approve` is saved to your global config, so it reaches every Kilo client.

This page is one of our [YOLO mode guides](https://agentrq.com/guidelines/yolo-mode/), and part of our guide to [YOLO mode in every coding agent](https://agentrq.com/blog/what-is-yolo-mode-and-how-to-turn-it-on-in-every-coding-agent). Everything below was checked against the Kilo source and docs (Kilo-Org/kilocode, version 7.8.25, commit 0a9faef) on October 30, 2026.

![Animated sketch of YOLO mode in AgentRQ: claude waits to run go test, YOLO is flipped on for the task, and every later edit and test run lands auto-allowed in the Trajectory view](https://agentrq.com/assets/sketches/yolo-mode.svg)

## What YOLO Mode Turns Off in Kilo

Kilo sets each tool to `allow`, `ask` or `deny`, and YOLO turns every `ask` into `allow`. A rule set to `deny` still blocks.

Kilo asks less than you might expect out of the box. Most tools default to `allow`, including file edits outside JetBrains. What asks by default:

- → **Shell commands**, except read-only ones and a short list such as `mkdir`, `cp`, `mv`, `tar` and `tsc`
- → **Files outside the project** (`external_directory`)
- → **Reading .env files**
- → **The doom-loop guard**, when the agent keeps failing the same way
- → **File edits in the JetBrains plugin**

YOLO does not touch Kilo's sandbox, covered below.

## How to Enable YOLO Mode in Kilo

| Where | YOLO | Halfway |
| --- | --- | --- |
| CLI | `kilo --auto` (alias `--yolo`) |  |
| One-shot run | `kilo run --auto "..."` |  |
| CLI session | `/auto-approve` | approve a pattern at the prompt |
| VS Code | shield button, or Settings → Auto Approve | per-tool Allow / Ask / Deny |
| JetBrains | Settings → Tools → Kilo Code → Auto-Approve | per-tool rules |
| kilo.jsonc | `"permission": { "*": "allow" }` | per-tool and glob rules |

bash

```bash
kilo --auto
```

The help text calls `--auto` "auto-approve permissions that are not explicitly denied (dangerous!)". For one-shot runs it matters even more: without `--auto`, `kilo run` has nobody to ask, so it rejects every request that would have prompted and exits with an error.

### /auto-approve Is Global

`/auto-approve` (also `/approve-all`) is not a session switch. It saves an allow-everything rule to your global config, and Kilo's own description says it is "shared with every client": VS Code, JetBrains and headless runs stop asking too. Run it again to remove the rule. The VS Code shield button is the runtime version: it approves pending and new prompts while it is highlighted.

### The Halfway Option: Pattern Rules

Kilo's permission rules take glob patterns, and the last matching rule wins. A common middle ground is to allow the commands you run all day and keep asking about the rest:

json

```json
{
  "permission": {
    "bash": {
      "*": "ask",
      "git *": "allow",
      "npm test": "allow",
      "rm -rf *": "deny"
    }
  }
}
```

When the CLI asks about a command, you can also save a pattern from the prompt as an `allow` rule in your global config.

## Kilo's Sandbox

Kilo has an operating-system sandbox, off by default, for macOS and Linux. Turn it on in VS Code under **Settings → Sandboxing**, or in the global `kilo.jsonc`:

json

```json
{
  "sandbox": { "enabled": true, "network": "deny" }
}
```

It limits where tools can write and blocks outbound network access from model-run commands, and it applies even when a tool passes the permission checks. So `--auto` with the sandbox on is a much safer YOLO than `--auto` alone. Reads are not restricted, and Windows has no sandbox.

## How to Enable YOLO Mode in Kilo Through AgentRQ

Kilo's own YOLO switches cover a session, or with `/auto-approve`, everything. AgentRQ lets you make the decision per task, and answer from somewhere other than the terminal.

### Approve From the AgentRQ Task Instead of the Terminal

Connect Kilo to an AgentRQ workspace through the [ACP Gateway](https://agentrq.com/docs/connect-acp-agent) ([Kilo setup guide](https://agentrq.com/docs/agents/kilo)). Log in once, then start the bridge:

bash

```bash
npx @agentrq/acp-gateway@latest --login --agent kilo
npx @agentrq/acp-gateway@latest --agent kilo
```

`kilo acp` has no `--auto` flag, but it does read your saved rules. If you ever ran `/auto-approve`, run it again to remove the allow-everything rule, or Kilo approves every call before AgentRQ sees it. Then decide which tools should reach you: with Kilo's defaults, that is mostly shell commands. Set `"edit": "ask"` in `kilo.jsonc` if you want to see edits too.

Kilo's ACP session modes are its primary agents, such as `code`, `plan`, `debug` and `ask`. They change what the agent does, not how it asks: `ask` answers questions without changing your code, and `code` is the one that edits.

Each permission request now shows up in the AgentRQ task on the web, on your phone or in Slack, together with the command or edit it is asking about. Answer **Allow Once**, **Always Allow** or **Deny** from wherever you are, and Kilo carries on. If nobody answers within 30 minutes, the gateway cancels the turn instead of guessing. Change the limit with `--permission-timeout`.

### Turn On YOLO for One Task

Flip the **YOLO** toggle on a task, or when you create it, to put just that task in [YOLO mode](https://agentrq.com/features/yolo-mode). Every permission request in it is approved automatically and Kilo never waits, while every other task in the workspace still asks. [Scheduled tasks](https://agentrq.com/features/task-scheduling), [event triggers](https://agentrq.com/features/events) and [workflow](https://agentrq.com/features/workflows) steps have the same switch, so an unattended job can run in YOLO while your interactive work stays supervised.

![The YOLO toggle on a task in AgentRQ being switched on, then off again](https://agentrq.com/assets/guidelines/yolo-mode-task-toggle.gif)

### Turn YOLO On or Off in Workspace Settings

To make YOLO the default for a whole workspace, open the workspace, go to **Settings**, choose the **Automations** tab and flip **YOLO Mode (Execute All)**. Click **Update Workspace** to save. Switch it off the same way. The switch is off by default, and every permission request in the workspace is approved automatically while it is on.

![Workspace Settings in AgentRQ: the YOLO Mode (Execute All) switch turned on and saved, then off and saved](https://agentrq.com/assets/guidelines/yolo-mode-workspace-settings.gif)

### A Safe YOLO Setup for Kilo

- → **Turn on Kilo's sandbox.** It keeps working when AgentRQ approves everything, so a YOLO task still cannot write outside the workspace or reach the network.
- → **Keep deny rules for the worst commands.** A `deny` rule in `kilo.jsonc` blocks a command before any approval is asked for.
- → **Allow the boring tools, not everything.** **Always Allow** adds the tool to the workspace's auto-approved list, so the routine calls stop asking and the risky ones still do. Prune that list in workspace settings now and then.
- → **Leave the workspace-wide switch off.** Turn YOLO on per task instead, so it never outlives the job you trusted.
- → **Read the record.** The [tool call history](https://agentrq.com/features/tool-call-history) lists every call the task made, including the ones that were auto-approved.

## FAQ

**How do I enable YOLO mode in Kilo?** Start the CLI with `kilo --auto`. `kilo --yolo` is a hidden alias for the same flag.

**What does /auto-approve do in Kilo?** It saves an allow-everything rule to your global config, which stops every Kilo client asking. Run it again to remove the rule.

**Why does kilo run reject my commands?** Without `--auto`, a non-interactive run cannot ask anyone, so it rejects every request that would have prompted. Add `--auto`.

**Does Kilo ask before editing files?** Not by default, except in the JetBrains plugin. Set `"edit": "ask"` in `kilo.jsonc` to make it ask.

**Does Kilo have a sandbox?** Yes, an opt-in one for macOS and Linux. Set `sandbox.enabled` to true to limit writes and block network access.

**How do I approve Kilo commands remotely?** Connect Kilo to [AgentRQ](https://agentrq.com) through the ACP Gateway. Its permission requests show up in the task on the web, your phone or Slack.

For every other agent, see [what YOLO mode is and how to turn it on in every coding agent](https://agentrq.com/blog/what-is-yolo-mode-and-how-to-turn-it-on-in-every-coding-agent).