Agent Mode (Auto-Execution)

Note

Agent Mode has no separate plan entitlement. Its MCP connections count toward the plan’s server quota, and only an authorized workspace administrator can change their execution and auto-execution lists.

Overview

Agent Mode lets DeepIntShield run eligible, authorized tool calls for you automatically, so you don’t make a separate execute call for each tool. Use it when you want an autonomous agent loop instead of the explicit review-and-execute workflow.

Caution

Streaming Not Supported: Agent Mode is not compatible with streaming responses. Use non-streaming chat and responses endpoints when Agent Mode is enabled.

When Agent Mode is enabled:

1. LLM returns tool calls in its response
2. DeepIntShield considers auto-executable tools for autonomous execution
3. Results are fed back to the LLM
4. Loop continues until no more tool calls OR max depth reached
5. Non-auto-executable tools are returned to your application for review

Caution

Agent Mode requires explicit configuration. Tools must be marked as auto-executable via tools_to_auto_execute. By default, no tools are auto-executed.

tools_to_auto_execute is an eligibility list, not an authorization verdict or an automatic Command Authority approval. When Agentic-New GAF is enabled, every eligible call still needs an exact Allow for the current key binding, governed agent, Registry action, OpenFGA relationships, client configuration, and arguments. Shadow mode does not bypass that execution decision.

---

Configuration

Agent Mode requires two configurations:

1. tools_to_execute: Which tools are available (whitelist)
2. tools_to_auto_execute: Which tools are eligible for the autonomous loop (subset of the executable list)

Tools To Execute vs Tools To Auto Execute

Field	Purpose	Semantics
tools_to_execute	Tools available to the LLM	["*"] = all, [] = none, ["a", "b"] = specific
tools_to_auto_execute	Tools eligible for the autonomous loop; GAF still decides each call	Same semantics, must be subset of tools_to_execute

Note

A tool in tools_to_auto_execute that is NOT in tools_to_execute will be ignored. The execute list takes precedence.

---

Gateway Setup

Configuring Auto-Execute Tools

1. Navigate to Agentic → MCP Registry in the workspace sidebar
2. Click on a client to open its configuration sheet
3. Scroll to the Available Tools section
4. For each tool, toggle the Automatically execute tool switch
5. Click Save Changes to apply

The auto-execute configuration is managed per client. It controls which tools the loop may attempt automatically; it does not replace server-side authorization or approval.

Global Agent Settings

Max depth and other agent settings - max_agent_depth, tool_execution_timeout, and code_mode_binding_level - are managed from the Settings tab under Agentic → MCP Registry. Adjust them there to change how deep the agent loop can run and how long each tool execution may take.

---

Agent Mode Behavior

Max Depth

The max_agent_depth setting limits how many iterations the agent can perform:

• Default: 10 iterations
• Each LLM call that produces tool calls counts as one iteration
• When max depth is reached, the current response is returned (may contain pending tool calls)

Parallel Execution

When the model requests several auto-executable tools at once, they run concurrently, so a turn with multiple independent tool calls finishes about as fast as its slowest call.

Mixed Auto/Non-Auto Tools

When a single response mixes auto-executable and non-auto-executable tools, DeepIntShield attempts the eligible tools and then hands the remaining request back to your application for review. Every attempted tool must first pass the canonical authorization boundary. The response you receive after successful eligible calls has:

• A content field with a JSON summary of the tools that already ran
• The pending tools (the ones you have not allow-listed) in tool_calls
• finish_reason set to "stop"

{
  "choices": [{
    "index": 0,
    "finish_reason": "stop",
    "message": {
      "role": "assistant",
      "content": "The Output from allowed tools calls is - {\"filesystem-list_directory\":\"[\\\"file1.go\\\", \\\"file2.go\\\"]\"}\n\nNow I shall call these tools next...",
      "tool_calls": [{
        "id": "call_pending",
        "type": "function",
        "function": {
          "name": "filesystem-write_file",
          "arguments": "{\"path\": \"output.txt\", \"content\": \"...\"}"
        }
      }]
    }
  }]
}

Note

The content field contains a JSON summary of executed tool results. The tool_calls array contains only the non-auto-executable tools that require your application’s review. The finish_reason is set to "stop" to exit the agent loop.

If canonical GAF denies a call, requires Command Authority approval, or cannot reach a required authorization dependency, Agent Mode aborts immediately with the structured authorization outcome. It does not feed that boundary error back to the model and continue the loop. Ordinary downstream tool errors still become tool results.

Your application then:

1. Parse the content field to see what was already executed
2. Review the pending non-auto-executable tools in tool_calls
3. Execute or reject them manually
4. Continue the conversation with results

---

Security Considerations

Caution

Be careful which tools you mark as auto-executable. Dangerous operations like write_file, delete_file, and execute_command should normally remain out of the autonomous eligibility list. Classify their Registry actions accurately so Command Authority can require an exact human approval as well.

Recommended Patterns

Safe for Auto-Execute:

• Read operations (read_file, list_directory)
• Search/query operations (search, fetch_url)
• Non-destructive information gathering

Require Human Approval:

• Write operations (write_file, create_file)
• Delete operations (delete_file, delete_record)
• Execute operations (run_command, execute_script)
• Operations with side effects (sending emails, making purchases)

Example: Safe Configuration

{
  "tools_to_execute": ["*"],
  "tools_to_auto_execute": [
    "read_file",
    "list_directory",
    "search",
    "get_weather"
  ]
}

---

Tool Execution Timeout

Individual tool executions are bounded by tool_execution_timeout:

• Default: 30 seconds
• If a tool exceeds the timeout, an error result is returned
• The agent loop continues with an ordinary timeout/tool error result
• Canonical authorization Deny, Require-approval, and unavailable outcomes abort the loop instead

Adjust the timeout (for example, to 60s) from the Settings tab under Agentic → MCP Registry.

---

Next Steps

Code Mode

Let AI write code to orchestrate multiple tools

Open →

Tool Filtering

Control tool availability per request

Open →