Crush

Coding agent (CLI) · Charm · 4/7 verified · Last checked 2026-10-16

Asks before every tool call by default. You can allow or deny tools by name, and --yolo skips all prompts. No sandbox or network control is documented.

Overall: C (1.50 avg, 4/7 controls verified)

Lock this down first

Never run with --yolo, and deny bash if the task does not need a shell.

Scorecard

Criterion	Rating	Notes
Permission granularity	2/3	Allow or deny whole tools by name, including MCP tools. No argument-level rules.
Human approval gates	2/3	Asks for permission before running tool calls by default. --yolo skips all prompts, and there's no admin lock.
Sandboxing	Unverified	Not confirmed in the docs we checked.
Secrets handling	1/3	Config can pull tokens from a password manager by shell expansion, as in the 1Password example.
Audit logs	1/3	Logs go to ./.crush/logs/crush.log; crush logs prints recent lines. General logs, not a dedicated audit trail.
Kill switch / interrupt	Unverified	Not confirmed in the docs we checked.
Network egress control	Unverified	Not confirmed in the docs we checked.

Unverified: Sandboxing, Kill switch / interrupt, Network egress control. That means we could not confirm it in public docs, not that it is missing.

Sources

https://github.com/charmbracelet/crush

Vendor? Request a correction. We review corrections within 7 days.