Directory / JetBrains Junie
JetBrains Junie
Asks before sensitive actions unless you turn on brave mode, with an allowlist file for commands, MCP tools and file access. An OS-level sandbox with a domain allowlist exists, but only in the Early Access build, so we don't score it yet.
Lock this down first
Keep brave mode Off (Ctrl+B cycles it), and allowlist only the specific commands you trust in ~/.junie/allowlist.json.
Scorecard
| Criterion | Rating | Notes |
|---|---|---|
| Permission granularity | 2/3 | allowlist.json takes allow or ask rules by prefix or glob for commands, MCP tools, edits and reads outside the project. Chained and nested commands are checked part by part. PreToolUse hooks can block a tool. No admin lock is documented. |
| Human approval gates | 2/3 | Asks for approval before sensitive actions by default (brave mode Off). Auto mode approves commands a safety check calls safe, and On approves everything. Not admin-lockable in the docs. |
| Sandboxing | Unverified | Early Access only; not scored until it ships in the stable build. The EAP sandbox (OS-level, via srt) is off by default and leaves MCP servers and hooks outside. |
| Secrets handling | 1/3 | Reading files that may contain secrets is a separate action that asks for approval unless allowlisted. Where BYOK provider keys are stored isn't documented. |
| Audit logs | 1/3 | Each session keeps a local transcript.md and events.jsonl, and /logs exports them. No central audit log. |
| Kill switch / interrupt | 2/3 | Remote mode's web UI can cancel the current task; in the terminal, Ctrl+C twice exits. A step limit is set in /settings. |
| Network egress control | Unverified | Early Access only; not scored until it ships in the stable build. The EAP sandbox has a network.allowedDomains list, and network is unrestricted by default. |
Sources
- https://junie.jetbrains.com/docs/action-allowlist-junie-cli.html
- https://junie.jetbrains.com/docs/junie-cli.html
- https://junie.jetbrains.com/docs/junie-cli-hooks.html
- https://junie.jetbrains.com/docs/slash-commands.html
- https://junie.jetbrains.com/docs/byok.html
- https://junie.jetbrains.com/docs/junie-cli-remote-mode.html
Vendor? Request a correction. We review corrections within 7 days.