Directory / Qwen Code
Qwen Code
Approval modes from read-only Plan to YOLO, permissions.deny to block tools, and an opt-in execution sandbox using bubblewrap or Landlock with network closed. The default mode lets a classifier approve actions.
Lock this down first
Switch the approval mode to Ask Permissions and enable tools.executionSandbox with network set to closed.
Scorecard
| Criterion | Rating | Notes |
|---|---|---|
| Permission granularity | 3/3 | permissions.deny blocks tool calls at runtime; tools.disabled removes tools from the registry. |
| Human approval gates | 1/3 | Ask Permissions mode is opt-in. The default Auto mode uses an LLM classifier, not a human, to approve actions. |
| Sandboxing | 2/3 | Off by default. executionSandbox supports workspace-write filesystem limits via bwrap or Landlock; Docker and Podman are also supported. |
| Secrets handling | 1/3 | Settings can reference keys from env vars. excludedEnvVars keeps variables out of project context. |
| Audit logs | 2/3 | OpenTelemetry qwen-code.tool_call events for each tool call. |
| Kill switch / interrupt | 2/3 | Esc cancels an ongoing request. |
| Network egress control | 2/3 | Off by default. When the execution sandbox is on, network can be closed; Landlock can't enforce that, so it needs bwrap. |
Sources
- https://qwenlm.github.io/qwen-code-docs/en/users/configuration/settings/
- https://qwenlm.github.io/qwen-code-docs/en/users/features/approval-mode/
- https://qwenlm.github.io/qwen-code-docs/en/users/features/sandbox/
- https://qwenlm.github.io/qwen-code-docs/en/developers/development/telemetry/
- https://qwenlm.github.io/qwen-code-docs/en/users/reference/keyboard-shortcuts/
- https://qwenlm.github.io/qwen-code-docs/en/users/configuration/trusted-folders/
Vendor? Request a correction. We review corrections within 7 days.