Zed Agent

Coding agent (IDE) · Zed Industries · 5/7 verified · Last checked 2026-10-16

Regex-based allow, deny and confirm rules per tool and MCP tool, with confirm as the default. Hardcoded rules block rm -rf on root and home. Untrusted worktrees open in Restricted Mode.

Overall: B (2.20 avg, 5/7 controls verified)

Lock this down first

Keep tool_permissions.default on confirm and add always_deny patterns for commands you never want run.

Scorecard

Criterion	Rating	Notes
Permission granularity	3/3	always_allow, always_deny and always_confirm regex rules per tool, including mcp:<server>:<tool>. Chained shell commands are checked piece by piece.
Human approval gates	3/3	The docs list default as "Fallback when no patterns match: "confirm" (default), "allow", or "deny"". always_confirm and deny rules still apply when the global default is allow.
Sandboxing	Unverified	Not confirmed in the docs we checked.
Secrets handling	2/3	Provider API keys saved through Zed go in the system keychain, not settings.json.
Audit logs	Unverified	Not confirmed in the docs we checked.
Kill switch / interrupt	2/3	A stop button interrupts the agent immediately.
Network egress control	1/3	fetch rules match URLs. Terminal commands are not network-restricted.

Unverified: Sandboxing, Audit logs. That means we could not confirm it in public docs, not that it is missing.

Sources

Vendor? Request a correction. We review corrections within 7 days.