Controlling what an external AI agent can do
A connected AI app does not get blanket access to your files. You choose one of two levels per app, you can hide individual paths, and every write stays inside the workspace and is recorded with the app's name. When something is wrong, you can pause the app, withdraw a proposal you have not reviewed, or roll a document back to an earlier version. Nothing in the tool set can overwrite a document wholesale or delete one.
Before you start
- An app connected to MindMax.
- Two minutes in Settings → External AI, where each app has its own row and ⋯ menu.
The two levels
| Level | The app can | The app cannot |
|---|---|---|
| Read only | Search, read documents and maps, read your comments, highlights and bookmarks, read a canvas | Propose edits, add comments or cards, create files, run a long method that writes |
| Collaborate (default) | All of the above, plus propose edits, comment, create documents and canvases, run methods with its own model | Overwrite an existing document, delete a file, write outside the workspace |
Read-only connections do not see the write-oriented prompts in the host's / menu. The two levels describe what an app may reach; the three tool kinds in the agent tool reference describe what each tool does. They are not the same split.
Hiding a path. A file or folder marked Hidden from AI in the file tree is skipped by search and by every tool, on both levels. Use it for private material, drafts you do not want quoted, or a folder of large binaries that would only slow a run down. The file stays visible to you.
Where writes may land. Paths must resolve inside a workspace you have opened recently. An
absolute path outside them is refused for writing; read_document alone may read such a file, and
only for reading. See what the AI can read for the
full boundary.
What you can see while it works
| Where | What it tells you |
|---|---|
| Status bar pill | Which app is using the library right now. Open it for the last calls, a temporary pause, or disconnect |
| Sessions list | One entry per app: what it read, what it proposed, which long method it ran |
| Review card / pending proposals | Every change to an existing document, still waiting for your decision |
| Version history | Which version you, MindMax or a connected app wrote, and what changed between two of them |
| Local audit log | A record of calls kept for 30 days on this machine |
Comments and cards also carry the app's name, so a note in the margin or a branch on a canvas says who wrote it. Working with an external AI agent has the map of where each kind of result lands.
Why a host does not just write files itself
Some apps will try to use their own file-writing tool on the workspace folder. On Claude-style
hosts, MindMax registers a write guard and an AGENTS.md / .claude/CLAUDE.md note that points the
app back to MindMax's tools: create_document for new files and suggest_edits for existing ones.
That is what keeps the review gate, the quote expansion and the attribution intact. If an app
ignores it, ask for "propose the changes as suggestions in MindMax" — see
common issues.
Undoing something
| Situation | What to do |
|---|---|
| A proposal you have not reviewed | withdraw_proposal, or Withdraw on the review card — the file was never touched |
| A proposal with some good groups | Accept the groups you agree with, reject the rest; nothing is written until you accept |
| An accepted change you regret | Compare in version history and roll back to the earlier save |
| An app doing too much at once | Pause it from the status bar, or switch it to Read only |
| You are done with that app | Disconnect removes only its mindmax-desktop entry; other MCP servers are left alone |
Rejecting an edit leaves the comment thread it answered exactly where it was — you can reply and ask for another pass. Revising documents with an agent covers the review card, and working in the margin with an AI agent covers the thread.
The privacy boundary, with its costs
- The server binds to
127.0.0.1only, with a separate token per app. Nothing is uploaded to MindMax or to us, and there is no remote endpoint: a server or a phone cannot reach this library. MindMax must be running; the first tool call starts it in the background if it is not. - No MindMax model runs on this path and no credits are spent. What the app sends to its own model provider is governed by that provider's terms, as with anything else you do in that app.
- The flip side of local-only: there is no mobile or web version of this connection, and pausing or disconnecting an app stops its work immediately — a long method keeps its saved steps but will not advance until you resume it.
For the reasoning behind the missing delete tool and the review gate, see MindMax MCP and edits wait for you.
Common problems
The app cannot write anything. It is on Read only. Switch it to Collaborate in the ⋯ menu next to its row.
A file is invisible to the app. Check whether it, or a folder above it, is marked Hidden from AI.
An absolute path was refused. Open that folder as a workspace; writes must stay inside one.
A change appeared without a review card. It should not. Check the version history for a new file (a new document is created directly) versus an edit to an existing one (always a proposal), and report a host that bypassed the guard via common issues.
Next
- MindMax MCP — the local connection and its design constraints.
- Working with an external AI agent — back to the capability map.