agent-toolkit

A tools provider plugin for LM Studio that gives models real filesystem access, a command executor, a JavaScript sandbox, and macOS system controls — all gated by a persistent local permission system you manage through a Python control panel.

Tools

Tool	Description
get_current_time	Current local date and time
get_model_info	Loaded model name, size, params, context length, capabilities
open_control_panel	Open the permissions GUI (macOS)
read_file	Read an entire file
read_file_lines	Read a line range — efficient for large files
write_file	Create or overwrite a file (creates parent dirs)
edit_file	Exact substring find-and-replace — preferred for code edits
edit_file_lines	Replace a line range — returns a unified diff
list_directory	List a folder, optionally recursive
create_directory	Create a directory
delete_path	Delete a file or directory
move_path	Move or rename
run_command	Execute a shell command (permission-gated)
run_javascript	Run JS/TS in a sandboxed Deno runtime (no network, no subprocess)
media_control	Play/pause/next/previous/volume/mute/status via Now Playing
get_permissions	Show the current permission policy at runtime

Permission system

All access control lives in a single file:

The plugin only reads it — never writes it. Your paths, rules, and custom system prompt never leave your machine and are never included in lms push.

Permission tiers

The same tier applies to both files and run_command:

Tier	Files	Commands
read_write	Full access	Any non-denied command; write-impact args path-checked
read	Read/list only	Read-only commands: ls, cat, grep, find, …
deny	Invisible	No commands at all

More specific path rules take priority over less specific ones:

Control panel

Tabs:

• File Manager — full filesystem tree with green/yellow/red colour coding; right-click or use the button bar to set rules
• System Prompt — custom instructions injected at the top of every new conversation
• Command Executor — enable/disable run_command, allow/deny lists with * wildcard support, system launcher commands (macOS)
• Active Rules — view and delete all configured rules

CLI helpers:

Prompt injection

On the first message of each conversation the plugin injects:

• Your custom system prompt (if set)
• Current time and loaded model info (name · size · params)
• A short tool reference and your current permission scope

On every subsequent message it injects only the current time and model name — keeping context overhead minimal.

Command executor

Disabled by default. Enable in the control panel.

Security note: run_command with an interpreter (python3, node, bash) gives the model the same power as that interpreter. The deny list prevents accidental damage but is not a sandbox. Use the allow list if you want strict control over what can run.

Media control

Requires nowplaying-cli (macOS only):

Works system-wide with any Now Playing source: browsers, Spotify, Apple Music, etc. No Accessibility permissions required.

JavaScript sandbox

Uses the bundled Deno runtime from LM Studio. Runs with:

• --deny-net --deny-env --deny-sys --deny-run --deny-ffi
• Read/write limited to an isolated sandbox directory (~/.lmstudio-toolkit/sandbox/)

Good for maths, data transformation, JSON parsing, and algorithms. Not for network requests.

Install

After installing, configure your permissions:

The plugin fails closed by default — everything is denied until you grant access.