> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hypercubic.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tools

> Hopper's agent can read, write, compile, submit, install, and deploy on a real mainframe. Its approval model holds destructive actions until you confirm them.

## Read-only vs. mutating

Every agent action is one or the other:

| Type          | Examples                                                                         | Approval                     |
| ------------- | -------------------------------------------------------------------------------- | ---------------------------- |
| **Read-only** | List members, read a member, read a screen, query a snapshot                     | Runs without asking          |
| **Mutating**  | Write a member, submit a job, send keys to the terminal, install a CICS resource | Pauses for explicit approval |

Read-only actions execute the moment the agent calls them. Mutating actions stop in chat with an approval card you must approve or reject.

## Why approval is per-action

There is no session-level "auto-approve" toggle. Every mutating action requires its own approval, because "always approve writes" is fine for a source-code edit and dangerous for a production VSAM update.

## Hidden-field redaction

When the agent reads a TN3270 screen, hidden fields (passwords, sensitive inputs) are replaced with placeholders before the screen content reaches the agent.

* The agent receives `***HIDDEN_8***` instead of an 8-character password. {/* TBD: confirm placeholder format */}
* Chat history records the placeholder.
* Telemetry, if enabled, records the placeholder.

The redaction runs inside Hopper before the data crosses any boundary. A UI bug cannot leak a hidden-field value.

## Credentials don't reach the AI

The agent never sees raw credentials. CICS user/passwords and FTP passwords live in your OS keychain. When the agent emits an action that needs them, Hopper substitutes the real values *after* the model has produced the call:

* The agent emits an action like "sign on to CICS as `${CICS_USER}` with password `${CICS_PASSWORD}`".
* Hopper substitutes the placeholders from your keychain before the action runs.
* The actual credentials never enter the model's context.

A chat transcript shared with us, or an exported conversation file, contains no credentials.

## Approve carefully

A few patterns worth pausing on:

* **A PDS member name you don't recognize.** The agent can imagine member names. Verify the member exists, or that you intended to create it.
* **A JCL job with a `CLASS` you don't normally use.** Wrong class can route to a slow or restricted JES queue.
* **CICS resource installs and refreshes.** These mutate live state.
* **Bulk manifest deploys.** Read the manifest before approving.

If you're unsure, reject with feedback. The agent will explain or revise.

## Where to read next

<CardGroup cols={2}>
  <Card title="The AI agent" icon="robot" href="/core-concepts/the-ai-agent">
    The turn loop, attached context, and how the agent thinks.
  </Card>

  <Card title="Security & privacy" icon="lock" href="/resources/security">
    What's stored, what's redacted, what leaves your laptop.
  </Card>
</CardGroup>