Poolside pool
A coding agent that runs in your terminal or any ACP-compatible editor, reviewing and editing code and automating dev tasks.
Evidence shows default approval, risk-tiered Auto mode, deny-overrides-allow, read-only path defaults, mandatory review to leave Plan mode, and hooks explicitly documented as not a security boundary with fail-open behavior — real design, but hooks run shell commands without approval and fail open, a concrete deduction.
README documents classifier failure behavior, hook timeout/parse handling, and env-var fallback for credential-less environments; internally consistent but purely textual, no tests or code in scope, hence moderate.
Multiple run modes (terminal, ACP server/client, exec), multiple backends (OpenRouter, Ollama, OpenAI-compatible), three permission scopes, Windows preview — strong environment fit; trigger precision and Auto classifier internals are deferred to external docs.
Table of contents, install, and config reference are thorough; but the license is a proprietary EULA link only with unknown metadata, and there is no version number, changelog, or maintenance statement in scope; attribution is brand-level only.
Output formats (), session management, /usage accounting, and rewind are described; value proposition is clear but differentiation and cost data are absent.
Key claims (permissions/classifier details) resolve to docs.poolside.ai outside the repository and cannot be verified statically; README and LICENSE are consistent and facts are generally separable from inference.
- Hooks execute shell commands automatically without approval and fail open; the docs themselves state they are not a security boundary — do not rely on hooks for enforcement.
- Auto approval mode depends on an external classifier model; misclassification could auto-approve high-risk actions. The `--unsafe-auto-allow` flag bypasses all approvals in non-interactive mode and should only be used in controlled environments.
- The license is a proprietary EULA with unknown repository metadata; review poolside.ai/eula before commercial use.
- Permission wildcards support only `*`; composite shell commands always require manual approval. Configure explicit deny rules for sensitive paths (~/.ssh, .env).
- Key safety details (classifier inputs, failure behavior, sandboxing) live in external docs at docs.poolside.ai and were not verifiable in this static review.
What does this agent do, and when should you use it?
pool is Poolside's official coding agent that runs as an interactive TUI in your terminal or as an ACP (Agent Client Protocol) server via `pool acp`, integrating with editors like Zed, JetBrains, and Xcode. It offers four run modes: standalone terminal app, ACP server, ACP client driving other agent servers (`pool --agent-server`), and the non-interactive `pool exec` for scripts and CI. The agent ships four approval tiers (Always ask through Allow all), Build/Plan modes, hooks at six lifecycle events, subagent delegation, and tool/path allow-deny permission rules. It integrates with open agent specs — AGENTS.md, Skills, MCP, and ACP — and can use OpenRouter, Ollama, or any OpenAI-compatible API as its model backend. Configuration lives in `~/.config/poolside/settings.yaml` with global and per-project scopes.
pool reads AGENTS.md files from your project for context and instructions, accepts prompts in an interactive TUI, and performs file reads/writes and shell commands via tool calls. pool acp exposes an ACP server supporting session/list, session/load, session/set_config_option, and the poolside/session_steer capability; pool --agent-server can drive third-party ACP servers such as claude-agent-acp or codex-acp, and remote ACP agents over streamable HTTP transport. pool exec -p "..." -o runs a single prompt non-interactively and emits JSON output. pool mcp add/list/get/remove manages MCP servers over stdio, HTTP, and SSE transports; Auto approval mode uses a configurable classifier model (auto_mode_classifier or POOL_AUTO_MODE_CLASSIFIER_MODEL) to triage permission requests by risk. Hooks run shell commands at PreToolUse, PostToolUse, UserPromptSubmit, Stop, PreCompact, and SessionStart events, and can inspect or rewrite tool calls and prompts.
- Quick code review or refactoring in the terminal: run
poolin a project, fuzzy-search files with@, and enter read-only planning with/plan. - Editor users: point Zed or JetBrains ACP configuration at
pool acpfor session persistence and mid-turn steering. - Developers wanting one TUI for multiple agent backends: connect Claude or Codex via
pool --agent-server claude-agent-acp. - CI or security engineers: run
pool exec -p "scan cmd/cli code for vulnerabilities" -o --unsafe-auto-allowin a pipeline. - Local/private model users: drive pool through Ollama (
ollama launch pool) or an OpenAI-compatible endpoint such as llama.cpp or vLLM. - Teams needing enforced permission boundaries: configure tool wildcard and path read/write allow/deny rules in
.poolside/settings.yaml.
What are this agent's strengths and limitations?
- Four run modes — TUI, ACP server, ACP client, and non-interactive
pool exec— cover both interactive and automation use cases - Highly open model backend: native support for OpenRouter, Ollama, and any OpenAI-compatible API (llama.cpp, vLLM, etc.)
- Fine-grained permission system: tool wildcard rules and path read/write rules across three scopes, with deny overriding allow
- Hooks and subagents (including the zero-config
generalsubagent) enable context-isolated delegation and lifecycle automation
- Hooks are not a security boundary: they run without approval prompts and fail open, so enforcement must rely on permissions and sandboxes
- Auto approval mode requires configuring a separate classifier model, adding setup cost
- Returning from Plan to Build mode always requires review, even under Allow all approval
- Default reliance on Poolside platform credentials (
pool login/ POOLSIDE_API_KEY); offline or account-less setups must switch to a third-party backend - License details are not stated in the README itself; you must check LICENSE.md
How do you install or deploy this agent?
Linux/macOS: curl -fsSL https://downloads.poolside.ai/pool/install.sh | sh. Windows (preview): irm https://downloads.poolside.ai/pool/install.ps1 | iex. To update, exit any session and run pool update; startup also prompts when a newer version exists. First use requires pool login (e.g., OpenRouter account), or set POOLSIDE_API_KEY and POOLSIDE_STANDALONE_BASE_URL in credential-less environments.
How do you use this agent?
Run pool in any project directory for interactive mode; pool -h lists all options. In-session: / slash commands, @ fuzzy file search, ! shell mode, double esc to rewind, Shift+Tab to cycle approval modes, /plan for Plan mode. Editor integration: set ACP config to {"command": "pool", "args": ["acp"]}. Connect other backends: pool --agent-server codex-acp, or configure remote HTTP ACP agents under agent_servers in settings.yaml. Non-interactive: pool exec -p "prompt" -o . Manage MCP: pool mcp add filesystem -- node filesystem-server.js.
How does this agent compare with similar options?
The README positions pool's ACP client mode alongside ACP servers like Claude Agent (claude-agent-acp) and Codex (codex-acp): pool's TUI can drive those backends directly, or they can replace pool entirely; pool's differentiators are its dual ACP server/client architecture plus built-in approval modes, hooks, and subagents.
FAQ
What model backend does pool use by default?
pool login connects to the Poolside platform (inference endpoint https://inference.poolside.ai). You can instead use OpenRouter, Ollama, or any OpenAI-compatible API via the POOLSIDE_STANDALONE_BASE_URL, POOLSIDE_API_KEY, and POOLSIDE_STANDALONE_MODEL environment variables.Will tool actions run without confirmation?
accept-edits, auto, or always-allow; Auto mode triages by risk (low-risk runs immediately, high-risk opens the approval dialog).Can it run unattended in CI?
pool exec -p "..." -o with --unsafe-auto-allow, and set POOLSIDE_API_KEY and base URL environment variables in credential-less environments.Can hooks be used as a security control?
pool acp --sandbox required) for enforcement.How do I connect remote or third-party agents?
pool --agent-server <command> for local ACP servers (e.g., codex-acp), or configure a remote streamable-HTTP endpoint with URL and custom headers under agent_servers in settings.yaml, then connect with pool -s remote.