One line in Takopi's config decides what Claude Code can touch

Takopi puts your coding agents in Telegram. It's a bridge for Claude Code, Codex, opencode and Pi: you message it from your phone, it runs the agent on your machine, and it streams back what the agent is doing. It handles several projects and branches at once, and you can pick a session back up in the terminal.

Because nobody is at the terminal, Takopi runs Claude Code in headless mode. In that mode, Claude Code can't stop and ask you about a tool. It only uses the tools it was told it could use up front. That list turns out to matter a lot.

We connected Takopi to Swytchcode, which runs the agent's API calls with your keys and holds every write for your approval. On the first try, nothing worked, and the wrong things did.

Two problems, one setting

By default, Takopi lets Claude Code use four tools: Bash, Read, Edit and Write. Swytchcode's tools aren't on that list. That caused two problems at once.

Swytchcode didn't work. Every call came back refused, with Claude Code saying it hadn't been given permission. In headless mode, there's no one to ask, so the answer is always no.

The shell did work, too well. Bash, which was allowed, renamed the approval rule in a copy of Swytchcode's rules file. Read printed the token the agent uses to reach Swytchcode. Rules only help if the agent can't edit them, and here it could.

One line in ~/.takopi/takopi.toml fixed both:

[claude]
allowed_tools = ["mcp__swytchcode"]

Here's what changed:

What the agent tried

Takopi's default

With the setting

Call a Swytchcode tool

Refused, not allowed

Works

Check a Stripe balance

Never reached Swytchcode

Runs straight away

Make a write call

Never reached Swytchcode

Held for your approval

Edit the rules file with Bash

Worked

Refused outside the project folder

Read the Swytchcode token

Worked

Refused outside the project folder

Edit its own Claude Code settings

Refused

Refused

We tried the usual ways out: absolute paths, cd .., ../. All refused. With the setting in place, all seven of our checks passed, and the rules file was unchanged at the end.

So keep the Swytchcode project outside the folders Takopi works in. If you add Bash or Edit back to allowed_tools for coding work, check again that they can't reach it.

Set it up

You need a Swytchcode account. Approvals need the Business or Enterprise plan. On the Takopi machine:

npm install -g swytchcode
swy init --operator --editor=none --project ~/agent-swy
swy login
swy mcp serve --profile operator --project ~/agent-swy --transport http -d
swy mcp token

In each project folder Takopi works in, add the server and the skill:

claude mcp add --transport http swytchcode http://127.0.0.1:5476/mcp --header "Authorization: Bearer <token>"
mkdir -p .claude/skills
cp -R ~/agent-swy/agent-skill/swytchcode-operator .claude/skills/

Then add the allowed_tools line above to ~/.takopi/takopi.toml. Run Takopi's setup wizard first: takopi config set needs the file the wizard writes. Our docs page for any other agent covers connecting your first app.

One warning. Takopi has a dangerously_skip_permissions option. Turning it on undoes all of this, because every tool runs. If you need it, use the deny rules and sandbox settings we wrote up for TinyAGI instead.

What we didn't test

We tested Takopi 0.23.4 with Claude Code, by calling its Claude runner directly with a scripted model and a mocked Stripe. That's the same code its Telegram bridge runs for each message, but we didn't run the bot itself.

We also didn't test the Codex engine. Reading Takopi's code, it accepts every command and file change Codex asks to make, so it would need its own lock-down.

Headless means the list is the rule

With a person at the keyboard, Claude Code asks before it does something new. Headless, it can't ask, so the allowed list is the only rule there is. Whatever's on it runs, and whatever isn't, doesn't.

That makes Takopi's default worth a second look for anyone, not just Swytchcode users. Before you message your agent from your phone, open takopi.toml and decide what's on the list.