Permissions

Splitkick asks for no permission up front and has no permission screen. macOS asks when a feature needs access for the first time. This page lists those prompts, why they appear, and what happens when you say no.

What Splitkick is

Splitkick runs with the rights of your macOS user, like Terminal does. It is not in the App Sandbox: agents must read and write your projects and run git, the agent CLIs and your shell. The app is signed with a Developer ID, uses the hardened runtime and is notarized by Apple.

Everything that Splitkick starts runs as a child process of Splitkick: agent CLIs, git, the built-in terminal, the commands an agent runs. macOS treats Splitkick as the responsible app for all of them. When an agent touches a protected place, the prompt names Splitkick, not the agent.

Prompts you may see

Prompt	When	Why	If you say no
Notifications	The first time a session needs your input or finishes while Splitkick is in the background	Desktop banners	No banners. Turn them on later in System Settings → Notifications → Splitkick.
Keychain	When Splitkick reads the login of an agent CLI, or reads a token it stored	Usage display and login check for Claude Code and Codex; tokens for remote connections and the Playwright extension	The usage display stays empty. The agents still work: they read their own keychain items.
Files and folders	A project is in Desktop, Documents, Downloads, iCloud Drive, on a network share or on an external drive	Agents and git must read and write the project	Agents and git cannot use files there
Data from other apps	An agent, or a tool it runs, reads the data of another app in ~/Library	macOS protects the data of each app from other apps	The tool cannot read the data. The prompt can come back many times, see below.
Automation	A browser or phone on Web Access opens a terminal on the Mac, with Terminal or iTerm2 as the terminal app	Splitkick controls the terminal app to open it in the worktree	The terminal does not open. Opening a terminal from the desktop window needs no permission.
Incoming connections	You turn on Web Access with a bind address other than localhost, and the macOS firewall is on	Other devices connect to Splitkick	Other devices cannot connect. On localhost nothing changes.
Administrator password	An update cannot replace the app in Applications, for example because another user installed it	Replace the old app with the new one	The update is not installed

Notifications

Splitkick sends a banner only while it is in the background, when a session waits for you or finishes. You can turn banners off in Settings → General → Notifications ("Desktop notifications").

• Click the notification of a session that needs your input, finished or failed: Splitkick opens that session.
• When a session needs your input while Splitkick is in the background, the Dock icon bounces once.
• On Windows, a click on a notification restores and focuses the Splitkick window. It does not open the session.

Keychain

Claude Code and Codex keep their logins in your login keychain. Splitkick reads the item Claude Code-credentials for the usage display and as a fallback login check. For Codex it reads Codex Auth only when ~/.codex has no login file, and writes the item back after Codex refreshes its token.

Splitkick uses the macOS security tool for this, so the dialog may name security instead of Splitkick. Select Always Allow if you do not want to see the dialog again.

Splitkick also stores tokens of its own in the login keychain:

Keychain item (service)	Content
Splitkick remote connection token	The access token of each remote connection, one item per connection
Splitkick Playwright extension token	The connection token of the Playwright extension, for the browser engine "Playwright with your Chrome". See Browser for agents

The account of each item starts with the path of Splitkick's data folder. So the installed app and another build never share an item.

Tokens never appear on a command line, so ps does not show them. Splitkick gives each Claude run its MCP config as a private file and deletes the file when the run ends. The Playwright extension token reaches Playwright only through its environment.

Files and folders

macOS protects Desktop, Documents, Downloads, iCloud Drive, network shares and external drives. Worktrees go to ~/splitkick/<project name>/ by default, which is not protected; see Files on disk. The prompt appears only for projects that are in a protected place, and for agents that read files there.

Splitkick removes external drives (/Volumes/...) from the PATH it gives to agents, so that a mounted disk image or USB drive in your PATH does not cause a prompt on every start.

Data from other apps

macOS asks "“Splitkick” would like to access data from other apps" when a process reads the data of another app, for example in ~/Library/Application Support/<other app> or ~/Library/Group Containers/. Splitkick itself does not do this; the agents and the tools they run do (op, git, ssh, ls and many more).

macOS keeps this permission for each program that asks, not for Splitkick as a whole. A new tool is a new program, and system tools such as /bin/ls cannot keep the permission at all. So Allow does not stick, and the dialog can come back many times in a session. If this happens to you, Full Disk Access stops it.

Automation

Agents can run osascript and control other apps. macOS then asks whether Splitkick may control that app, because Splitkick is the responsible app. Allow it only if you know what the agent wants to do. You can remove the permission in System Settings → Privacy & Security → Automation.

Command Line Tools

On a Mac without the Xcode Command Line Tools, the first git call shows the macOS install dialog. This comes from macOS, not from Splitkick. See Install.

What Splitkick never asks for

Accessibility, Screen Recording, Microphone, Camera, Contacts, Calendars, Location and login items. Onboarding does not ask for Full Disk Access; it is an opt-in setting, see below.

Full Disk Access

Splitkick does not need Full Disk Access. Not giving it is the recommended default. Onboarding does not ask for it. Give it only when your agents must read data that macOS protects for all apps.

What it does

Full Disk Access lets an app read places that other permissions do not cover: Mail, Messages, Safari, Time Machine backups, the data of other apps and some system settings. Without it, macOS does not ask: the read fails with "Operation not permitted".

When you give Full Disk Access to Splitkick, everything that Splitkick starts gets it too: every agent, every command an agent runs and the built-in terminal.

When it can help

• The dialog "would like to access data from other apps" comes back again and again. Full Disk Access and a restart of Splitkick stop it.
• An agent works with data from other apps, for example it archives mail from ~/Library/Mail or reads a Notes or Messages database in a non-code project.
• Your projects are in protected folders and you get many folder prompts.
• An agent command fails with "Operation not permitted" on a path in ~/Library.

The risk

An agent with Full Disk Access can read your mail, messages and browser data. A prompt injection, for example text in a web page or an issue that the agent reads, can make it do that. In Yolo mode it does not ask you before it runs a command, so it can also send the data out. Give Full Disk Access only if you trust the agents and modes you use. If a project in a protected folder is the only problem, move the project to a normal folder instead.

Turn it on

The quickest way is in Splitkick:

1. Open Settings → General and go to the section Full Disk Access (macOS). It shows whether this session has Full Disk Access, and explains the risk.
2. Click Open System Settings. In the Full Disk Access list, turn on Splitkick. If it is not in the list, add it with + (see step 2 below).
3. Click Relaunch now. macOS applies the permission only after Splitkick starts again.

You can also do it in System Settings only:

1. Open System Settings → Privacy & Security → Full Disk Access.
2. Click +, select Splitkick in Applications and click Open. If Splitkick is already in the list, turn it on.
3. Quit Splitkick (⌘Q) and start it again. This step is necessary: the running app keeps its old permissions until it quits, also after you turn on Full Disk Access.

To check it, run this in the built-in terminal:

ls ~/Library/Mail

Without Full Disk Access the result is "Operation not permitted". With it you see the mail folders.

Turn it off

Turn Splitkick off in the same list, or select it and click −. Then restart Splitkick.

Terminal has its own permissions

An agent that you start in Terminal, iTerm2 or another terminal app uses the permissions of that app, not those of Splitkick. Full Disk Access for Terminal does not give it to Splitkick, and the other way around.

Reset all permissions

To see all prompts again, quit Splitkick and run:

tccutil reset All app.splitkick.desktop

This removes the permissions that you gave to Splitkick. Check Full Disk Access in System Settings afterwards: turn it off there if it is still on.