nanny.toml reference

# ── Start ─────────────────────────────────────────────────────────────────────

[start]
cmd = "python agent.py"   # required, the command nanny run executes

# ── Tools ─────────────────────────────────────────────────────────────────────

[tools]
allowed = ["web_search", "send_outreach"]   # empty list denies every tool call

# Per-tool configuration. The name must match the function name in code.
[tools.web_search]
max_calls       = 30      # most calls allowed in one run
reads_untrusted = true    # ingests content you do not control

[tools.send_outreach]
external_effect = true    # acts on the outside world

# ── Rules ─────────────────────────────────────────────────────────────────────

[rules]
extends = ["nanny:recommended@1.0.0"]   # installed with nanny rules add

# ── Observability ─────────────────────────────────────────────────────────────

[observability]
log  = "stdout"   # "stdout" | "file": "file" writes to .nanny/logs/log.ndjson
# file = "events"   # optional, bare name only, no extension: see below

# Cloud sync isn't a config field. It turns on for any machine that sets
# the NANNY_API_KEY environment variable. There is no endpoint or key here.

[tools.web_search]
max_calls       = 30
reads_untrusted = true

[rules]
extends = ["nanny:recommended@1.0.0", "nanny:owasp@1.0.0"]