Control

How the profile + capability system works, and the full CLI control surface — flags, env vars, config files, slash commands.

How it works

Erosolar is a single binary with a profile selection at startup. The profile picks the system prompt, the default model, and — most importantly — the tool inventory the agent sees. There are three profiles:

Capability gating is enforced in code. The default coding profile cannot load offsec tools — even if a configured MCP server tries to surface them. The hardening tests at test/v1.5-capability-gating.test.ts + test/capability-separation.test.ts fail CI on any regression.

Selecting a profile

Two ways, in priority order:

erosolar --profile variant-research            # explicit flag
EROSOLAR_PROFILE=variant-research erosolar     # env var
erosolar                                       # default → erosolar-code

Per-profile env overrides

Each profile has its own env namespace formed by uppercasing the profile name. Override the model, provider, or system prompt without recompiling:

If the model env hints at a different provider than the explicit provider env, the model wins. The CLI emits a "modelLocked" / "providerLocked" status badge so it's visible in /status.

Slash commands

In-session control. Top of the inventory:

Config files (project-local under .erosolar/)

MCP server tenant-mount example

An offsec MCP server that should only mount for the variant-research / engagement-delivery profiles:

{
  "mcpServers": {
    "kali-server": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-mcp-kali-server"],
      "profiles": ["variant-research", "engagement-delivery"]
    },
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"]
    }
  }
}

The github server has no profiles field — it mounts for all profiles (back-compat default). The kali-server only surfaces for the offsec profiles, so a default coding session never sees its tools even if the config is present.

Hooks

Shell-command hooks fire around tool execution and session lifecycle. Same contract as Claude Code: the command receives a JSON envelope on stdin, can pass through, block, or shape the result via JSON on stdout. Configured in .erosolar/settings.json:

{
  "hooks": {
    "PreToolUse": [
      { "matcher": "Bash",
        "hooks": [{ "type": "command", "command": "/path/to/audit-bash.sh" }] }
    ],
    "PostToolUse": [
      { "matcher": "Edit|Write",
        "hooks": [{ "type": "command", "command": "/path/to/lint-after-edit.sh" }] }
    ],
    "SessionStart": [
      { "hooks": [{ "type": "command", "command": "/path/to/session-banner.sh" }] }
    ]
  }
}

Hooks are best-effort: timeout / error / malformed JSON is logged and skipped, never crashes the agent.

Diagnostic env vars

Read next