> ## Documentation Index > Fetch the complete documentation index at: https://docs.devin.ai/llms.txt > Use this file to discover all available pages before exploring further. # Local Hands for Devin Cloud Sessions > Let a Devin cloud session run commands and edit files on your own computer through Devin Desktop or devin connect, with your approval for each tool call. Local Hands (local machine access) let a Devin cloud session run commands and work with files on your own computer. Use them when the task needs something that exists only on your machine: a local checkout with uncommitted changes, a device on your network, a tool that needs your VPN, or logs from a local build. Your computer does not replace the session's VM. Devin keeps its VM and gets a second set of tools that run on your machine. The two machines have separate files, working directories, and environments; Devin moves data between them only through tool calls that you approve, such as a file copy. > [!NOTE] > > Local Hands are rolling out gradually. If you don't see the **Local Hands** setting, the feature is not yet available to your organization. > [!NOTE] > > **Local Hands** is the name of the feature; the access card and the toasts describe it as **local machine access**. The session header shows a connected machine as **Local Hands**. Local Hands are not [Devin Connect](/enterprise/deployment/devin-connect), which gives Devin access to private networks. ## How it works **1. Devin requests access** When a task needs your machine, Devin posts a **Local machine access requested** card in the session. The card gives the reason and the time the request expires. In Devin Desktop it shows an **Approve** button; in the browser it shows a `devin connect` command with a pairing code. You can also ask for this directly, for example "run the tests on my local machine". **2. You connect your machine** Approve the request on the machine you want Devin to use: click **Approve** in Devin Desktop, or run `devin connect` in a terminal. See [Connect your machine](#connect-your-machine). **3. Devin uses the local tools** Devin's local tools become available and the header shows the **Local Hands** chip. You approve each tool call unless you turn on [bypass](#bypass-local-permissions). **4. The connection ends** The connection ends when you revoke access, stop `devin connect`, close the Devin Desktop window that approved the request, or the session ends. The local tools go away with it. ## Requirements * A cloud session that you own. Devin issues the pairing code to the session owner's account, so another person who views the session cannot connect their machine. Sessions with no user to approve access, such as scheduled sessions, automations, and API sessions run by a service user, cannot request a machine. * The [Devin CLI](/cli) or [Devin Desktop](/desktop/introducing-devin-desktop) on the machine you connect, signed in with the same Devin account that owns the session. For the CLI, run `devin auth login`. * The **Local Hands** setting on for your organization. See [Availability](#availability). ## Connect your machine The simplest way is Devin Desktop: open the session there and click **Approve**. If you work from a browser, run the `devin connect` command from the card in a terminal on the machine you want to connect. A request is single-use and expires 10 minutes after Devin makes it. A new request replaces an older one, and the older pairing code stops working. **Devin Desktop** Open the session in Devin Desktop. The card shows **Approve** and **Decline**. Click **Approve** to connect the machine Devin Desktop runs on. No pairing code or terminal is needed. If you prefer the CLI, click **Use the terminal instead** to show the command. **Terminal** Copy the command from the card and run it on the machine you want to connect: ```bash theme={null} devin connect ``` Running the command is the approval. There is no second prompt. The command stays in the foreground, prints each tool call Devin makes, and keeps the connection open until the session ends or you press `Ctrl+C`. **devin --cloud** A cloud session that you opened with [`devin --cloud`](/cli/cloud) connects the terminal's machine automatically when Devin requests access. Each tool call still needs your approval. If the request expired, click **Connect this machine** on the card in Devin Desktop, or **Request a new code** in the browser. ### Session privacy When you connect a machine to a session you own, Devin makes the session private: only you can send it messages. This stops other people in your organization from steering a session that can run commands on your computer. To leave the session's privacy unchanged, pass `--public`: ```bash theme={null} devin connect --public ``` ## What Devin can do on your machine Devin can run shell commands, read and search files, create and edit files, and copy files between your machine and the session's VM. Devin has no screen, keyboard, or mouse control on your machine. [Computer use](/work-with-devin/computer-use) applies to the session's VM only. ## Approvals By default, every local tool call stops and asks you. The session shows the tool and its arguments with three choices: * **Allow once**: run this call. * **Allow for this session**: run this call, and later calls of the same tool, without a prompt until the machine disconnects. * **Deny**: reject this call. Devin sees the denial and can try a different approach. Your Devin CLI [permission rules](/cli/reference/permissions) also apply to local tool calls. An `allow` rule runs a matching call without a prompt, a `deny` rule blocks it, and an `ask` rule makes it prompt each time. This includes rules that your organization sets in [Team Settings](/cli/enterprise/team-settings). ### Bypass local permissions To stop the per-call prompts, click **Bypass local permissions** on the access card or in the **Local Hands** menu. Local tool calls then run without a prompt until the machine disconnects. Pending requests are approved immediately. To start every connection in bypass, set [`local_tools_bypass_permissions`](/cli/reference/configuration/config-file#local_tools_bypass_permissions-user-only) in your Devin CLI config. When you turn bypass on or off from the session, the CLI updates this setting. > [!WARNING] > > With bypass on, Devin can run commands and change files on your computer without asking. Use it only for sessions and tasks you trust. ### Calls that always ask Built-in rules make some calls ask every time, even with bypass on. **Allow for this session** and your own `allow` rules do not approve them either. They cover credential files and private keys, privilege escalation, destructive commands, shell interpreters, secret stores, and writes to shell profiles and Git config. The approval card says why a call needs explicit approval. Your `ask` rules and your organization's `ask` rules behave the same way. ## Disconnect or revoke access * **Revoke access**: click **Revoke access** on the access card or in the **Local Hands** menu. Devin loses the local tools immediately. * **Stop the CLI**: press `Ctrl+C` in the terminal that runs `devin connect`. * **Close Devin Desktop**: the connection ends when you close the Devin Desktop window that approved the request, or quit Devin Desktop. * **End the session**: the connection closes when the session ends. `devin connect` reconnects by itself after a short network loss. When the machine stays offline or you stop the command, the chip shows the machine as disconnected. To connect again, ask Devin to request access again and use the new code. ## Availability Organization admins control this feature with the **Local Hands** toggle in [**Settings > Devin**](https://app.devin.ai/settings/devin). The toggle is on by default for organizations that are not part of an enterprise, and off by default for organizations in an enterprise. Local Hands are not available when: * The session uses a [security profile](/product-guides/security-profiles). * [Native deployments](/product-guides/deployment-capabilities) are off for your organization. * The session has no user to approve access (scheduled sessions, automations, and service-user API sessions). ## Troubleshooting | Symptom | What to do | | - | - | | The card says the request expired | Click **Request a new code** (or **Connect this machine** in Devin Desktop) | | The card says a newer request replaced this one | Use the command on the newest card | | Devin Desktop says to sign in on this machine | Sign in to Devin in Devin Desktop, or run the `devin connect` command in a terminal | | `devin connect` says local tools require a Devin account | Run `devin auth login` and sign in with Devin | | The card has no **Approve** button in the browser | A browser cannot run tools on your machine. Run the `devin connect` command in a terminal, or open the session in Devin Desktop. | | A call asks again after you turned on bypass | It is one of the [calls that always ask](#calls-that-always-ask) | ## Related resources > **[Devin Cloud in the CLI](/cli/cloud)** > > Start and steer cloud sessions from your terminal > **[CLI permissions](/cli/reference/permissions)** > > Write allow, ask, and deny rules for tool calls > **[Hand off to cloud Devins](/work-with-devin/devin-handoff)** > > Move a local task to a cloud session > **[Computer use](/work-with-devin/computer-use)** > > How Devin uses the desktop of its own VM This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.