Skip to main content

Execution modes

The execution mode determines what a Proxy account is allowed to execute on the proxy. It is selected as the Execution mode on the account and as the mode of the matching profile; the two must match.

ModeWhat it executes
ScriptA predefined script from an allowlist, with validated and escaped parameters
CommandAn arbitrary shell command sent by the package (PowerShell, cmd, or a unix shell)

Script​

In script mode, the profile defines a fixed set of scripts, each with the parameter names it accepts. A package selects a script by name and passes named parameter values; the proxy validates the script name and the parameters against the profile, escapes the values, and executes the script.

Flow of script execution: the package calls executeOnProxy with a script name and parameter values, the automator encrypts and delivers the work, and the proxy validates the work against the allowlist; allowed work is executed with escaped parameters and returns an encrypted result, while work that is not allowed is rejected without executing anything and the package receives an error

Nothing outside this allowlist can run: unknown scripts, unknown parameters, and raw commands are all rejected by the proxy. Script mode also uses the strongest encryption scheme, with tamper detection. See Security and privacy for the details.

Use script mode whenever the set of operations is known in advance. This is almost always the case for integrations. The Run scripts guide shows how to set it up.

Command​

In exec mode, a package sends the complete shell command to execute. The profile determines the shell (PowerShell, cmd, or a unix shell) and the environment the command runs in, but not what the command does. Any command the proxy's user account can run is accepted.

Flow of command line execution: the package calls executeOnProxy with a composed shell command, the automator encrypts and delivers the work, and the proxy accepts any command without an allowlist, runs it in the shell configured on the profile, and returns the encrypted result

This offers maximum flexibility at the cost of control: prefer script execution unless packages genuinely need to compose commands at runtime. The Run shell commands guide shows how to use it.