diff --git a/README.md b/README.md
index dba0286..6b89900 100644
--- a/README.md
+++ b/README.md
@@ -55,6 +55,17 @@ runtime. Clone it, `pip install -e .`, run it.
   template, a secret) and a model can make it. Or add an **MCP server** by URL
   and its tools appear beside the built-in ones. Both restrictable to groups,
   and neither can be pointed at your own network unless you say so
+- **Agent chats** — start a chat as an *Agent* instead, pointed at one of your
+  own SSH connections and a directory on it, and a model can read files, write
+  files and run commands **there**. Nothing ever runs on the machine LLeMbas
+  itself is on. What it may do without asking is a mode you set and can change
+  mid-conversation: *Manual* shows you everything first, *Edit* writes freely
+  but asks before commands, *Auto* asks about nothing, and *Plan* reads freely,
+  changes nothing, and finishes by proposing steps you can carry out with one
+  button. Adding a host shows you its fingerprint before anything is sent to it
+- **It can ask you things** — a model that needs a decision can stop and put a
+  few questions on one card, with answers to pick from and a box to write your
+  own. In any chat, not only an agent one
 - **Speech in and out** — dictate a message and have replies read aloud, against
   any OpenAI-compatible audio endpoint (whisper.cpp, Speaches, Kokoro…). Each
   person picks their own voice
@@ -83,8 +94,7 @@ runtime. Clone it, `pip install -e .`, run it.
 
 **Planned**
 
-Agentic execution (local and over SSH) · image generation · OCR for scanned
-PDFs · semantic search in the library.
+Image generation · OCR for scanned PDFs · semantic search in the library.
 
 See [PLAN.md](PLAN.md) for what is built, what is not, and why.
 
@@ -95,7 +105,8 @@ git clone https://git.houmeres.sk/Houmeres/LLeMbas.git
 cd LLeMbas
 
 python -m venv .venv && . .venv/bin/activate
-pip install -e ".[dev,search]"   # `search` adds DuckDuckGo; drop it if unwanted
+pip install -e ".[dev,search,ssh]"   # search: DuckDuckGo. ssh: agent chats.
+                                     # Drop either if you do not want it
 
 cp .env.example .env
 lembas secret-key           # paste the result into LEMBAS_SECRET_KEY
@@ -141,6 +152,48 @@ Recorded audio is passed straight through and never written to disk.
 > The microphone needs HTTPS or localhost. Browsers do not grant it over plain
 > HTTP, so a LAN install without TLS will not offer dictation.
 
+### Agent chats
+
+**Admin → Agents** to turn the feature on, then **Connections** in the sidebar
+to add a machine. Three things have to line up before an agent chat can start:
+the feature enabled, the *Run commands* permission, and a model flagged **Agent
+execution**. All three are off by default, on purpose.
+
+Nothing an agent does runs on the machine LLeMbas is on. Commands go to a host
+you name over SSH, which means **the containment is that host** — a container
+built for the job is a very different thing from a key to a server you care
+about, and LLeMbas cannot tell them apart. A throwaway container is the intended
+shape:
+
+```bash
+docker run -d --name agent-box -p 127.0.0.1:2222:22 <an sshd image>
+```
+
+Adding a connection does not connect to it. **Check** shows you the host's
+fingerprint with nothing sent — not your username, not your key — and only
+accepting pins it. If that host later answers with a different key, it is
+refused rather than quietly trusted.
+
+Then start a chat with the **Agent** toggle, pick the connection and a
+directory, and choose a mode. The mode is in the chat header and changes at any
+time:
+
+| | Reads | Writes files | Runs commands |
+|---|---|---|---|
+| **Manual** | asks | asks | asks |
+| **Edit** | free | free | asks |
+| **Auto** | free | free | free |
+| **Plan** | free | asks | asks |
+
+The mode is enforced in the reply loop, not written into the prompt: everything
+a model reads — a web page, a README, the last command's output — is untrusted,
+and a rule that lives only in a system message is one a poisoned file can argue
+with. In **Auto**, nothing stands between that and a command running.
+
+*Plan* finishes by proposing steps, with a button that carries them out — which
+switches to *Edit*, never *Auto*, because the plan was written under a mode
+where every command still asked.
+
 ### The library
 
 **Sidebar → Library**, and **Settings → Memory**. Nothing is on by default for a