PhoenixDevToolbar.Plugins.Eval (PhoenixDevToolbar v0.0.2)

The Eval tab (ADR 12): read queries about the running node and, only when you allow it, code you type, evaluated on the node. Not in :defaults: add it to the toolbar's plugins:.

config :phoenix_dev_toolbar,
  plugins: [:defaults, {PhoenixDevToolbar.Plugins.Eval, allow: :eval}]

Options, each with a safe default:

• allow: :read_only (default: a fixed list of read queries, no code) or :eval (code typed in the panel runs on the node)
• clients: who may run code: :local (default: only a browser on this machine, loopback or its own addresses, reaching the server directly; :loopback is accepted and means the same) or :any (any browser that reaches the dev server, Docker or LAN setups). Read queries answer any browser, like the System tab.
• timeout_ms: how long code may run before it is stopped, 5000 by default (100 to 60000)

Eval is its own opt-in and does not depend on the top level actions: option (kill, suspend, message peek: off by default). It is refused only when the host sets actions: false explicitly.

allow: :eval with clients: :any lets anyone who reaches the dev server run code as the BEAM user: both overrides are warned about when the toolbar starts. See SECURITY.md.