# `PhoenixDevToolbar.Plugins.Eval`
[🔗](https://github.com/zoten/phoenix_dev_toolbar/blob/0.0.2/lib/phoenix_dev_toolbar/plugins/eval.ex#L1)

> #### Experimental {: .warning}
>
> This API may change in any 0.0.x release. Changes are listed in the CHANGELOG.

The Eval tab ([ADR 12](https://github.com/zoten/phoenix_dev_toolbar/blob/main/adr/12-cluster-and-eval-plugins.md)): read queries about the running node and, only when you
allow it, code you type, evaluated on the node. Not in `:defaults`: add it to
the toolbar's `plugins:`.

    config :phoenix_dev_toolbar,
      plugins: [:defaults, {PhoenixDevToolbar.Plugins.Eval, allow: :eval}]

Options, each with a safe default:

  * `allow:` `:read_only` (default: a fixed list of read queries, no code) or
    `:eval` (code typed in the panel runs on the node)
  * `clients:` who may run code: `:local` (default: only a browser on this
    machine, loopback or its own addresses, reaching the server directly;
    `:loopback` is accepted and means the same) or `:any` (any browser that reaches
    the dev server, Docker or LAN setups). Read queries answer any browser, like
    the System tab.
  * `timeout_ms:` how long code may run before it is stopped, 5000 by default
    (100 to 60000)

Eval is its own opt-in and does not depend on the top level `actions:` option
(kill, suspend, message peek: off by default). It is refused only when the host
sets `actions: false` explicitly.

`allow: :eval` with `clients: :any` lets anyone who reaches the dev server run
code as the BEAM user: both overrides are warned about when the toolbar
starts. See [SECURITY.md](SECURITY.md).

---

*Consult [api-reference.md](api-reference.md) for complete listing*