New in Bob: Your editor, your policies, your audit trail
Admins can now enforce Bob's configuration centrally and stream its audit events into the security platform they already run. Developers get Bob as a first-class agent in the editor or orchestrator they already use, lifecycle hooks that can be enforced rather than remembered, and answers grounded in IBM's own product documentation.
Group policies: enterprise governance for Bob
IT and security admins can now set and lock Bob's configuration across managed developer machines, so company standards hold without each developer getting it right. Your existing device management infrastructure distributes the policies: ADMX/ADML templates for Windows Group Policy, mobile device management on macOS, a policy file on Linux. Locked settings appear read-only, the same way VS Code marks policy-managed settings.
Launch policies cover the settings that come up first in a security review. Disabling auto-approval groups stops the agent green-lighting its own tool calls. Disabling auto-updates keeps the deployed version under change control. Enforcing hooks centrally means a required check cannot be switched off. IBM publishes configuration templates and documentation to get started.
Native Agent Client Protocol support
Bob Shell now speaks the Agent Client Protocol (ACP) natively, so any ACP-compatible client can run Bob as a first-class agent — IntelliJ, Neovim, and Zed alongside the Bob IDE extension. Session management, modes, streaming, Model Context Protocol (MCP), and guardrails all come through the protocol itself, with no adapter in the middle.
The reach goes past editors. ACP clients also include the agent orchestrators enterprises are already building for themselves, which changes the adoption question. Bob does not have to replace an existing workflow. It can run as one agent inside it.
The following video shows Bob running as an agent inside IntelliJ through ACP.
MCP Elicitation
MCP tools can now ask for the information they need to complete a task, directly within the session. When a tool call is missing a required value — a username, a preference, a configuration parameter — the tool prompts with a brief inline form rather than failing or proceeding on a guess. The developer reviews, edits, and accepts or declines before the tool proceeds.
The practical effect is that MCP tools can handle incomplete input gracefully without requiring the developer to anticipate every parameter upfront or retry after a failed call.
Hooks
An agent loop is non-deterministic by nature. Hooks are how you put deterministic rails around it. Teams can now trigger automated actions at defined points in the loop — SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Stop — so a linter runs before a task starts, tests run after a change lands, and a cleanup script runs when something errors.
A PreToolUse hook can block a tool call outright, making a coding standard a hard constraint the agent cannot bypass. Group policies enforce hooks centrally, so a project cannot quietly disable one. Violations surface at write time rather than in a review three sprints later.
You define hooks per project and enable or disable them independently. Hook commands run under workspace trust, and a failing hook won't halt Bob unless it's configured to block. The hook log records what fired and whether it passed. A new Hooks tab in Bob Settings lists all global and workspace hooks in one place: search, filter, toggle them on or off, and jump directly to the settings file where a hook is defined. The hooks documentation covers the full event list.
The following video shows a hook firing during a Bob session.
Security information and event management (SIEM) integration
Bob now forwards audit events into existing security and observability platforms, so AI activity flows into the same tools a team already uses for investigation, alerting, and retention. Bob supports Splunk at launch. The Bob team configures each integration with you and verifies the sink, regions, and event delivery end to end before it goes live.
To start one, raise a request through IBM support, which routes it to the Bob team.
IBM Docs in context: retrieval-augmented generation (RAG) over IBM documentation
Bob can now answer questions grounded in IBM's own technical documentation. Rather than relying on what a model happens to have absorbed about IBM products, Bob retrieves from indexed product documentation and answers from that. The same index covers Bob's own documentation, and Bob IDE reaches the retrieval service through an MCP server.
Because Bob retrieves from an indexed corpus of IBM's published documentation rather than searching the open web, answers come from IBM sources at a known version, without a round trip through general-purpose web search. IBM maintains that index and refreshes it as the underlying documentation changes, so the corpus tracks the current product rather than a snapshot someone remembered to re-crawl. It also means Bob works the same way in network-restricted environments where external search isn't an option.
Reading and editing Office files
Bob can now read, edit, and create documents, slides, and spreadsheets without leaving the agent. A task that touches a spec, a data file, or a presentation alongside code no longer requires switching context to open the file separately.
Premium Package for Java: Spring Boot to Quarkus
Bob's Premium Package for Java now includes guided Spring Boot to Quarkus migration. Bob analyzes your application's Java environment and dependencies, then recommends either a Spring Compatibility or Full Quarkus migration strategy. It performs migration tasks across common translation points, including Spring MVC endpoints to Quarkus REST, dependency injection, and Spring Data persistence to Hibernate Panache or the Java Persistence API (JPA). It validates the build throughout the process. Rather than leaving you with a half-converted build, Bob works through six gated modules to help complete the migration. It targets services where container startup time and memory footprint are the problem, not a wholesale rewrite. Activate the capability from the Premium Package for Java welcome page, or through a slash command.