One mediated path.
CLI, MCP, inspector and recipe requests converge on the broker. The selected capability, its inputs, current references and the owner’s policy are checked before provider dispatch. A new frontend must not create new authority.
Observe first. Grant deliberately.
Observation is the default. Input, clipboard content, screenshots, application launching and app-native mutations need explicit permissions. A driver manifest describes requirements; it cannot create its own grants.
Destructive, secret-access, code-execution and privilege-sensitive risk classes require an external operator after capability checks. Broker approval and desktop portal consent are separate decisions.
Ambiguity is a result.
A request with several plausible targets should return candidates, not choose silently. A stale reference must fail rather than retarget a newly created object. A failed mutation does not automatically retry through another backend.
Isolation has a scope.
The persistent driver host stages digest-pinned executables and uses Bubblewrap plus Landlock on Linux. Filesystem, environment, network and resources remain constrained by owner configuration and the host contract.
These controls do not make every application memory-safe, every plugin trustworthy, or every supported kernel equivalent.
What this does not solve.
- A malicious process with the same Unix UID may access user data or impersonate local services. Socket UID checks are not a same-user sandbox.
- An agent given an unrestricted shell or another desktop-control tool can bypass the mediated surface.
- Federated MCP upstream executables are not automatically sandboxed against the user account.
- A browser’s top-level origin list is not a firewall for redirects, subresources or normal page scripts.
- Policy reduces the consequences of prompt injection; it does not prove that untrusted content cannot influence an agent.
Audit without collecting the work.
The intended audit surface is redacted execution metadata, not clipboard contents, raw screenshots, browser authentication material or arbitrary document payloads. Review the source and the configured retention policy before trusting an installation with sensitive work.
Report responsibly.
Follow the repository’s security policy for the current reporting route. Do not put live credentials, private documents or an uncoordinated vulnerability disclosure in a public issue. This website does not invent a security mailbox or response commitment.