Real access to your desktop, held to a high bar

Pairing needs a local approval. Only the host app can approve a request; an agent has no way to approve itself, and the agent-facing API has no control-plane method

Approval grants a defined scope: all desktop apps by default, including future ones, or an explicit list. The isolated browser is a separate permission

Older pairings keep their original scope. Upgrading never silently widens access; widening means revoking and pairing again

Foreground control is allowed at pairing but must be requested explicitly with mode: "foreground". Sessions default to background and never fall back automatically

Pause, emergency stop and revoke work regardless of scope. Pause and emergency stop survive quitting, reopening, login and updates; they block on-demand startup, and only the app’s resume or restart controls clear them

Starting the service on demand creates no grant: system permissions and the first pairing still need your approval

The CLI and MCP talk to the host over a private Unix socket on macOS (owner-only, in an owner-only folder) or a named pipe limited to your user on Windows

Optional HTTP MCP is off at every launch, listens only on 127.0.0.1, requires a client credential and rejects foreign Origin and Host headers. Cross-machine access is a manual SSH tunnel, never a LAN listener

A client credential is a random token. The runtime stores only its SHA-256 hash; the CLI keeps its copy in a private file and never prints it

There is no telemetry. The bundled driver’s telemetry and update checks are disabled, and the app’s own update check reads public GitHub release information only

The setup prompt carries local path hints and never credentials. The app only copies it: it does not install the Skill, write into an agent’s configuration or Skill folder, pair a client or start the service

The action journal keeps metadata only: request ID, action type, state, time and error code. It keeps at most 500 finished records from the last 7 days

Default logs never contain screenshots, typed text, URLs or window titles. Screenshots written by the CLI are private local files, removed after 24 hours on a later run

Values of secure and password fields, and values made only of mask characters, are dropped inside the adapters. They never reach results or verification conditions

On macOS, the system Apple menu and menu content that is not currently shown are not exposed to agents

Every action consumes a fresh snapshot. A changed or expired window is rejected instead of guessed at

A request ID makes retries safe: the same ID with the same arguments returns the known result, and a different payload under that ID is refused

If delivery itself is uncertain, the action is recorded as unknown and desktop execution stops until you restart it. Nothing uncertain is replayed, even after a restart

Executed is not verified. Only an explicit observable condition produces a verified result, and it proves only that condition

macOS builds from the release workflow are signed with a Developer ID and notarized. An in-app update installs only if its bundle ID and signing team match the running app, it passes Gatekeeper, and its version is newer

Windows installers and portable packages are not code-signed yet, so SmartScreen or Smart App Control may warn or block them

Every download is checked against the release’s SHA-256 file, its metadata (version, platform, commit, clean-source flag, size, signing mode) and GitHub’s recorded digest when available

Update requests go only to HTTPS addresses on github.com, api.github.com and githubusercontent.com, and every redirect is checked again. Bundled Node and driver builds are pinned and hash-checked when packaging

Local authorization does not isolate malicious processes running as the same operating-system user

If your agent uses a cloud model, the screenshots and results it requests are processed by that provider

Background execution depends on the app and the control, so focus changes cannot be ruled out. Authorized clients also share one isolated browser space

Elevated Windows apps, the UAC secure desktop, and long text in canvases or terminals are outside the validated range

This is a development preview, validated on a limited set of systems. See the platform table for exactly what was checked

The one-prompt setup has had only limited checks: a clean machine going from download to first observation, and Skill installation by agents other than Codex, are not tested yet