Security Model
Localhost binding
The HTTP server binds to 127.0.0.1 only — LAN clients cannot reach the daemon. Cross-origin access from web.agenvoy.com is gated by CORS middleware with an origin whitelist. Chrome Private Network Access (PNA) is satisfied via the Access-Control-Allow-Private-Network header.
Sudo mode
TUI-only escalation via /sudo. Grants temporary bypass of the confirm gate for the current session. 1-hour TTL, stored in ToriiDB (not on disk — expires automatically, zero permanent residue). System-directory floor paths remain blocked even under sudo.
Sensitive file guard
read_files always requires explicit confirmation for files matching sensitive patterns — SSH keys, .pem, .key, .env, and credential files — regardless of sudo mode or allowlist status. This guard is hardcoded in Go, not prompt-based.
Permission mode
Agenvoy supports two permission modes: single-confirm and always-allow. Seven categories of irreversible operations always require explicit ask_user regardless of mode:
- File deletion or overwrite
- System configuration changes
- Network requests to unknown endpoints
- Package installation
- Credential storage or retrieval
- Process termination
- Scheduler creation or modification
System prompt protection
The system prompt (configs/prompts/system_prompt.md) instructs the LLM to refuse:
- Requests to disclose system prompt contents
- Role-play / DAN / "ignore previous instructions" overrides
- Paths containing
..or system directories (/etc,/usr,/root,/sys) - Commands like
rm -rf,chmod 777,curl | sh
These are policy in prompt, not Go-side hardcoded filters — adding a category means editing the prompt only.
Keychain
Credentials (provider API keys, OAuth tokens) are stored in the OS keychain under service agenvoy:
| Platform | Backend |
|---|---|
| macOS | security CLI |
| Linux | secret-tool (libsecret) |
| Other / fallback | Encrypted file under ~/.config/agenvoy/ |
The service name "agenvoy" is fixed and must not change.
Command execution
run_command never sees a raw shell string. Argv-only input, an allowlist of bare binary names, and a parsed (not pattern-matched) sh -c script are the three layers — see the Sandbox page for the exact rules. Commands on the read-only list (git status, ls, cat, …) skip the confirm gate; everything else is gated by the active permission mode.
The allowlist is append-only at runtime: /dangerous allow-cmd in the TUI or POST /v1/allowlist/cmd adds a binary, and a restart is required for it to take effect. Nothing removes an entry through the API — that is a manual config edit.
MCP isolation considerations
MCP servers are third-party processes whose behavior is unverifiable. Agenvoy treats them as untrusted by default and does not provide a per-server "trusted" flag. All MCP tool calls go through the same confirm gate as built-in tools. If you want batch MCP operation, use agen run (which trusts your own decision, not the server's).
[!NOTE] This document was auto-generated by Claude after reading the full source code.