Deny by default
Agent tools, MCP, and CLI spawns evaluate through Gatekeeper. Production environments raise risk and default to approval for write and destructive tools.
Security
Policy outside the webview
Every non-human tool or command from an agent, MCP client, plugin, or AI command bar is evaluated in Rust or a trusted Node sidecar — never in React. Human typing stays yours.
Human keystrokes are not blocked
You are the operator. Typing in a focused terminal is out of Gatekeeper scope. Agent-originated writes into a PTY are Gatekeeper-blocked.
Cmd+K never auto-executes
Suggested commands wait for Run. HIGH and CRITICAL need a second confirm. Policy can require approval for risk classes — the webview cannot waive that.
Policy lives in trusted code
Evaluation and execution for agents live in Rust and/or the Agent OS sidecar. React displays decisions and sends approve(actionId) / deny(actionId) only.
Untrusted content cannot grant power
Repository text, terminal output, and MCP results are untrusted. They cannot grant capabilities. Prompt injection protection is Gatekeeper + guardrails — not a system-prompt instruction.
Secrets stay out of SQLite
API keys use the OS keychain. Kubeconfig discovery stores cluster and context names only — never tokens or certificate data. Telemetry endpoints are optional HTTP GETs you configure.
# Gatekeeper boundary (ADR-007)
mode: enforce
defaultDecision: deny
human PTY input → not blocked
agent PTY write → Gatekeeper
Cmd+K suggest → never auto-run
agent PTY write → Gatekeeper
Cmd+K suggest → never auto-run