agentcue

Security model

Threat model: single trusted user on their own machine, server bound to loopback. AgentCue refuses to start on a non-loopback host — there is no authentication layer, by design, until one exists.

Guards in place

• Loopback-only binding enforced at startup; TrustedHost + Origin/Sec-Fetch-Site checks against DNS-rebinding/CSRF; request body size cap.
• writefile nodes are contained to the user’s home root via resolve().relative_to() (no substring tricks).
• shell nodes refuse `` template interpolation — upstream data cannot flow into command strings.
• fetch nodes resolve the host and reject loopback/private/link-local/reserved addresses, and do not follow redirects.
• Approval gates default to undecided; timeout means deny; decisions are single-writer (first response wins, enforced at the SQLite layer) and audited.
• ANTHROPIC_API_KEY is stripped from child environments so subscription CLIs don’t silently switch to API billing.

Known limitations (accepted for the localhost single-user model)

Documented deliberately rather than hidden — pull requests welcome:

1. No auth. Any local process can call the API. Loopback binding is the boundary.
2. Prompt injection: content fetched from the web / files / issue text flows into agent prompts. When you enable “allow tools”, you are trusting that content. Keep allow-tools off for flows that ingest untrusted input.
3. Child env: apart from ANTHROPIC_API_KEY, child processes inherit your environment (an allowlist is planned).
4. readfile nodes can read any file your user can — treat flow definitions as trusted config.
5. Frontend uses inline handlers with manual escaping; a CSP/refactor is planned.
6. Flow-node agents are not covered by the global spawn semaphore yet — a runaway flow can spawn many CLI processes.
7. Windows is the primary platform; health scan / session relaunch are Windows-only today.

Report issues via GitHub Issues.

This site is open source. Improve this page.