Security

The native host owns sessions, tools, permissions and effects. The window can submit intent and render state, but it cannot invent a write the host did not accept.

Applies to tool calls the host executes; a remote provider still sees the prompts sent to it.

Writes and runs outside your rules need approval, and repeated failures stop at a bound. Keys are typed at a hidden prompt and never stored in a setup file.

These are engineering controls, not proof that every provider, plugin or configuration is safe. Review what you enable.

We do not claim SOC 2 or GDPR certification, a provider's retention behavior, or that a local model fits every Mac. Report a security concern through the support channel on the site.