Security Model

Security Model

AgentDesk is a local debugging tool. It is not a secret vault, sandbox, or production isolation platform.

Main Boundaries

AgentDesk uses explicit run modes:

• Demo mode: no live execution
• Ollama mode: local Ollama model nodes only
• Cloud BYOK mode: configured OpenAI/Anthropic model nodes only
• Runtime mode: packaged loopback CLI for local commands and MCP discovery/tool calls

The user must intentionally switch modes and trigger live actions.

Local Runtime Boundary

Runtime mode is served from the packaged CLI and uses loopback-only API routes. Runtime requests are designed to be explicit, bounded, and redacted.

Runtime controls include:

• loopback Host/Origin checks
• required runtime header
• JSON-only requests
• request body size limit
• command timeout
• stdout/stderr caps
• redaction before trace artifacts are returned

MCP Boundary

MCP configs are treated as untrusted.

AgentDesk can import metadata without execution. Live discovery and tool calls require user-triggered Runtime mode actions.

Review before discovery:

• command
• args
• cwd
• URL
• env key names
• header key names
• readiness flags
• risk flags

BYOK Boundary

Cloud BYOK API keys are kept in browser session state. They are not intentionally exported or saved to localStorage.

However:

• prompts become trace evidence
• model responses become trace evidence
• provider error messages may become trace evidence
• screenshots may contain sensitive data

Treat all exported traces as evidence that must be reviewed before sharing.

Redaction

AgentDesk redacts common sensitive patterns such as:

• API key fields
• bearer tokens
• GitHub tokens
• Slack tokens
• JWT-like strings
• database URLs
• private key fields
• local user path prefixes

Redaction is a best-effort defense. It is not a formal data loss prevention system.

Non-Goals

AgentDesk does not promise:

• malware sandboxing
• isolation from malicious local commands
• safe execution of untrusted MCP servers
• guaranteed removal of every possible secret pattern
• production-grade secret management
• tenant isolation
• hosted audit retention

Safe Public Sharing Checklist

Before posting an export publicly:

1. Inspect replay-session JSON.
2. Inspect trace bundle ZIP contents.
3. Remove screenshots with private data.
4. Remove customer data.
5. Remove internal URLs if needed.
6. Confirm no API keys, tokens, cookies, or credentials remain.
7. Prefer minimal repro traces over full private runs.