-
Notifications
You must be signed in to change notification settings - Fork 1
Security Model
Matea distinguishes ChatGPT, the public MCP ingress, the local Controller, repository workspaces, external services, optional plugins, and the independent recovery channel. A successful connection at one boundary does not authorize effects at another.
Normal work is limited to a registered repository and checkout. Outside-repository filesystem access requires a separate capability or grant.
- Read-only inspection
- Local repository changes
- Remote writes
- Destructive operations
- Secret or credential access
Remote, destructive, and secret-bearing actions stay explicitly gated even when local repository access is configured for fewer prompts.
Tokens, OAuth material, private paths, and proprietary source must not enter public logs, artifacts, docs, packages, or issue reports. Public export and release checks scan for unsafe content but do not replace careful review.
Stable releases are immutable and identified by full Git revision plus manifest hash. Rollback uses exact known-good evidence. Ambiguous source ownership, stale activation, dirty source, or release drift fails closed.
Use GitHub private vulnerability reporting. See the repository Security Policy.