Trust and safety

AgentRoom runs coding agents on the machine that holds your source code and your credentials. That is the point of it, and it is also the reason this page exists.

This page describes the posture as it actually is, including the gaps. If you only read one section, read the sharp edges.

What is bounded

Sessions only target folders you registered. There is no route that starts an agent somewhere else, and no way for a client to widen the set.

Clients send turns, not commands. A client cannot run a shell command, launch an agent process, or read provider credentials. Git goes through fixed operations rather than command strings, because a route that accepts arbitrary command text is a shell with extra steps.

Workspace reads are fenced four ways. Registered folders only, bounded in size, symlink-checked so a link cannot walk out of the folder, and filtered so files with secret-shaped names never come back.

Writes are narrow and locked. File writes carry an optimistic lock, so a stale client gets a conflict rather than clobbering someone else's edit. Folder creation is one level deep and refuses a name already in use. Rename cannot change the parent. Move and copy stay inside one workspace and refuse to drop a folder inside itself. Recursive delete never targets the workspace root and refuses protected entries, symlinks, and anything past its entry-count and size caps.

Secrets are not in the responses. They are read from the environment or the macOS Keychain, and the config, status, logs, and audit endpoints do not return them.

Mutating routes require a bearer token when one is configured.

What ships switched off

Each of these would demo better switched on. They are off because the safe default matters more.

That last row is the one that took the most thought, so it is worth spelling out.

Why some settings cannot be changed remotely

AgentRoom has settings a paired client can edit, and settings it cannot. The ones it cannot are not filtered out at the edge. They are absent from the schema entirely.

The reasoning is that a path to an executable is not a preference. "Run this binary" is remote code execution written as configuration, so it is not a remotely editable setting at all, and asking for one fails exactly the way a typo fails. The same goes for the bearer token itself, which is the credential the request rides on, and for the bind address and storage location, which would strand or relocate the backend halfway through an edit.

Doing it this way rather than as a filter has a second effect. The settings endpoint cannot leak a secret it has no key for.

Above that sits a second tier: the settings that decide what the backend is allowed to do, such as whether the terminal exists and how wide an agent's sandbox is. Those are editable remotely only when a switch on the Mac says so, and that switch is environment-only and off by default. Without it, the bearer token alone would escalate from "may drive this backend" to "may decide what this backend is allowed to do", and those are not the same permission.

One more rule ties it together: an environment value beats the settings file and locks that key. An operator can pin any setting beyond a client's reach by setting it in the environment. Everything applies on restart, and only the Mac can restart the backend, so nothing is reconfigured underneath a turn already in flight.

The sharp edges

Registering a folder does not sandbox it. This is the one that catches people. Each agent reads that workspace's own configuration, including MCP servers, hooks, and skills. Pointing AgentRoom at a repository you did not write means letting that repository's agent configuration run. See the coding agents page for what each one loads.

Claude Code's default permission mode is not confined to the registered folder. That is the SDK's default rather than something AgentRoom adds, and AgentRoom does not narrow it for you.

The terminal is unsandboxed once launched. It starts inside a registered workspace, but nothing holds it there afterwards. Leave it off unless you intend the client to have shell access to that Mac.

A Cursor sandbox bounds writes and network egress, not reads.

A DeepSeek turn is bounded by a composition you supply, and AgentRoom cannot inspect it to tell you what it permits.

The backend binds to the local network by default, because that is how the headset reaches it. Configure a bearer token before connecting a physical Vision Pro, and certainly before enabling the terminal or language services.

Editor language services can reach past your source. They may inspect SDKs, language environments, project state, and plugins, and may invoke build tools. Optional ones must be named by absolute path in the environment; the backend will not search your PATH for them.

What this adds up to

AgentRoom is not a sandbox and does not claim to be one. It is a bounded remote control for agents that run with your privileges on your machine.

The bounds it does hold are the ones a client could otherwise use to escalate: it cannot run shell commands, it cannot read outside registered folders, it cannot point the backend at a new executable, and it cannot turn its own safety settings off. Everything past that boundary is the same trust you extend when you run a coding agent in a terminal, and we would rather write that down than imply otherwise.

Next: install AgentRoom.