Reference

Security model and privacy

One Connect runs AI agents that execute commands on your Mac with your permissions. Here is what it protects, what it cannot, how each guard works, and what leaves your machine.

Warning

Treat One Connect like a CI runner on your laptop. It runs AI coding agents that execute shell commands with your user account's permissions. Hooks and policies are guardrails, not a sandbox.

What it protects#

Asset	Protection
Your money	API-key variables are stripped from agent runs. Dispatch is blocked when billing is metered without an opt-in. A run is stopped when the vendor reports API-key billing or paid overage.
Vendor credentials	Never read, stored or proxied. Each vendor CLI handles its own login.
Tracker credentials	GitHub goes through your own `gh` login. The Linear key is read from the Keychain or an environment variable at runtime, never written down, and redacted.
Secrets in output	The runner redacts agent output (token patterns, configured environment values, private keys) before it reaches disk, events, the UI, prompts or tracker comments.
Protected branches	Each agent worktree has a pre-push hook that rejects pushes to protected branches. The daemon never pushes.
Scope	A per-worktree pre-commit hook rejects commits outside the assignment's allowed paths. A live watcher flags out-of-scope edits, and the daemon re-checks the committed scope before a merge.
Irreversible actions	Tool requests that look like push, deploy, migrate, publish or messaging come to you. Approvals are audited events.
Your unrelated data	Agent runs get only the `acc` MCP server, not your personal MCP servers. Only the configured vault folders are readable.
The control API	Binds to `127.0.0.1` only. Every request needs a session cookie, the install token or a per-run token. Host and Origin checks block DNS rebinding and cross-site requests.
Evidence	The event log is append-only (database triggers) in a durable folder. Temp folders are refused.
Phone access	Off by default. Only a private, authenticated tunnel after a per-launch Decision, with single-use pairing, scoped cookies, CSRF and Origin checks, brute-force lockout, revocation and audit.
Runaway agents	The kill switch stops every runner process group, even with the daemon down.

What it does not protect against#

A malicious or prompt-injected agent with shell access. Vendor sandboxes (Codex workspace-write, the Cursor sandbox, Claude Code permission modes) are the main containment. An agent can bypass git hooks with --no-verify; the daemon re-checks scope after every run and before a merge, and flags violations.
Other processes running as your user. They can read the data folder, like any local tool's.
Vendor-side behaviour, including overage you enabled in a vendor account. The UI shows the overage state where vendors expose it and unknown where they do not.
Arbitrary MCP servers you approve. Read roots are hints, not a sandbox.

How each guard works#

Guard	How	Code
Local-only API	Binds `127.0.0.1`. The Host header must be a local address on the engine's port. A cross-origin Origin is refused, and state-changing requests without an Origin and without the bearer token are refused.	`server/http.ts`
Sign-in	`acc open` uses the `0600` install token to get a one-time code; `/auth?code=` swaps it for an `HttpOnly`, `SameSite=Strict` cookie. Sessions are stored hashed and expire after 30 days on the server.	`server/auth.ts`, `cli.ts`
Per-run MCP auth	Each run gets a random token in `runs/<id>/mcp.json` (`0600`), accepted only for that run	`runManager.ts`, `mcpBridge.ts`, `mcp/server.ts`
Redaction	Token patterns (GitHub, Anthropic, OpenAI, Linear, Slack, AWS, Google, Stripe, JWT, Bearer, URL credentials, key=value secrets, PEM blocks) plus exact values from `policies.redact_env` and tracker keys. Applied in the runner before disk, on every event, on outbox payloads and on prompts; pre-flight fails on a hit.	`core/redact.ts`, `runner/runner.ts`
Billing	API-key variables stripped from child environments; pre-flight billing check against the vendor's own login status; the run stops on a non-subscription key source or overage in use	`adapters/agents/env.ts`, `core/preflight.ts`, `runManager.ts`
Path scope	Per-worktree hooks path. The pre-commit hook rejects staged files outside the allowed globs; a live watcher raises a scope violation.	`adapters/vcs/git.ts`, `hook.ts`
Protected branches	The pre-push hook rejects any ref to a protected branch	`adapters/vcs/hook.ts`
Tool approvals	In-scope edits and non-dangerous shell commands are allowed; push, deploy, migrate, publish and messaging wait for you. The shell prefixes pre-approved for every run exclude anything that deletes files or rewrites shared refs, and a test keeps it that way.	`mcpBridge.ts`, `runManager.ts`
Git policy	App-owned Git operations suppress repository and global hooks, fsmonitor, filters, external diff and textconv drivers, credential helpers, lazy fetching, signing programs and submodule recursion	`adapters/vcs/git.ts`
Durability	Data folders under temp paths are refused. The event log is append-only. Log offsets are stored atomically with events.	`paths.ts`, `store/eventStore.ts`
Kill switch	SIGTERM, then SIGKILL, to every runner process group. `acc kill-all` works with the daemon down by verifying runner PIDs from their run folders.	`daemon.ts`, `runner/supervisor.ts`
Docker inputs	Approved secrets and configs are immutable, content-addressed copies in private project data (`0700` folders, `0400` files). Modified copies are refused before launch.	`environment/`

Paths are under packages/daemon/src/ unless they start with core/.

The Mac app boundary#

The app loads only bundled local assets; remote pages get no native capabilities. Its install token stays in Rust, and the page gets single-use, short-lived WebSocket tickets instead. Each project has a separate state folder. The embedded terminal runs as you and is not sandboxed; its keystrokes and output are never saved. Docker writes require a recorded, single-use Decision for the exact action.

What leaves your Mac#

By default, nothing beyond what your agents' own vendor tools send to their vendors.

Data flow	When
Vendor CLIs talk to their vendors	Whenever an agent runs, under your vendor account and the vendor's terms
Tracker reads and writes	GitHub or Linear, only with `live: true` (writes) or an enabled import source (reads)
Code host and infrastructure reads	Only after you activate a connection with a host and scopes
Skill and MCP registry imports	Only when you preview or import one
Clone	Only after you approve the exact clone command
Phone tunnel	Only after a tunnel launch Decision, over your private Tailscale network
Outbound notifications	One approved message at a time
Jev advice	Only when enabled, and one confirmed request body at a time
Update checks	The Mac app checks the signed update feed on GitHub every six hours
Feedback and bug reports	Only when you press Send in Feedback or Report a bug: your words and, if you leave it ticked, the app and system versions go to oneconnect.dev, which files them in the One Connect team's Linear. What is sent shows the exact payload first

There is no telemetry. Bundled local models, embeddings and One Ask run on your Mac.

Hardening checklist#

Keep tracker.live: false until you have reviewed the integration.
Set allow_shell: false for agents that do not need arbitrary commands.
Protect main on your code host too; the local hook is a second line of defence.
Put production credentials' variable names in policies.redact_env.
Turn paid overage, on-demand billing and auto-recharge off in every vendor account.
Approve only MCP servers and container actions you understand.

Reporting a vulnerability#

Report privately through GitHub's Report a vulnerability button on the repository's Security tab. Do not open a public issue. Include a description, steps to reproduce, the affected version and the impact. The latest 0.x minor version receives security fixes. The full policy is in SECURITY.md.