Security
Each guarantee tied to the thing that enforces it, a guard, a test, a compilation property, and the ones nothing enforces yet, said plainly.
Shipped in the current build. You can do this on your own machine today.
A security page that lists intentions is a marketing page. Every line below names what enforces it, and the lines that nothing enforces yet say so.
| Guarantee | Enforced by | Status |
|---|---|---|
| Keys live in the macOS Keychain, never in a file, a database or a log, and are sent only to the provider they belong to | No code path writes a key to a file, a database or a log | Enforced |
| No write path to a broker | The market feed exposes no write method, verifiable by compilation | Enforced |
| A role only sees the tools its capabilities cover | The tool registry filters by capability; two tests hold the door | Tested |
| No role holds both user data and arbitrary outward access | A startup audit over the whole roster; a violation stops the application from opening | Enforced at startup |
| Running code and reaching outward never combine | The same audit, the sandbox cuts the network, the audit keeps the cut meaningful | Enforced at startup |
| Writing a workbook opens no network | The capability is classified among those without outward access | Tested |
| A tool call cannot choose its own file path | The tool schema carries no path key; a guard inspects the schema | Tested |
| A source address carrying a secret is redacted before the journal | The provenance writer redacts on the way in | Tested |
| A card runs in its own isolated workspace | One card, one process, one workspace | Tested |
| A card cannot read a neighbouring card’s workspace | Strict configuration mode on the CLI, plus the deposited deny list | Measured 2026-08-26 |
| Quitting stops every process the app started | The quit path iterates the started processes | Tested |
| A missing engine costs nothing | Preflight refuses the format before any process starts | Observed in a live run |
| Deskworth’s server never sees your data | The control plane schema is checked by a machine guard, so the list cannot quietly grow | Tested |
#The local tool server
It binds the loopback address on a port the system picks, and every call carries a bearer token issued to one card. A call without a known token is refused without being told why.
- AVAILABLEBearer token per cardEach card points at the same server with its own token, and no card sees another’s. The token is written into the card’s own workspace declaration.
- AVAILABLELoopback onlyNo other machine can reach it. The address is not configurable, and a third-party connector may not take the server’s name.
- PLANNEDOrigin validation on every requestThe current transport revision requires a server to validate the origin of incoming requests and refuse an invalid one, precisely to defend a local server against a page in a browser 3. This server predates that revision and relies on the per-card token instead. It is a conformance gap, and it is written here rather than left unsaid.
#Fetched content is data, never instruction
Anything a tool retrieves from outside, a filing, a wire item, a page, is treated as data. It is never executed as an instruction to the agent. This is a design rule of the capability system rather than a filter applied after the fact, and tools that return third-party prose declare it, so the warning is attached by the server instead of being left to whoever wrote the tool to remember.
#What is not proven
- The sub-agent boundary is written and tested, and nothing calls it. Inheritance of reach and budget is therefore untested in a real delegation.
- A hard kill from outside the application bypasses the quit path. One orphan process was observed exactly that way. This is expected behaviour of a signal, not a leak in the quit path.
- There is no published vulnerability reporting channel yet. See the security page under Resources for what that means today.
#Sources
- Deskworth OS, product state at 0.0.23DeskworthInternal document, not published
- The canonical role registry, mirrored on this siteDeskworthInternal document, not published
- Model Context Protocol, Streamable HTTP transportModel Context Protocol projecthttps://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http
- The tool registry, mirrored on this siteDeskworthInternal document, not published