Zidos runs on your machine: commands in a sandbox, steps in the log. Each mechanism below runs live.
security.txt
Approval, sandbox, desktop, browser. The examples run on this page and send nothing anywhere.
go test -race ./internal/session
Reply
permission.promptedrisk read_only · rule default:read_onlypermission.decidedallow · onceIn the example: approve, reject or pick the alternative; the decision lands in the example log.
go test -race ./...
Sandbox✓ Result returned--unshare-net--die-with-parent--clearenvOn Linux the command runs in bubblewrap with no network. No sandbox, no run.
Linux (X11) helpers run in a closed bwrap profile: no network, no D-Bus, DISPLAY only. No bwrap, no start.
Wayland, macOS and Windows are not covered.
Site allowed
Ready.
httpbin.org
Unlisted address refused
browser_navigation_deniedhttpbin.org
In the example a listed address opens, an unlisted one does not, and the password is hidden in the log. On Linux, Chromium runs in its own sandbox inside ours.
Checkpoints are signed with Ed25519. A separate program spots tampering.
permission.prompted
permission.decided
Failed · record 2
Redacted before logging
Authorization: [REDACTED]Chain intact · 3 records
The agent runs a command that touches the system or the network.
On Linux, commands run in a bubblewrap sandbox with the network cut off. Without the sandbox the command does not run.
A page carries instructions aimed at the model.
On Linux, Chromium runs inside its own sandbox: separate process namespaces, seccomp on tabs.
The server's tool set changes after it is connected.
We plan to stop the run when the MCP tool set changes.
A client on a phone or another machine gets more than it should.
A root key on the remote port is rejected (403); a scoped key is accepted. Credential fields are stripped from responses. Browser control from a phone is not enabled. Until key checks are turned on, any local caller gets the admin role: that is the compatibility mode.
Another user of this machine reads private state.
A log record is altered or the tail is cut off.
Checkpoints are signed (COSE_Sign1, Ed25519) and chained; there is a mandatory-checkpoints mode. The independent verifier is a separate Go module that does not import the core. Without operator keys, checkpoints stay unverified.
A secret ends up in the log, in a provider request or in front of the agent.
At write time, configured secrets and known formats are removed: cloud provider keys, bearer tokens, private PEM, JWT. Not every secret. Provider requests are scrubbed before sending; if the scanner fails, nothing is sent. Channel secrets are stored sealed, write-only. In the Windows sandbox the profile, AppData, registry and Credential Manager are closed; secrets you put in the working folder are visible to the agent.
What is verified, partial or planned.
| Mechanism | Where and how |
|---|---|
| Command sandbox, Linux | bubblewrap, network cut off |
| Command sandbox, Windows | Profile, AppData, registry and Credential Manager are closed. Verified on one machine and one account (Windows 11). |
| Command sandbox, macOS | Partial |
| Browser sandbox | Linux. Not supported on macOS and Windows: refused before the driver starts. |
| Desktop control | Linux/X11 in a closed bwrap profile |
| Windows service | Not supported |
| Browser control from a phone | Not enabled |
| Release signatures | Verification scripts and a public anchor exist. We do not claim every release is signed. |
| Reproducible builds | The check is in the release scripts; the result on a release is not confirmed. |
| Stop on MCP tool-set change, immutable log archive, external timestamp, SIEM | Planned |
| Certifications (SOC 2, ISO, HIPAA) | None |
| Vulnerability reports | See security.txt |
Where data goes, what the provider sees, how to move it.
The core listens on this computer only. Remote access goes through a separate listener with its own keys.
The request, after secret redaction. If the scanner fails, nothing is sent. Claude, ChatGPT and Gemini work with your subscription.
Configured secrets and known formats are removed before writing: cloud provider keys, bearer tokens, private PEM, JWT. An unknown format can slip through.
With the export and import command. Secrets are left out of the archive by default.
On Linux, sandboxed commands never have network access; a test covers it.