Permissions and Security
A layered permission system, secret filtering, and local-first data.
ZYRAXON runs on your machine and treats that as the default boundary. Every tool call is evaluated by a layered permission system before it runs, and every secret is filtered before it reaches a model.
The permission layers
| Layer | Decides |
|---|---|
| Mode | Which tools a mode may call at all (for example, Plan denies all writes) |
| Tier | Which tools an account is entitled to |
| Rule | Per-tool allow/deny/ask rules the user sets |
| Evaluation | The runtime check in packages/zyraxon/src/permission/ that resolves the three above |
✓
Nothing is granted silently
A tool call that no layer permits is refused with a reason, not run by accident. Subagents inherit a narrowed permission set rather than the parent’s full one.
Secret handling
- ▸API keys, tokens and passwords are filtered out before anything is sent to an external model.
- ▸Keys are stored locally and never leave the machine.
- ▸Zero Distribution -- your files, data and keys stay put.
Zero Distribution
Everything runs locally. The desktop app, the local models and the bundled MCP servers need no account and no network to do local work. When you do connect a remote provider or MCP app, only that call leaves the machine, and only with the credential you supplied for it.
Reporting a security issue
Do not open a public issue for a security problem. Email the maintainers, or use the private reporting channel in the repository.