Security¶
Permissions¶
Tool requests use allow/ask/deny rules. Explicit denials and the command classifier still apply when auto-approval is enabled. In-project edits and profile-preapproved actions may execute without a prompt.
[permissions.bash]
deny = ["curl", "wget", "ssh", "scp"]
[permissions.path]
deny = ["~/.ssh/**", "~/.aws/**", "**/.env", "/etc/**"]
Use a restrictive profile to remove unnecessary tools entirely.
Protecting API keys¶
--api-key hides its environment value in CLI help. Keep credentials out of
shared configuration and use GDC_API_KEY for headless runs when practical.
Extension authentication fields require the same care.
Exposing a server safely¶
| Surface | Access control |
|---|---|
| Local server | Loopback by default |
| Non-loopback server | Startup requires swarm role and TLS |
| Swarm peers | Signed identity and swarm transport checks |
| Session HTTP/WS endpoints | No built-in user authentication |
TLS encrypts transport; it does not authenticate users of session endpoints. Restrict those endpoints with an authenticating proxy, firewall or private tunnel. Use a dedicated account or container to limit the server's host access.
Trust for extensions¶
| Extension | Control |
|---|---|
| MCP tools | Server trust plus tool permissions |
| Plugin tools | Plugin trust, manifest capabilities and tool permissions |
| Hooks | Operator-installed code; executes on configured events |
Review extension code and declared access before enabling it.
Swarm¶
| Setting | Effect |
|---|---|
join_rate_per_minute |
Join attempts per source per minute; 0 blocks joins |
network_allowlist |
Bound worker network destinations |
profiles_exposed |
Profiles offered as callable swarm skills |
public_discovery |
Opt-in sanitized public description |
See swarm configuration.
The sandbox¶
[sandbox] adds execution restrictions alongside permissions. Available
backends and enforcement depend on the platform. Inspect the active sandbox
to confirm which restrictions it enforces.
See configuration.
A durable audit trail¶
Review saved messages and completed results. Use an audit hook for additional records of operations.