Security model
The graph gates coordination. It does not pretend to sandbox your OS.
MootDeck makes agent-to-agent visibility explicit. This page is the exact version, including the boring parts people actually need before trusting a local developer tool.
01Model
Topology gates the MootDeck CLI, not the whole universe.
The core rule is narrow on purpose: list, check, and ask only expose nodes that are directly roped to the caller. Ropes are one-hop and non-transitive.
That gives you a visible working boundary for agent-to-agent coordination inside MootDeck. It does not stop a CLI tool from doing whatever that tool can already do outside MootDeck, including reading local files it has permission to read or making its own network calls.
02Network
What can leave the machine?
MootDeck itself does not send terminal contents, notes, canvas layouts, or API keys to us. Network egress can still happen through the tools you run, the update check, the waitlist, optional crash reporting, or hosted model calls you configure.
| Surface | Leaves your machine? | Notes |
|---|---|---|
| Terminal agents | depends | Claude Code, Codex, aider, shells, test runners, and scripts behave exactly like the tools you start. |
| MootDeck app telemetry | no | No telemetry is sent by default. |
| Update check | yes | The app checks /updates/latest.json. Your IP appears in normal server logs. |
| Waitlist form | yes | Email address and signup timestamp are processed for launch notification. |
| Mooty with Ollama | no | Model calls stay local if your Ollama setup is local. |
| Mooty with hosted API | yes | Terminal or note context sent to the provider you configure. |
| Crash reports | opt-in | Disabled by default. Only sent if you explicitly enable them. |
| Notes and layouts | no | Stored locally unless you put them in a synced folder yourself. |
03Limits
What this model does not claim.
- Ropes do not sandbox operating-system permissions.
- Ropes do not prevent a process from using its own network access.
- Shared notes are collaboration scratchpads, not a high-assurance secret store.
- Hosted model calls leave the machine because hosted model calls leave the machine. No poetry required.
- Closed source means you are trusting the shipped binary for now. That is a real cost.
04IPC
The local socket is token-authenticated per app instance.
The mootdeck CLI talks to the running desktop app through local IPC. The socket is authenticated with an app-scoped token so a random process cannot casually pretend to be part of the session.
This is a practical local coordination boundary for developer workflows. It is not sold as a certified sandbox, enterprise DLP system, or replacement for OS-level isolation.
NEXTKeep reading