Real access.
Explicit responsibility.

Bridge is an owner-authorized file and process tool. It is not a sandbox. A shell command can modify or delete files, access the network, and invoke installed programs with the privileges of the user running the agent.

Authorization

The internal agent uses stdio under an authorized parent process or an authenticated loopback HTTP listener. The private ChatGPT connection uses an authenticated tunnel. Never expose the local MCP endpoint as an anonymous internet shell. A future public relay requires isolated accounts, per-device authorization and independent security acceptance before release.

File protections are not a permission boundary

SHA-256 checks prevent accidental overwrite of a changed file. Literal edit checks prevent an ambiguous replacement. These controls do not restrict what an authorized shell command can do. For sensitive workflows, run the agent under a separate OS account with only the access it needs, maintain backups and review meaningful changes.

Data flow

Requested file contents, paths, image bytes and process output are returned to your AI client through the configured transport. They may contain sensitive data. Your AI provider and transport provider have their own data-handling terms. “Runs locally” does not mean “nothing leaves the computer.”

Credentials

The agent must not require passwords or tokens to be pasted into an AI conversation. Existing OS permissions and authorized SSH configuration remain in force. Selected provider credential environment variables are removed before starting child commands; this is not a complete secret-isolation boundary for an owner-level process.

Logs and process lifetime

Local audit records contain operation names, success state and duration, not raw tool arguments or file contents. Process output is temporarily held in the agent’s bounded in-memory buffers. A restart loses sessions. Stopping an SSH connection does not prove every remote descendant has stopped.

Report a concern

Email info@ganado.cz with the subject “Bridge security report”. Include a minimal reproduction and version, not secrets or customer data. There is no paid bug-bounty or response-time guarantee.