Security

The local bridge

The browser extension connects to a bridge listening on 127.0.0.1 on your device. The bridge routes calls to the local or remote MCP tools you configure. Binding to loopback avoids exposing the listener directly on your network, but does not make every local process or browser interaction trustworthy.

The local connection uses ws://; it is not TLS-encrypted. Do not treat localhost as an authenticated security boundary. Do not expose, forward, or proxy the bridge port to an untrusted network. Run AgenticNova under a normal user account, not as administrator or root, unless a specific trusted setup genuinely requires it.

Permissions and connected tools

Built-in filesystem and terminal tools use separate, session-only folder approvals. A filesystem approval does not authorize terminal commands. Grants expire when the relevant bridge or server restarts.

Filesystem tools restrict paths to their approved roots. Terminal approvals select permitted starting folders, not the full scope of a command: commands have your account’s permissions, are not sandboxed, and are not approved one by one. They can run programs, use network access, and modify anything your account can access.

These folder controls do not automatically constrain every third-party MCP server. Inspect its commands, arguments, environment variables, credentials, and capabilities before enabling it. Configuration imports can launch software; only import trusted configurations. Disable tools you do not need.

Treat AI and retrieved content as untrusted

An AI model can misunderstand a task or follow hostile instructions embedded in a file, webpage, or tool result. This is often called prompt injection. A model’s confident explanation is not proof that a command or edit is safe.

• Start with a narrow task and a non-sensitive workspace.
• Read approval prompts and proposed commands; do not grant broader access just because a model asks.
• Do not expose passwords, tokens, license keys, or private files to prompts or tools that do not need them.
• Review outputs and tracked changes, and stop the session if it goes off-task.

Stop prevents further session work; it does not undo completed changes or guarantee that a running external process has stopped. Use the relevant process controls and verify the result.

Online license verification

The bridge validates its license with the AgenticNova service over HTTPS, including before tool operations and during periodic checks. Current builds require a fresh server reply and disable tools when validation cannot succeed; a cached grant does not authorize offline tool use.

License replies are signed with Ed25519 and checked against the public key shipped in the client. Fresh challenges and product/device checks help prevent reuse of recorded replies. These protect licensing decisions; they are not a sandbox for AI actions, encryption for stored project data, or a guarantee that a connected MCP server is safe.

Keep your key private. Contact support for device changes, suspected key exposure, or activation problems rather than sharing credentials in a public issue.

Change review and recovery have limits

Tracked filesystem edits save local before/after snapshots and offer manual, conflict-aware undo. Terminal commands and arbitrary third-party tool actions are not individual file-undo entries.

Optional Git-based workspace checkpoints cover selected regular files, including untracked files. They exclude ignored files, common secret filenames, links, recovery stores, and nested repositories. Secret detection is name-based, not exhaustive. Restore uses a preview and approval, but cannot restore Studio memory, outside-folder files, excluded data, or external side effects.

Recovery stores live beside the workspace and are not tamper-proof. They have size and file limits, may be unavailable without Git, and are not a substitute for independent backups. Do not rely on them to recover payments, published changes, network requests, or every command effect.

Protect settings, logs, and results

Tool results can carry file content, command output, paths, or images into your AI chat. Your AI provider and configured MCP services handle that information under their own policies. See the Privacy policy.

Bridge configuration may contain MCP credentials. License files, browser settings, logs/bridge_debug.log, and local recovery snapshots can contain sensitive information. Protect your device and backups, avoid committing these files to public repositories, and redact logs before sharing them. Local storage is not a claim of encryption at rest.

Updates and public website safeguards

The bridge checks signed release announcements and validates the platform, version, and HTTPS download link. Opening a download requires your confirmation; updates do not install automatically. A signed announcement does not replace checking the downloaded package and its source.

Download AgenticNova from the official landing page or a location confirmed by BytArch support. Keep your browser, operating system, bridge, and connected tools up to date.

Public website pages use local assets, a restrictive Content Security Policy, frame blocking, and MIME-type protections. Only explicitly allowlisted assets and published archives are publicly served. These measures do not imply a security certification or guarantee that the website or software is free of vulnerabilities.

Report a security concern privately

Email bytarchbit@gmail.com with the subject “AgenticNova security report”. Include the affected version, operating system, a description, and minimal reproduction steps. Redact secrets and personal information; ask before sending sensitive evidence.

Only test systems and accounts you are authorized to test. Do not access other users’ data, disrupt the license service, or publish live credentials. Reporting a concern is not blanket authorization to test production systems. No response deadline or bounty is promised on this page.