Documentationsection 4 of 13
Security
- 1The security model
Kotoba runs on your machine. It holds your API keys, reads and writes files, and — on the default setting — runs shell commands and Python as your own user…
- 2The approval gate
The approval gate decides whether a command may run. It sits in front of exactly two tools — shell and execute_code — and it is the control that everything…
- 3Dangerous commands
A command that matches one of fourteen patterns is labelled dangerous. Nothing about it is automatic: it never auto-runs, no saved grant of either kind covers…
- 4The sandbox setting
KOTOBA_SANDBOX takes three values. It decides where — and whether — her shell and execute_code tools run anything.
- 5execute_code
execute_code runs a Python snippet. On KOTOBA_SANDBOX=local that is the host, in the working directory, with the scrubbed environment described in Secrets. On…
- 6Secrets
Three separate things are meant here, and they are protected differently
- 7The web gate
The backend serves an API that can run commands on your machine. With no password set, it is open. That is fine for a laptop bound to localhost. It is not…
- 8What leaves your machine
Kotoba runs locally and talks outward. Nothing reaches in unless you deliberately configure it to (the ElevenLabs agent voice path is the one such case, and…
- 9Fetching and third-party content
Two guards sit between the outside world and the agentic loop. Both are filters, and both are described here as filters rather than boundaries.
- 10Reporting a vulnerability
Do not open a public issue for a security problem.