Security
The tool is built for a local network and a single owner. Below is what is worth understanding before opening access to it.
The agent works without confirmations
The default mode is bypassPermissions: tools run without asking.
- In docker the isolation is the container's own mounts, and
AGENT_WORKSPACE_ROOTSlimits the available directories. The container runs as root, so the CLI is givenIS_SANDBOX=1— otherwise it refuses bypass. - In the app there are no mounts. The same mode means full access to the disk.
If you want confirmations — set default, plan or acceptEdits: then a card "The agent wants to call a tool" appears above the composer, and the reply waits for your decision.
What the agent can see
Everything mounted into the container. EXTRA_WORKSPACE_ROOT extends that list — add to it deliberately.
GH_TOKEN from .env (needed to publish releases from a chat) is visible to the agent too. If you need it — use a fine-grained token scoped to one repository.
Passwords are not typed to the agent as messages
Safe mode is on by default for a chat: the agent doesn't read .env, ssh keys and other stores, and asks for a password as a card — the value lives in the server's memory and never enters the conversation. The details and the limits of this — Secrets and safe mode.
An access key is equivalent to a password
With it one can do everything one could do at this machine's keyboard. A key shorter than eight characters counts as switched off.
There is no need to give another person the main key: issue a named key scoped to "their projects" and/or "read only". A terminal is not given to a guest at all — from a shell the whole machine is visible, not the key's scope.
On Linux where the server runs as root (the docker build), such a key's turn runs as a separate machine user: other people's files are refused by the kernel rather than by the interface. In the app on Windows and macOS there is no such thing — there the boundary remains the key's scope.
A linked Telegram chat is full access too
It writes to the agent with the machine owner's rights. That is why linking goes through a one-time code valid for 10 minutes, and why the bot doesn't answer an unknown chat at all. For a chat that only needs notifications there is a "read only" mode.
There is no TLS inside
The api speaks plain HTTP. Don't expose its port without a reverse proxy with auth.
If you need https — either a one-click tunnel (it gives https right away), or your own domain behind a proxy, or a VPN, where the question of public access disappears entirely.
A short checklist
- The key is long and not reused.
- Outwards — only through a proxy with auth, a tunnel or a VPN.
- For guests — named keys with a scope, not the main one.
EXTRA_WORKSPACE_ROOTandGH_TOKEN— as needed, not "just in case".- Question interception on someone else's session — don't leave it on unattended.
What this is not
Clauder is single-user by design. Read-only keys and keys scoped to selected projects do exist, but that is not RBAC, not OIDC and not teams. For a company this is not the tool.