Security model

This is a local development tool, and its founding requirement is that it adds no remotely reachable surface and no silently enabled surface to your machine. The canonical policy lives in SECURITY.md; this page is the plain-English tour.

The invariants

• No network listener for MCP. The MCP server speaks stdio to its client and never binds a socket for that purpose.
• Loopback-only control plane. The driver⇄agent channel binds 127.0.0.1 exclusively, on an ephemeral port, authenticated with a per-session 256-bit random token. Agents reject non-loopback binds and unauthenticated peers.
• Agents are disabled by default. With no launch flag, no config opt-in, and no in-game opt-in gesture, an installed agent registers no listener and exposes nothing. The in-game opt-in (title-screen button + confirmation) lasts at most until the game process exits.
• Reflection writes are gated. Reading live game state requires an authenticated session; writing additionally requires an explicit per-session capability grant.
• No telemetry. Nothing phones home. Outbound network use is limited to explicitly requested provisioning (e.g. downloading a Paper server jar) and dependency installation.
• GitHub releases only. The agents are deliberately never published to mod/plugin marketplaces — they are development tooling, not player-facing products.

The build is held to the same bar

Coverage-gated tests (≥90% enforced — the build fails below it), CodeQL static analysis, an OpenSSF Scorecard workflow, SHA-pinned CI actions with least-privilege tokens, a protected release branch, and private vulnerability reporting. Found something? Please report privately — see Security on GitHub.