Skip to content

Security and privacy

AgentDock is designed around local execution: it spawns provider processes on your machine and doesn't operate a backend of its own.

AgentDock's security posture follows directly from what it is: a local desktop shell around CLIs you install and authenticate yourself, with no server component of its own.

What stays local

  • Process execution — every agent runs as a local process (spawned via SDK or PTY) on your machine. AgentDock does not proxy, relay, or intercept the network calls those CLIs make to their own providers.
  • Session and workspace data — stored locally in a SQLite database (sql.js) inside your OS's per-user application data directory. There is no remote backend and nothing synced to a AgentDock-operated service.
  • Credentials — AgentDock never stores, transmits, or manages authentication for any agent. See Authentication.

What isn't local

Each provider CLI communicates with its own cloud service according to that provider's own terms — Claude Code with Anthropic, Codex with OpenAI, Antigravity with Google. AgentDock has no visibility into or control over that traffic.

Unsigned builds

Current AgentDock releases are unsigned on both Windows and macOS (no code-signing certificate configured), so Gatekeeper and SmartScreen will both warn on first launch. This is a distribution-signing gap, not a sandboxing or process-isolation issue — see Known limitations.

Related

  • Security model — the implementation-level detail behind this page (context isolation, IPC surface, credential separation).
  • Workspace behaviour — the same local-execution model applied to Compare Mode's forced read-only panes.