Workspace boundaries
Authorize only directories needed for the current task. Prefer project-specific access over a home-directory or filesystem-wide scope. Verify path traversal protections and symlink handling in the version you install.
Protect secrets
Keep .env files, private keys, credentials, tokens, and production secrets out of AI-accessible paths where possible. Redaction is a defense-in-depth control, not a substitute for least privilege or secret rotation.
Command execution
Start with the most restrictive permission mode. Review commands before enabling writes, package installation, destructive operations, deployment, or access to production services. Use Git status and diffs to inspect changes before accepting them.
Remote access
Any public endpoint that can access local files or execute commands should require appropriate authentication and authorization. Do not rely on a hard-to-guess URL, CORS headers, or a Cloudflare/ngrok tunnel as your only access control.
Before connecting a remote AI client
- Update SFI Agent and verify the installer source.
- Authorize only the intended workspace.
- Confirm the dashboard is not unintentionally public.
- Use authentication or an appropriate access policy for privileged MCP tools.
- Test rejected unauthenticated requests and cross-workspace isolation.
- Inspect logs and Git diffs after tool activity.
- Stop the tunnel and revoke credentials when access is no longer required.