> ## Documentation index
> Fetch the complete documentation index at: https://haarness.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust boundaries

Haarness runs commands an agent wrote, tools you installed and servers you connected. This page
answers what each of them can reach, so you can decide what to trust and where to run it.

## Is Haarness a sandbox?

**No.** On your computer, the agent runs as you. Its shell commands, and the MCP servers,
extensions and hooks you add, can do anything your user account can: read your files, use your
network, see your environment variables.

[Permissions](https://haarness.ai/docs/security/permissions.md) are a check inside Haarness. They catch an agent doing
something you did not intend. They are not built to stop code that is trying to get around them.

| Where it runs | What contains it |
| --- | --- |
| Your computer | Only your user account and your operating system |
| A container or VM you set up | That container or VM |
| A [Cloud workspace](https://haarness.ai/docs/cloud/workspaces.md) | A separate machine per workspace (see below) |

Treat a local agent the way you would treat a script someone sent you. For generated code, that is
what it is. For untrusted code or `--yolo`, use a container or a Cloud workspace.

## Can the agent read files outside my project?

**With shell commands, yes, without asking.** By default every shell command is allowed, and
commands are not confined to the project. Haarness only asks about outside paths for a few
commands (`cd`, `rm`, `cp`, `mv`, `mkdir`, `touch`, `chmod`, `chown`, `cat`) and for output
redirects.

**With its file tools, it asks first.** Reading, writing, listing or searching outside the project
asks for approval. Symbolic links are followed to where they really point, so a link inside the
project that leads outside still asks.

The folders of skills and plugins you installed can be read without asking, but not written.

To be asked about every command, see
[Write your own rules](https://haarness.ai/docs/security/permissions.md#write-your-own-rules).

## Can the agent use the network?

Yes. Web fetches and shell commands are allowed by default, and nothing limits where they connect.
To be asked first, add `"webfetch": "ask"` and a `bash` rule. To remove web fetching entirely,
[turn the tool off](https://haarness.ai/docs/security/permissions.md#turn-a-tool-off-completely).

A web fetch follows a redirect only on the same host. A redirect to another host is not followed;
fetching it is a new request that meets your rules like any other.

## Can a web page or file steer the agent?

It can try. Everything the agent reads, such as a web page, a file, a command's output or an MCP
server's answer, reaches the model, and text in it may try to get the agent to do something you
did not ask for. Haarness does not remove such text. What limits the damage is what the agent may
do without asking: by default it runs commands and fetches pages freely, so keep untrusted work in
a container or a Cloud workspace, or [write rules](https://haarness.ai/docs/security/permissions.md#write-your-own-rules)
to be asked about more.

In Auto, the reviewer never reads what tools returned and counts only your own messages as
permission, so such text cannot approve a request for you.

## What do the agent's commands see?

Shell commands the agent runs inherit your environment, including any keys you exported, such as
`OPENAI_API_KEY`. Haarness leaves out only its own server's credentials
(`HAARNESS_SERVER_TOKEN`, `HAARNESS_SERVER_PASSWORD`) and your tracing settings (`OTEL_*`); the same
goes for terminals, hooks, MCP servers, extensions and language servers it starts.

Each command the agent runs also gets `AI_AGENT=haarness`, `AGENT=1`, `HAARNESS=1` and
`HAARNESS_SESSION_ID` (the chat's id), so a script or tool can tell an agent ran it, for example to
skip an interactive prompt. Your own `!` commands and terminals do not get them.

## Can a repository I clone run code?

**Yes.** Haarness reads a project's configuration as soon as you open the folder. There is no
"trust this folder?" prompt. A repository's `haarness.json`, `.haarness/` or `.opencode/` folder
can:

- add MCP servers, which start right away and run as you;
- add hooks, which run shell commands as you;
- add or turn on extensions, which run code as you;
- add commands, agents, skills and instructions;
- add permission rules that come after yours, which can turn your asks into allows;
- add a model provider of its own, make it the default model, and have it send the key from any
  environment variable you have set, such as `OPENAI_API_KEY`, to the address it names;
- define a provider with the same id as one you set up only in another project, and so receive
  the key you stored for that id;
- name a secret from your system keychain (`${keychain:NAME}`) in an MCP server's settings, which
  hands that secret to the server it configures.

A project **cannot** move a built-in provider, or one from your global configuration, to another
address, so the keys you stored for them only go to their own endpoints. Haarness ignores such an
entry and says so: `haarness providers` prints a line such as `Provider anthropic: ignored the
project's base_url …`. A project cannot change your
[usage statistics](https://haarness.ai/docs/security/data-and-storage.md#usage-statistics) setting either. It can only
make Auto's reviewer and your
[Chrome settings](https://haarness.ai/docs/desktop/use-your-chrome.md#stop-being-asked-about-a-site) stricter, never let
agents into your Chrome without asking. And once a project is open, the agent's file tools ask you
before they change any of these configuration files.

Before you open a repository you do not trust, check those files, or open it with project
configuration off:

```sh
haarness --disable-project-config
HAARNESS_DISABLE_PROJECT_CONFIG=1 haarness
```

Your global configuration still applies.

## What can an MCP server do?

Adding an MCP server is a decision to trust that server, not one tool call.

- **A local server** runs as a program on your computer, as you, with your environment. It starts
  as soon as it is configured.
- **A remote server** sees every argument the agent sends it. If it uses OAuth, you approve it in
  your browser and the token is saved in your Haarness data folder, readable only by you.
- **Its tools run without asking by default**, like the built-in ones. Add a
  [rule](https://haarness.ai/docs/security/permissions.md#write-your-own-rules) such as
  `"mcp__github__delete_repository": "ask"`, or turn single tools off.
- Arguments the agent sends are checked against the tool's declared shape before they go out.

Prefer servers whose source you can read. A server that asks for broad access for a narrow job is
telling you something. See [MCP servers](https://haarness.ai/docs/cli/mcp-servers.md).

## What can an extension do?

An extension is JavaScript or TypeScript that runs in its own process next to the Haarness server,
as you, with full access to your files, network and processes.

- Once extensions are turned on, an extension runs because it is installed or sits in an
  extensions folder. There is no signature check for one installed from a folder or npm.
  Marketplace installs are checked against the published digest.
- `haarness extension list` shows what is registered without running anything.
  `haarness extension check` and `haarness extension install` load the enabled extensions, so their
  code runs.
- A project can turn extensions on and add its own (see above).
- Time and size limits stop a stuck extension. They do not stop a malicious one.

See [Extensions](https://haarness.ai/docs/cli/extensions.md).

## What can a hook do?

A command hook runs a shell command as you, in the project folder, when its event fires. A
repository's hooks run too, unless project configuration is off. See
[Run commands on chat events](https://haarness.ai/docs/cli/hooks.md).

## What can an agent do in my Chrome?

With [Haarness for Chrome](https://haarness.ai/docs/desktop/use-your-chrome.md), an agent works in your real Chrome
profile, signed in as you. On a site you allow, it can do what you can do there: read your mail,
change settings, send messages or buy something.

- **What you allow, the agent can use as you.** Allowing scripts on a site lets the agent run code
  that can read anything on that page. Snapshots hide what is typed in password fields; a script
  can still read them.
- **What it reads goes to your model provider,** like everything else the model sees: page text,
  screenshots and what scripts return.
- **Chrome's own permissions still apply.** If you once let a site use your camera, microphone,
  location or notifications, that site keeps the permission while an agent drives it.
- **It stays in its own tab groups,** and cannot open `chrome://` pages, other extensions, files on
  your computer or Incognito windows. It never brings Chrome to the front by itself.
- **The extension talks only to Haarness on this computer.** It makes no network requests of its
  own; pages load over your own connection, as when you browse.
- **Its folder can be changed by anything running as you.** The unpacked extension lives in your
  Haarness data folder (`~/.local/share/haarness/browser/chrome/`). A program running as you,
  including the agent's own shell commands, could change those files, and Chrome would run the
  changed extension the next time it loads it, with its access to your tabs. Treat that folder
  like the rest of your Haarness data.
- **Developer mode stays on** while you use an unpacked extension, so Chrome lets you load other
  unpacked extensions too. Load only ones you trust.

Every site asks before the agent uses it, in each chat, and Auto cannot answer for you; see
[Websites in your Chrome](https://haarness.ai/docs/security/permissions.md#websites-in-your-chrome).

## Plugins, skills and agents from the marketplace

Treat a marketplace item like any other dependency.

- Every item has a publisher, a version history and a manifest of what it contains.
- Installing records the exact version and its digest. Nothing updates on its own; you run update.
- Without `--version`, you get the version currently offered.
- A version can be withdrawn. A withdrawn version can no longer be installed; a copy you already
  installed stays until you remove it.
- Everything is validated before it can be installed. Public items are also reviewed by a person
  before they are listed. Private items in your own account skip that review.

Prefer publishers you recognise, read the manifest, and pin versions in anything automated. See
[Install a plugin](https://haarness.ai/docs/cli/plugins.md).

## How is a Cloud workspace isolated?

Each Cloud workspace runs on its own machine, with its own encrypted disk and no public address. The
agent runs there as an unprivileged user.

- **Network:** the workspace can open outgoing connections to the internet on the usual web
  (HTTP, HTTPS), SSH and DNS ports.
- **Model keys:** provider keys stay in the Haarness router and never enter the workspace. The
  workspace gets its own key, created when it starts and revoked when it stops or is deleted. One
  request can spend at most 2,000 credits; beyond that, spending is limited by your balance and
  the budgets you set.
- **The worst case** is what that workspace can reach: its own files, the keys and environment
  variables you gave it, the repositories its deploy key can access, and your credit balance.

## Environment variables in a Cloud workspace

Environment variables you add to a workspace are stored encrypted and never shown again. They are
given to the workspace each time it starts, and **any code running in the workspace can read them**.
That is what they are for; a value cannot be hidden from the program it was given to.

- Change them while the workspace is stopped; they apply at the next start.
- The workspace's deploy key is on its disk, and the agent can use it. Give it write access only if
  the agent should push.
- Give each workspace only what it needs, prefer short-lived tokens, and rotate them.

## Related

- [Permissions](https://haarness.ai/docs/security/permissions.md) — what the agent may do without asking
- [Data and storage](https://haarness.ai/docs/security/data-and-storage.md) — what leaves your computer
- [Use your Chrome](https://haarness.ai/docs/desktop/use-your-chrome.md) — set up and control Haarness for Chrome