Ask
Every request waits for an answer: once, for this chat, or always for the project.
Security
Safe by default. Honest about the limits.
Polyth runs agents that edit files and run commands on real machines, often with other people's work nearby. Every design decision starts there: refuse when unsure, keep a person in the loop for anything risky, and never hand a secret to a model.
Three levels. A person for every risky call.
Choose a default for the Space and the project, and override it per chat. Helper agents inherit their parent's level.
Auto-approve
Routine work is answered automatically. High-risk requests still wait for a person.
Full access
Everything not blocked by an explicit deny rule runs. Opt-in, after a confirmation, and shown in red.
Auto-approve never answers these.
They arrive as an ordinary card with the reasons listed, and only Deny or Allow.
- Destructive deletes
- Discarding uncommitted work
- Force-pushes and history rewrites
- sudo-style escalation
- System and device changes
- Piping downloads into a shell
- Secrets and credentials
- Data uploads
- Publishing and deploys
- Writes outside the workspace
- Database destruction
- Commands too large or dynamic to read
Deny rules always win
An explicit deny beats every level, including Full access.
No self-promotion
An agent may reject a request or turn Auto-approve off. Approving, or turning autonomy up, is refused.
Tokens can't approve
Command-line and automation tokens can run agents but never answer a permission request.
Protected accounts
A Space with a protected member never answers on its own: a person decides every time.
Credential Vault
Agents use secrets without ever seeing them.
You enter it once
A protected form collects the value. It never passes through the chat or the model.
The agent gets a handle
The agent refers to the secret by name, never by value.
The server fills it in
For one command, the server puts the value into that process only, removes it from the output, and records only the handle in the audit log.
! GH_TOKEN=$POLYTH_SAFE_GITHUB gh release create v1.2 POLYTH_SAFE_GITHUB filled in by the server, for this command only ✓ Created release v1.2 any echo of the token → [redacted]
- Your secrets stay yoursA person's own entries come first, then the Space's. Another member's entries are never used.
- Packages are fenced offEach package can reach only its own stored keys, even if it guesses another's name.
- Where it does not applyInteractive terminals, remote hosts, browser sign-in and the agents' own runtimes do not receive vault values. Signing in to a website is always done by a person.
Closed until you open it.
Loopback first
A fresh server listens only on this machine. Publishing it takes an HTTPS proxy you name explicitly; forwarded headers from anyone else are ignored.
An owner from the start
Setup needs a one-time claim token printed on the server, creates the owner account and hands out recovery codes.
Phones without open ports
Polyth Link connects a phone over an authenticated, encrypted QUIC tunnel. Pair by QR code, nearby discovery or a six-digit code.
Default-deny devices
A paired device can do nothing until the owner grants it access, and access can be revoked at any time.
Sessions you control
Login attempts are rate-limited, and remembered devices can be signed out remotely.
No secrets in the open
Secrets and private keys never appear in settings responses, logs or prompts.
Boundaries the server enforces.
Spaces
Every request is resolved to a Space and checked for membership before any data is touched. Stored data lives per Space.
Files
File access is confined to the project. Path traversal and symlink escapes are rejected.
Installed packages
A package either runs sandboxed, with only the capabilities you granted for that Space, or needs a source you trust before it may run server code. An update cannot quietly leave the sandbox.
Processes
Polyth owns every agent process it starts, under a supervisor that records when a process is really gone. After a crash it recovers from confirmed history and never replays an action whose outcome is uncertain.
Limits
What Polyth does not promise.
The risk check reads what the agent says it is about to do. It is a tripwire, not a sandbox: an agent's own tools still run with the permissions of the account that runs Polyth. When you need hard isolation, run Polyth in a container or a virtual machine that holds only what the agents should reach.
Full access means full access. Use it in throwaway environments, not on the machine with your only copy of anything.
This website
Static, and nothing else.
polyth.app is plain HTML, CSS and a few lines of JavaScript from our own domain. No cookies, no analytics, no third-party scripts or fonts, and a content security policy that lets nothing else run.
Disclosure
Found a vulnerability?
Please don't open a public issue. Report it privately through the Security tab of the repository, with what an attacker can do, the affected version and your deployment, and steps to reproduce. We will keep you updated and credit you in the fix unless you prefer otherwise.