Security Overview

Captain Who uses a local-first desktop architecture: application state is stored primarily on the device, and the Agent's Tool invocations undergo type validation, permission decisions, and user approval where required. It is not a general-purpose operating-system sandbox and cannot replace account isolation, disk encryption, backups, or endpoint security software.

Primary protection boundaries

The chat interface cannot directly obtain arbitrary Node.js, file-system, or process capabilities; sensitive operations are handled by a trusted application layer.
Tool names and model descriptions do not constitute authorization. The application decides whether to allow, ask about, or deny an action based on the actual Tool identity, current project, permissions, and parameters.
Approval is bound to a specific action. A model cannot use text alone to expand one approval automatically into permanent permission.
External MCP, Skills, web content, attachments, and model output are all treated as untrusted input.
Files, commands, browser targets, uploads, downloads, and generated artifacts undergo their respective path and identity validation.
If an invocation may already have caused side effects but its outcome cannot be confirmed, the system reports an unknown state instead of replaying it automatically.

Decisions that remain the user's responsibility

Choose trusted model Providers, Skills, MCP Servers, and websites.
Check the target, parameters, and potential impact in every approval.
Enable Full permissions or automatic execution only when genuinely necessary.
Protect the local account, application data, project directory, and credentials.
After an external call times out or disconnects, verify the target system before deciding whether to retry.

Important residual risks

File and command restrictions are application policies, not process containers. An authorized process may access other resources allowed by the operating system.
An external MCP Server is a local process; Captain Who does not guarantee its behavior or supply chain.
Model Tokens and the Tavily Key are separated from ordinary configuration. Signed macOS releases use the system keychain, while SQLite retains only opaque references.
Full/Custom Automation can cause side effects while the user is not watching the screen, and pausing a task does not stop a Run that has already started.
Native notifications may be absent, delayed, or duplicated in a very small crash window, and may appear in the lock-screen notification center.
If the device or user account is already compromised, Captain Who cannot provide a trusted-execution-environment guarantee.

See Data and Permissions for actual data destinations and permission modes.