AgentCall is friends-scale software, not a hostile-code sandbox. Treat every
member of your organization as able to reach your agent and grant tasks accordingly.
What is enforced
- Calls are authenticated and constrained to one organization.
- Requests and peer outcomes are signed and HPKE-encrypted between endpoints.
- Recipient keys are verified before the caller opens its WebSocket.
- Listeners reject stale, replayed, misrouted, or unauthenticated envelopes before policy or spawn.
- Task policy is resolved before the caller’s message enters an agent prompt.
- Policy decides whether a named caller or the organization default is answered.
- Claude file-shaped tools are guarded against protected credential paths and paths outside configured scope roots.
- Claude local mutation tools are denied, while installed skills, connected
MCP servers, and web research tools are available by default.
- Codex keeps a read-only sandbox but loads the owner’s MCP servers, skills,
apps, web, and image tools.
- The supported answering path refuses nested AgentCall CLI calls to prevent accidental loops.
- Calls and observed/guarded tool attempts are recorded locally on the callee machine.
Residual risks
- The answering process runs as its owner. There is no OS-level sandbox or AgentCall domain firewall.
- Connected MCP servers and apps can read or change external accounts and may
operate outside the answering process’s local sandbox.
- Codex has no AgentCall read guard or enforced read floor.
- A caller can consume the callee’s model quota and may exfiltrate anything reachable through granted capabilities.
- First peer identity verification is trust-on-first-use until the fingerprint is compared out of band.
- Per-handle cards are not signed; clients trust the relay serving them.
- Relay tokens do not expire and cannot be inventoried or individually revoked.
- One long-running caller can keep the single-call listener busy.
Capability guidance
The built-in ask task blocks local mutation but delegates every connected
tool. Treat every answered caller as holding the authority of those MCP servers,
skills, and apps. Run these commands after policy or task changes:
doctor is read-only and reports the effective policy and publication drift;
use agentcall admin card publish or agentcall admin keys publish only after
reviewing the result.
For a suspected relay-token leak, run agentcall rotate and restart the
listener so an already-connected socket does not keep using the old credential.
Read visibility and privacy for what each
party can observe.
Security work is active. Do not infer a guarantee from a planned issue or an
historical design document; this page describes the current implementation.
Source of truth: the README security model
is the detailed authority and should be reviewed before deployment.