Concept · Security · 5 min read

Secured interaction

Kaptain's security posture is built from a few blunt decisions rather than many subtle ones: no internet exposure exists, every risky action passes one gate, and every credential does exactly one job.

Local-first is the security model

The runtime, your conversations, your keys, and your project all live on your machine. There is no Kaptain cloud that sees your prompts. What CHYNJ's servers hold is licensing metadata — and even there, fingerprints travel as hashes and codes are stored as hashes.

Two network modes, no third

Local only binds 127.0.0.1. Tailscale binds your tailnet address — only devices in your own tailnet can attempt a connection, and each still needs the access code. A plain LAN or public bind is refused by the binary; an unrecognised mode falls back to Local only. In Tailscale mode even local scripts must use the tailnet address — the mode never lies about its surface. The device allowlist narrows further, with staged saves so a stray click changes nothing.

Four approval modes, one gate

Ask (popup per risky action), Read-only (mutations denied), Auto-approve in workspace, Full access. Built-in tools, MCP tools, and shell commands all pass the same gate; read-only shell pipelines auto-run so approval fatigue doesn't train you to click yes. The mode is set per model and per kapsule — and it ships inside the kapsule file, so an imported agent carries its own policy.

Scopes name targets, never tools

A trusted scope pre-approves one path (optionally read-write), one MCP server, or one web host. Granting a target doesn't widen the mode; the ceiling still applies. This is the difference between "this agent may edit this folder" and "this agent may edit."

Three codes, three jobs

chynj_… signs a person into this Kaptain. kcat_… lends compute to another Kaptain — observe, infer, or admin, never tools. The device certificate identifies the machine to CHYNJ's licence server. None can impersonate another, which is why a leaked lending code can't read your chats.

Remote access, honestly

Every browser session binds to the current access code — rotate the code and every device re-pairs, on purpose. The access log shows who reached this Kaptain: IP, path, status, and whether the request was authenticated. Guides: Tailscale & remote access · HTTPS over Tailscale.

Agent-readable version: index.md