Your computer.
Explicit access.
Bridge is an owner-authorized file and process tool. It is not a sandbox. Shell commands can read, modify or delete data, use the network and invoke programs with the privileges of the OS user running Bridge. A separate OS account with only the required access is appropriate for sensitive tasks.
Two connections, one local toolkit
Local-only: a compatible desktop client starts the agent over stdio. The bundle's local-access setting starts disabled; manual stdio mode requires serve --allow-local-access. Managed preview: you explicitly start node bin/bridge.mjs connect, enter its short-lived code on the Bridge authorization page and authorize a supported AI client. The agent makes outbound HTTPS requests. Neither route requires exposing an inbound Mac port or an anonymous shell.
Account and device authorization
The managed path uses OAuth authorization codes with PKCE S256, exact resource and redirect binding, hashed bearer tokens and a device-bound job queue. One-time pairing codes expire after 10 minutes. The connected client can route work only to its authorized device/account; database functions check ownership and revoked/expired authorization. Public MCP discovery describes the tools, not a connected user's files.
Checked writes are not a sandbox
New-file creation refuses an existing target. Replacement requires the current SHA-256 and checks it again before replacement; literal edits reject ambiguous matches. The agent serializes its own writes and uses an atomic replacement. This reduces accidental stale edits; it is not a lock against every unrelated process, a backup or a restriction on shell commands. Read back important changes and run the relevant checks.
What leaves your Mac
Requested file contents, paths, images and command output are returned to the configured AI client. In managed mode, request and result envelopes are encrypted for short-lived queue storage. The live relay processes the request and returned result, so this is not end-to-end secrecy from Ganado. Routing metadata remains visible to the service. The device private key stays on the device; see the complete data and retention disclosure.
Stop and revoke
Ctrl-C stops the active connection; it does not erase the registered device identity. node bin/bridge.mjs disconnect requests revocation before deleting local relay state. Keep the state and retry if revocation is not confirmed. Revocation prevents future authorized work; it cannot undo a completed edit or guarantee that an already-started command or remote SSH descendant has stopped. A timeout is an unknown result: inspect state before repeating a write or command.
Secrets and untrusted content
Never paste pairing codes, device tokens, API keys or customer logs into a chat, issue or support report. Keep local relay state private. Child commands omit selected credential environment variables, but owner-level access is not secret isolation. Files and command output can contain hostile instructions; treat them as data and do not approve unrelated actions because a document asks for them.
Verification and limits
Public artifact checks exercise file operations, stale-hash rejection, bounded search and real process exit codes. Maintainer-run isolated database tests exercise cross-account denial, lease binding and revocation races. These are engineering checks, not a third-party penetration test or a certification. macOS is the primary supported preview; no Windows, enterprise SSO or graphical desktop-control support is promised.
Report privately
Email info@ganado.cz with the subject Bridge security report. Include the affected version, impact and a minimal reproduction using synthetic data. Do not test other users' devices or publish credentials. There is no paid bug-bounty or guaranteed response time. The local MIT licence includes its warranty disclaimer; mandatory rights are not waived.