What agents can do in your project, and what they can’t.
MADRE runs on your computer. It uses no cloud of its own and doesn’t keep your keys. On this page I’ll tell you what agents can do, how you undo what they change in your files, which limits the beta still has and how to tell me if you find a flaw.
In short
- MADRE runs on your computer, with no cloud of its own, and does not keep your keys.
- Every message carries a permission. If you say nothing, the agents only read.
- At
#3 Edit, MADRE keeps a copy before the turn and Undo takes everything back. - You see every connection MADRE can make and a log of the ones it made. Further down are the limits the beta still has.
The basics
First, what MADRE doesn’t do.
It uses no cloud of its own.
MADRE has no servers and no accounts. It runs only on your computer (at
127.0.0.1) and stops when you close the terminal.It doesn’t keep your keys.
It uses the sessions your agents already have. If you give it an access key, it puts it where that agent looks for it, locked to your user, and keeps no copy.
It doesn’t sit between you and your provider.
What an agent reads goes to its provider (OpenAI, Anthropic, Google or OpenCode’s) with your account and your limits. It doesn’t go through MADRE.
Permissions
You decide how far each agent gets to go.
Every message carries a permission level (a mode). Nothing that message kicks off can go past that level. If you don’t say otherwise, agents only read.
- #0
Incognito
Off the record. Nothing is saved and it is gone on reload.
- #1
Chat only Default
Reads the project and talks about it. Writes nothing.
- #2
Create
Creates new files where they belong in the project. Existing ones are not touched.
- #3
Edit
Edits the project, without approving action by action. Asks you to confirm.
- #4
Full access
Runs commands, pushes and deploys. What leaves the machine does not come back. Asks you to confirm twice.
#3 Edit asks you to confirm. For an agent to edit, you confirm it on a sheet that says what it will be able to do. If you prefer, in Settings › Permissions you set a phrase of your own and MADRE asks for it instead.
#4 Full access asks you to confirm twice. Out of the box you confirm twice in a row, or type your phrase twice. On top of that, the agent has to be allowed to go that high, and you decide that too.
No agent grants itself permission. No agent can raise its own permission, not even by putting it in its answer.
Undo
Before an agent edits, MADRE saves a copy.
In #3 Edit, MADRE saves your project before the turn. When it’s done, it shows you what changed, and Undo puts everything back the way it was.
- The copy is a git commit.
- It’s saved under
refs/madre/checkpoints/and doesn’t touch your branch, your index or your stash. If your folder doesn’t use git, the copy is kept separately, outside the project, in a folder only you can open. - Protected zones.
- For as long as the turn lasts, your
.envfiles,.pulse/,.madre/and.claude/settings.local.jsonare read-only. - You see it when it ends.
- The turn tells you which files changed, and its Undo button takes the project back to the restore point.
Careful with #4 Full access. Files come back with Undo, but a git push or a deploy has already left your computer, and that can’t be undone. Turn it on only if you’d lend that agent your terminal.
Transparency
You see every connection MADRE makes.
In MADRE you’ve got a list of every internet address MADRE can connect to, and a log of every connection it made.
Every address, in sight. Each one tells you what it carries, when it goes out and where you switch it off. The anonymous errors (what failed and how much it’s used, without what you write) you turn off in Settings › Updates and errors.
A log you can check. Every connection MADRE made, where it went and when. What was sent is never kept: not the content, not the headers, not the values.
Your keys are never shown. You can read the exact command of each turn. Your keys and environment variables only show up by name, never with their value.
Privacy
Your private data gets hidden on its own.
Hidden before they’re saved. Keys, tokens, emails and personal paths get hidden before they reach the log, the archivist that sums up the memory, the other agents and the dataset.
Private terms. Add the names that must never show up, like your organisation or a client, and MADRE swaps them for a marker at every hop.
Incognito for what shouldn’t stay. Whatever you say outside #0 Incognito stays in the project’s memory and reaches all its agents. If something shouldn’t be remembered, send it in Incognito.
Beta limits
What doesn’t protect you yet.
These are three beta limits. Better to know them before you give an agent permissions.
- #3 Edit undoes, but doesn’t prevent.
- Protected files are made read-only and restored from the checkpoint.
.git/stays writable because the agents need it, and gets restored afterwards. If an agent changes permissions on purpose, the restore catches it afterwards, but nothing stops it beforehand. - #4 Full access is your terminal.
- It runs commands with the CLIs and sessions on your computer, like tests, builds,
git pushor deploys. Files come back with Undo. What already left your computer doesn’t. - Memory belongs to the whole project.
- Whatever you say outside Incognito reaches every agent in that project.
Report
Found a security flaw? Tell me privately.
If an agent writes outside its permission, keeps #3 Edit when it shouldn’t, reaches the memory of another project or makes MADRE send something you didn’t allow, tell me first, privately.
Open a private advisory on GitHub Use the private form
- What to send me.
- The version (
madre doctor --json), your platform, which agent and mode you were using, and the shortest run of messages that makes it happen again. - What happens next.
- The fix ships in a patch release, and the advisory goes public once that fix is out. If the problem is in the CLI itself (Codex, Claude Code, Gemini CLI or OpenCode), I pass it on to that project.