Approve and stop access
For people deciding whether to let an agent use their computer, and how to stop it.
Before you approve
Opening a setup link or signing in grants nothing. Access starts when you approve in the terminal on the computer. Check three things first:
- You just asked for this. The agent typed its own name, and ezremote can't verify it.
- The permissions fit the task. Turn off the rest.
- The access time shown. Temporary access ends within 24 hours. Access saved to an account lasts until you revoke it.
Until access ends, the agent's commands run as your computer user, within the permissions you chose.
What each permission allows
| Permission | Lets the agent | Limits |
|---|---|---|
| Files | Read, list, search, write and edit files | Can be limited to chosen folders. |
| Terminal | Run commands and keep sessions open | Sandboxed unless you choose full access. Folder limits don't restrict what commands read. |
| Browser | Use every tab of a separate Chromium browser, with any sign-ins you imported | Asks separately. |
| MCP servers | Call MCP servers you set up for Claude, Claude Code, Codex, Cursor or Windsurf | Off by default. Needs an account and your consent. Runs outside the sandbox with each server's own permissions. |
The Terminal sandbox
By default commands run in a sandbox: Seatbelt on macOS, bubblewrap on Linux. A sandboxed command can read most files and reach public internet hosts. It can write only in approved folders and the temp folder. It can't read known SSH, cloud, Claude and Codex credential folders, browser data or helper state. It can't edit shell startup files or the helper, reach local network or literal IP addresses, or inherit the helper's credentials. Secrets kept elsewhere may still be readable. The agent sees what was refused and should tell you.
Full access gives one connection's commands all of your user's permissions, and only a connection saved to an account can have it. Windows has no sandbox yet, so Terminal there needs full access and temporary connections get none. On Ubuntu 24.04 or newer, an administrator may need to allow bubblewrap's user namespaces in AppArmor. A helper behind an upstream HTTP proxy refuses sandboxed Terminal.
How long access lasts
Temporary connections end within 24 hours of the request, and lasting ones when you revoke them. Agent credentials expire within seven days and the agent renews its own. A credential identifies one agent and can never approve a computer. Limits has the exact numbers.
What the ezremote service can see
- Traffic is encrypted in transit, not end to end. The service can read the requests and results it relays, so you are trusting whoever runs it.
- Activity records keep operation metadata. Large transfers pass through temporary private cloud storage.
- With analytics on, PostHog gets page, setup and operation events under pseudonymous IDs. They exclude credentials, setup-link secrets, names, email addresses, commands, file paths, file contents and browser contents. There is no session replay, and browser analytics honour Do Not Track.
- The installer checks downloads against SHA-256 digests. Helper releases aren't code-signed yet.
Stop access
| To stop | Do this |
|---|---|
| One connection | Disconnect on its setup page. A saved connection needs the same account signed in. |
| One agent on this computer | Remove in the menu-bar or tray icon. |
| An agent on your account | Change or remove it in the dashboard. |
| Every agent on this computer | ezremote revoke on the computer. It removes every grant and replaces the computer's credential. |
| One Terminal session | ezremote sessions list, then ezremote sessions kill ID, or the tray. |
Stopping blocks new work. It can't undo finished work, and a command already sent may still finish. Closing the setup page stops nothing. ezremote status shows whether the helper runs. If ezremote isn't on your PATH, use ~/.local/bin/ezremote on Mac and Linux or ezremote.cmd on Windows.