Security and access

Only connect an agent you trust to use your computer.

What you approve

Someone must approve locally on the computer. Opening a setup link or signing in does not grant access. Temporary requests show a name chosen by the requester; ezremote does not verify that name.

You choose which of Files, Terminal, Browser and MCP servers each agent can use. File tools can be limited to selected folders.

Terminal commands run in a sandbox by default (Seatbelt on macOS, bubblewrap on Linux). They can read most files and reach public internet hostnames, but can only write inside approved folders and the temp folder, block known SSH, cloud, Claude/Codex credential folders, browser data and helper state, cannot change shell startup files or the helper, and cannot reach addresses on your local network. Secrets stored elsewhere may still be readable. Commands do not inherit credentials from the helper environment. Literal IP requests are blocked, and helpers configured with upstream HTTP proxies refuse sandboxed Terminal. A blocked command reports what was refused. You can give one connection full Terminal access; its commands then have your computer user's full permissions. Temporary connections never include Terminal or local MCP forwarding. Windows cannot sandbox Terminal yet, so it needs full access there. On Ubuntu 24.04 or newer, an administrator may need to allow bubblewrap's user namespaces through AppArmor.

MCP forwarding is off by default and needs explicit signed-in consent. It uses servers you already configured for Claude, Codex, Cursor or Windsurf, with their own permissions. The Terminal sandbox does not apply to them.

Browser access asks separately. It covers all open tabs in the approved profile, including signed-in pages.

How long access lasts

Temporary connections end within 24 hours of the request. Signed-in connections last until you remove them. Saving a temporary connection to an account makes it lasting. Its agent must renew its direct token before the seven-day credential expiry.

Every agent token belongs to one agent identity, can be revoked individually, and expires within seven days. Dashboard tokens last 24 hours. A token can restrict the agent to one computer; connection permissions select operations; it cannot approve a new computer.

What the service sees

Traffic is encrypted in transit. The service can read the requests and results it relays; the connection is not end-to-end encrypted. The operator and your integration's backend must be trusted.

Activity records contain operation metadata. Large transfers pass through private, temporary cloud storage. Keep tokens and download links out of public chats, logs, and repositories.

When enabled, PostHog receives basic page, setup, and operation events with pseudonymous analytics IDs. Analytics excludes credentials, setup-link secrets, names, email addresses, commands, file paths, file contents, and browser contents. Session replay and automatic content capture are not enabled. Browser analytics honors Do Not Track; backend events are separate operation metadata.

The installer checks downloaded files against SHA-256 digests. Signed helper releases are not available yet.

Stop access

• One temporary connection: open its setup page and choose Stop this connection.
• One account agent: change its permissions or disconnect it in the dashboard.
• One agent on a computer: choose Remove for it in the menu-bar or tray icon.
• Remove all access to a computer: run ezremote revoke locally. This removes its grants and rotates its device token.

Stopping access blocks new work. It cannot undo completed work or guarantee stopping commands already sent. Closing a setup page does not stop the connection.