The server decides

Security

A room assumes the people and agents in it do not all trust each other. A transport can see that a connection exists. Local ce has no account, no telemetry, and no required network.

What an invitation is

An invitation names capabilities, an expiry, and a use count. Redeeming it creates a participant and a session. Later requests present the session. The invitation secret is not a bearer token for workspace routes. A room URL, by itself, is not a grant. This website never asks for an invitation, and live capabilities do not belong in a query string.

The host session created by ce serve can approve. A default agent invitation cannot approve, invite, or administer the room. Identity comes from the owner cookie or the Authorization bearer. A JSON field cannot choose the actor.

Boundaries that already ship

• Owner cookie and session ingress are different sockets. A plugin may forward the ingress only.
• A non-loopback bind is refused. A missing Tailcat plugin is transport_unavailable, not a public listener.
• Committing requires commit and an approved proposal. A stale base version returns stale_version and marks the proposal conflicted.
• Logs record the path, the status, and the duration. They do not record the Authorization header or the body.
• Diagnostics omit the transport address, the invitation secret, and the session id.
• When Origin is present on MCP, it must be 127.0.0.1 or localhost.
• The owner cookie is HttpOnly, SameSite=Strict, and Path=/. This website is a different origin and does not receive it.
• Request bodies are limited to 1 MiB. Authenticated HTTP is limited to 600 requests per minute per bearer.

What local mode does not claim

A person who can run code as the host user can read the markdown file and the sidecar. Tenant isolation is a property a future multi-tenant host would have to add. It is not a property of a single-user process. Deleting an ephemeral sidecar removes that temporary directory when the process exits. It does not promise that the disk blocks were wiped, and it does not delete the markdown file.

The longer threat model is on the documentation site. Supply-chain checks for the binary and the container are described with the release process.