Security model

How Agora authenticates callers, isolates browsers and apps, and what it does not protect against.

Agora controls a real computer with logged-in browser sessions. Treat access to it like SSH access to the host.

Network exposure

The daemon listens on 127.0.0.1:7788 and refuses to bind to any other interface unless you set AGORA_ALLOW_PUBLIC=1. Don’t.
For remote access, publish it through an authenticated tunnel (for example Cloudflare Tunnel with Access, or an SSH tunnel). Never open the port to the internet.
Chromium is controlled with --remote-debugging-pipe: there is no CDP TCP port. X displays are local to the host and never exposed.
WebRTC needs UDP to the host. Behind HTTP tunnels, viewers use the WebSocket transport instead.
The embedded dashboard is served with a strict Content Security Policy (default-src 'self').

Tokens

Every API call needs Authorization: Bearer <token>. Streaming endpoints also accept ?token= because browsers cannot set headers on WebSocket and <img> requests.

Token	Scope	Where it comes from
Admin	Everything.	Generated on first start in `admin.token` (mode 0600). `agora token` prints it.
Cursor	Its own workspace and its own descendants, limited by its permissions.	Returned once by `POST /v1/cursors`. Agora stores only a hash.
Viewer	Streaming one workspace, with or without input, for at most 24 hours. Rejected on every other endpoint.	`POST /v1/viewer-tokens` or `agora open`. HMAC-signed with `viewer.key`.

Give agents cursor tokens, never the admin token. Permissions only narrow down the tree: a child can never get a permission its parent lacks, and only cursors with workspace can create workspaces, freeze, suspend, fork or take control.

Process isolation

When the daemon runs as root, apps and browsers run as the unprivileged agora user (home /var/lib/agora-apps), with no access to root’s files.
Chrome’s sandbox stays on.
Each workspace has its own processes, display and (by default) browser profile. Processes start inside a per-workspace cgroup when cgroups v2 is available, which enforces memory_mb and cpu_percent budgets.
Request bodies are capped at 8 MB.

What Agora does not isolate

Isolation between cursors in the same workspace is logical: tab owners, surface locks and token scopes. They share one display, one browser profile and one Unix user. A cursor with browser permission can read any page in that profile.

For agents you do not trust:

Put them in separate workspaces (separate processes, display and profile), and do not give them the workspace permission.
Use a dedicated profile without your personal logins.
Keep process and desktop off unless the task needs them: process launches programs as the agora user.

Agora does not checkpoint memory: a suspended workspace keeps cookies and storage on disk in its profile, not open page state.

Reporting a vulnerability

Email security@olimpia.dev with the details. Please do not open a public issue for security reports.