[ Security ]
A tool that watches everything is a tool that could leak everything.
Byte 2.2.5 has two explicit operating boundaries: a local workspace on your machine and an authenticated organisation cell for devices you enrol. The rest of this page explains what each path reads, sends and refuses.
[ 32 · The boundary ]
Local mode starts inside one rule.
Loopback, a local SQLite database and same-origin execution guards define the default boundary. Hosted reporting is enabled separately through device enrolment.
One event's flight through this machine, drawn as a sequence with time running down the page. There are 7 lifelines across it. Inside the wall, 5 of them: the hooks, the handler, 127.0.0.1, SQLite, the screens. Beyond it, 2 more, an alert channel and a remote source, and both are drawn shut. Message 1: the hooks report an event to the handler. Message 2: the handler posts it to 127.0.0.1, the loopback address, which is unreachable from the network. Message 3: it is written to ~/.claude/byte-agent-monitor/dashboard.db, one SQLite file in WAL mode. Message 4 runs the other way: the screens ask for it, and DASHBOARD_TOKEN is required if you expose them. Message 5: the rows come back. That is 5 hops, and every one of them is inside the wall. Message 6 is the only one that goes outward, and it is the one arrow on the drawing that ends at the wall rather than at a lifeline: it is labelled sent 0 B, because no request is made. The plate represents 2 configured local-mode gates and both are shut. Gate 1 is an alert channel, opened by a webhook URL you configure, and nothing is sent until a rule you wrote matches. Gate 2 is a remote source, opened by a machine you add over your own SSH stack, whose transcripts are copied to a staging directory and imported by the same importer that reads local history. Native agent authentication stays with each agent. Hosted mode adds one authenticated path: an enrolled device sends the fields allowed by its privacy tier to its organisation cell. It does not inherit authority from another integration or organisation. Over the recorded local reference night, across 34 sessions, 194 agents and 23,900 events, 0 bytes left the machine. This website uses no analytics or cookies.
Fig. 32 · One packet's flight, hop by hop. Five hops stay inside the machine, and the sixth stops at the wall.
- Measured
- bytes sent over the recorded night: 0.
[ What can leave ]
Outbound paths stay closed until you configure them.
- An alert channel
- Nothing is sent until a rule you wrote matches.
- A remote source
- No secret is stored. An unknown host key fails the sync.
- An organisation cell
- An enrolled device authenticates to one organisation. Its privacy tier decides whether Byte sends metadata, redacted content or permitted full records.
A webhook you configure, a remote source you add, or an organisation device you enrol. Each path is off until you enable it for that purpose.
In local mode with those paths shut, collection stays on the machine. Byte reads supported native history and events, then writes its own local database.
A cloud one has to send prompt text, tool arguments, file contents and whole transcripts to draw the same screens. That comparison is illustrative and names no product.
[ 33 · The defences ]
It refuses to start rather than warn you.
A wide bind with no token and no acknowledgement fails at start-up, naming the three fixes. A warning on stdout is invisible in a container, and gone by the time anyone looks.
- Loopback by default
- The server binds 127.0.0.1 and is not reachable from the network. That bind is the trust boundary and everything else is a layer on top of it.
- The wide bind refusal
- Reach past loopback with no token and no explicit acknowledgement and the server refuses to start.
- Token authentication
- Set DASHBOARD_TOKEN and every API route and the WebSocket require it, compared in constant time.
- A Host header allowlist
- Loopback, plus whatever you name yourself. This is what stops DNS rebinding. CORS is restricted to the same set. Both are browser defences and neither is authentication: neither stops curl.
- Prepared statements, and coercion that fails closed
- Every query is a prepared statement with bound parameters, and query parameters go through one coercion module. It exists because a negative limit used to mean no limit, and an int64 overflow used to mean a 500.
- A same origin guard on spawning
- Every route that starts a process rejects a browser request whose origin is not loopback, so a web page you happen to have open cannot start processes on your machine.
Fig. 33 · Six defences, each with its trigger and its effect.
- Measured
- the defences the product ships.
[ 34 · On disk ]
One file, and you know where it is.
Byte reads supported native history for Claude Code, Codex, OpenCode and Superset. Agent Config also exposes Claude Code settings, skills, commands and MCP definitions with their source paths.
Secrets in MCP URLs and headers are redacted before they reach the screen. The MCP server scrubs hostnames, key paths and addresses too, because tool results land in a model's context.
One SQLite database at ~/.claude/byte-agent-monitor/dashboard.db, in WAL mode, shared by every way of running the product. Four ways data gets in: live hook events, a first-run import of the transcripts already on your disk, a rescan or folder scan you trigger yourself, and an upload of JSONL or an archive. Two ways it gets out, both yours: a backup export from the page header, and any of the eleven CLI commands that read the file directly with no server running. Retention is yours to set: sessions are marked abandoned after an idle threshold and purged after one you choose, and the danger zone that clears everything sits behind an explicit confirmation. Nothing is uploaded, and no copy is kept anywhere else.
Fig. 34 · One file. Four ways in, two ways out.
- Measured
- the storage the product ships and the paths it uses.
[ Reporting ]
Found something? Tell us before you tell anyone else.
One address, read by a person. Credit in the release notes unless you would rather not have it.