Security

The 4-layer sandbox, in the open.

CVE-2025-59528 — the Antigravity sandbox escape (CVSS 10.0) — is why Mooter ships sandboxing as mandatory. Every spawned agent runs inside four isolation layers, and there is no --no-sandbox.

  1. 01Network egress

    An empty network namespace for isolated spawns — a local agent has no route off the machine.

  2. 02Filesystem boundary

    Read-only root, exactly one writable worktree, and secret directories masked out of view.

  3. 03Secrets scoping

    Cleared env plus an explicit whitelist — provider API keys are excluded from local spawns.

  4. 04Config protection

    Your settings stay read-only. A spawned agent cannot rewrite the rules it runs under.

Verify it yourself

mooter security audit reports the layers active on your host. mooter security spawn-test runs a real escape attempt and must block reading ~/.ssh, writing outside the worktree, and leaking the API key.

← Back homeopen source, MIT · audit the sandbox on GitHub