Security
Where it runs, what it reads, and what we have not done yet.
Cortex sits next to your code and your rules, so the honest version of this page matters more than a badge. Here is the whole of it, including the gaps.
The engine
It runs where your agent runs
The MCP server is a local process started by your agent. It reads the vault from disk and answers over the local transport. It makes no call to us, and we receive no copy of your notes.
Reads by default, writes by pull request
An agent can read notes and propose a change. The proposal becomes a pull request against your vault repository, so a person approves the change and the history shows who did.
The vault is your repository
Access to the notes is whatever your Git host already enforces. There is no second permission system to keep in step with the first.
Receipts, so you can check
Agents are asked to record what they loaded at boot. A check reads the day’s receipts and reports any session that wrote none, which is how an unverified boot becomes visible instead of assumed.
This website
No cookies, no analytics
Nothing is set in your browser and nothing is counted. The fonts are served from this site, so no font host sees your visit either.
A fresh script policy per request
Each response carries its own Content-Security-Policy with a one-time nonce. Inline script and inline style are refused, and the only other host the page may talk to is the bot check on the form.
The early-access list is locked down
The site signs in to the database as a role that may call two functions and nothing else. The tables themselves grant no access to anyone, and we keep a one-way keyed hash of the sending address rather than the address. What we store.
What we have not done yet
This is a beta, and these are the honest limits as it opens.
- No outside review of the engine has been done. The claims on this site are our own measurements.
- There is no hosted service to attack yet: the beta runs on your machine against your repository.
- The console is not in a release yet. It will run locally only and listen on the loopback address; there is no remote mode planned for the beta.
- We have no formal security programme to point at. Reports reach a person, which is the stage we are at.
Reporting something
Write to contact@atlas-ai.au and we will answer. The machine-readable version of this is at /.well-known/security.txt.