Feature
Trust gates
Hooks, MCP servers, wildcards and inline secrets are blocked before any write.
Every asset has a trust class. The trust gate runs before anything is written and blocks denied hooks, unapproved MCP servers, permission wildcards, sandbox weakening and inline secrets, each reported as a diagnostic with a stable dotted code.
Committed projections need a local approval: a per-machine record naming the package, version, surface, target, path and content hash. It never authorizes anything for the whole organization.
More features
All features →- 01
Home workspace package manager
Install, list, upgrade and remove AI config packages in your home directory.
- 02
Secrets that stay on your machine
{{secret:NAME}} references resolve locally at apply time, never in the registry.
- 03
Plugins and reversible settings
Settings edits you can undo, and plugins installed only from your allowlist.