Security
Updated
RightNow Agent, the terminal coding agent, is paused. Its guides stay online as reference.
Read this before connecting a provider or letting the agent run tools in a repository.
The shipped configuration sends prompts and relevant tool results to RunInfra at https://api.runinfra.ai/v1. RightNow Agent is not an air-gapped product.
Build from source
The reference below describes a build from the pinned agent source.
Credentials
- The shipped RunInfra provider preset reads
RIGHTNOW_API_KEYand acceptsRUNINFRA_GATEWAY_KEYas a fallback. Other featured provider presets useCEREBRAS_API_KEY,GROQ_API_KEY,OPENROUTER_API_KEY, andAI_GATEWAY_API_KEY. - Direct Anthropic uses
ANTHROPIC_API_KEY. Direct OpenAI usesOPENAI_API_KEY. - The Connect screen probes keys before storage. A key may be stored when it is valid or when its provider is unreachable and the probe result is unknown.
- Stored keys use the first nonempty override,
RIGHTNOW_AUTH_PATHthenGROK_AUTH_PATH, or otherwise<RIGHTNOW_HOME>/auth.json. The agent attempts to set owner-only permissions. If permission tightening fails after writing or renaming, it logs a warning without failing an otherwise successful write. - For a model credential, a nonempty
api_keywins, then the first nonempty resolvedenv_key, then the selected provider's stored key. - Keep credential values in the environment or the auth store, not in committed config, documentation, receipts, or shared logs.
Receipt projections omit header and query values, but the full effective sampling config contributes to a hash. Review every diagnostic artifact before sharing it.
Network boundary
| Activity or setting | Effect and boundary |
|---|---|
| Model requests | Model requests go to the selected provider. |
| Web tools | Web search and web fetch contact public sites when called. |
| Integrations | MCP servers, hooks, proxies, and custom providers keep their own command, network, and credential behavior. |
| Model catalog | remote_fetch = false disables optional model-catalog fetching only. |
| Telemetry | telemetry = false does not disable model or tool traffic and does not remove the local unified log. |
| Updates | Native updates follow the selected stable or alpha channel and verify the download against the release manifest, its SHA-256 sidecar, and the published size before activation. Native updates also verify the publisher signature before activation. rightnow update --check --json reports the decision without installing. |
Permissions are decision gates
--always-approve, --yolo, and --dangerously-skip-permissions auto-approve tool execution. Do not use them for untrusted work.
On Windows, permission prompts are application-level decisions, not kernel-enforced filesystem or network isolation. Use an external containment boundary when stronger isolation is required.
Untrusted input and integrations
- Treat repository text, command output, fetched pages, MCP output, hooks, and migrated rules as untrusted input.
- Review commands, paths, destinations, URLs, headers, and environment values before approval.
- The shipped configuration disables machine-wide Claude and Cursor skill, rule, and agent imports. MCP migration is opt-in.
Vulnerability reporting status
Report vulnerabilities privately. Do not open a public issue or publish reproduction details. Include the affected version and operating system, the impact, reproduction steps or a minimal proof of concept, and relevant configuration with credentials and personal data removed.
Next task
Choose permission rules before approving repository work.