Security

Release status

RightNow Agent is coming soon for Windows, macOS and Linux. Installation commands and workflows in these guides are reference material until the public release is available.

Read this before connecting a provider or letting the agent run tools in a repository. The shipped configuration sends prompts and relevant tool results to RunInfra at https://api.runinfra.ai/v1. RightNow Agent is not an air-gapped product.

Credentials

The shipped RunInfra provider preset reads RIGHTNOW_API_KEY and accepts RUNINFRA_GATEWAY_KEY as a fallback. Other featured provider presets use CEREBRAS_API_KEY, GROQ_API_KEY, OPENROUTER_API_KEY, and AI_GATEWAY_API_KEY.
Direct Anthropic uses ANTHROPIC_API_KEY. Direct OpenAI uses OPENAI_API_KEY.
The Connect screen probes keys before storage. A key may be stored when it is valid or when its provider is unreachable and the probe result is unknown.
Stored keys live in <RIGHTNOW_HOME>/auth.json, written with owner-only permissions.
An environment variable always wins over a stored key.
Keep credential values in the environment or the auth store, not in committed config, documentation, receipts, or shared logs.

Receipt projections omit header and query values, but the full effective sampling config contributes to a hash. Review every diagnostic artifact before sharing it.

Network boundary

Model requests go to the selected provider.
Web search and web fetch contact public sites when called.
MCP servers, hooks, proxies, and custom providers keep their own command, network, and credential behavior.
remote_fetch = false skips the optional model-catalog and /v1/settings fetches, so no fleet policy can arrive.
telemetry = false does not disable model or tool traffic and does not remove the local unified log.
rightnow update follows the selected stable or alpha channel and verifies the download against the release manifest, its SHA-256 sidecar, and the published size before activation. rightnow update --check --json reports the decision without installing.

Permissions are decision gates

--always-approve, --yolo, and --dangerously-skip-permissions auto-approve tool execution. Do not use them for untrusted work.

Windows boundary

On Windows, permission prompts are application-level decisions, not kernel-enforced filesystem or network isolation. Use an external containment boundary when stronger isolation is required.

Untrusted input and integrations

Treat repository text, command output, fetched pages, MCP output, hooks, and migrated rules as untrusted input.
Review commands, paths, destinations, URLs, headers, and environment values before approval.
The shipped configuration disables machine-wide Claude and Cursor skill, rule, and agent imports. MCP migration is opt-in.

Vulnerability reporting status

Report vulnerabilities privately using the contacts in /.well-known/security.txt and on the contact page at /contact. Do not open a public issue or publish exploit details. Include the affected version and operating system, the impact, reproduction steps or a minimal proof of concept, and relevant configuration with credentials and personal data removed.