Skip to main content

Security & Privacy

Anyy is local-first, but local does not mean consequence-free. The assistant can use files, terminal commands, messaging Channels, schedules, and external providers. Treat each enabled capability as authority you have granted.

Start with the Safe Defaults​

  1. Enable only the integrations and tools needed for the task.
  2. Connect only the model providers and Channels you need.
  3. Enable one toolset, Skill, or MCP server at a time.
  4. Check paths, commands and destination accounts before asking Anyy to change them.
  5. Keep a recent Profile backup before broad configuration changes.
Workspace is not a security boundary

Workspace selects context and artifact locations. It does not turn an otherwise authorized tool into a sandbox. Review file paths, commands, and enabled toolsets on their own merits.

Tool access​

Enabled file and terminal tools, MCP, job management and Role onboarding execute directly. Review enabled integrations and the target account or Workspace before asking Anyy to act. Authentication, secret protection and ownership isolation continue to apply.

Protect Credentials​

Prefer Dashboard or an interactive setup flow for API keys and channel secrets. For non-interactive Channel setup, pass secrets through file descriptors:

anyy setup channel CHANNEL \
  --set FIELD=VALUE \
  --sensitive-fd SECRET_FIELD=FD

Use a dedicated open descriptor numbered 3 or higher; --external-locator-fd is available only for an input that accepts external secret locations.

Do not place secrets in prompts, shell history, screenshots, Skill files, or durable memory. Anyy redacts recognized secret material from protected persistence and delivery paths, but redaction is a last line of defense—not a reason to expose a credential.

When a secret may have leaked, rotate it at the provider first, update Anyy, reload the affected integration, and inspect its health.

Control Messaging Access​

Each Channel profile exposes only the access policies it supports. Depending on the platform, direct messages can be pairing, open, allowlist, or disabled; group messages can be mention, open, allowlist, or disabled.

Policy inputs are in the CLI wizard for ordinary platforms; Dashboard credential forms are not a complete access editor. Current public sender-list editing is limited to the fields actually offered for Weixin/IRC. See Messaging Platforms rather than guessing input IDs.

Manage actual pending requests through the CLI, because the current Dashboard Channel page has no pairing-approval list:

anyy channel pairing list
anyy channel pairing approve --request REQUEST_ID

Revoke an unwanted grant immediately:

anyy channel pairing revoke --grant GRANT_ID --reason "access removed"

Pairing is an authorization decision. Verify the platform identity and account before approving it.

Keep External Integrations Narrow​

  • For MCP, enable a server only after probe or test, then include only the tools you intend to expose.
  • For Skills, inspect SKILL.md and linked files before installation or use.
  • For scheduled automation, select toolsets and verify the prompt and delivery route.
  • For public webhooks, use HTTPS and keep verification/signature secrets private.
  • For Dashboard, keep access limited to trusted users and networks.

Backups and Audit History​

Backups include Profile data needed for recovery, including private conversations and working files. The managed secrets/ directory and supported mcp/oauth/ storage are excluded unless you explicitly include secrets. Canonical configuration and working files are still captured: inline credentials, including MCP environment/header values, may remain in the archive. Backups are not guaranteed to be fully redacted. Protect every backup, and treat any credential-bearing archive as sensitive material.

Anyy records operation diagnostics, connection changes, sender access decisions and delivery outcomes. Use Dashboard health pages plus anyy status, anyy doctor, and integration-specific doctor/status commands when investigating unexpected behavior.

If Something Looks Wrong​

  1. Stop or disable the affected schedule or integration.
  2. Revoke Channel pairing grants that should not exist.
  3. Rotate exposed provider, Channel, or MCP credentials.
  4. Run the relevant doctor/status command.
  5. Restore from a known-good backup only after preserving evidence you still need.