EKORD

Security

Execution model

The Agent runs as your local operating-system user and can do what that user can do: read and write files and run commands in that account.

Connection direction

The Agent makes an outbound connection to EKORD. Your machine does not need inbound firewall or NAT configuration.

What EKORD stores

• account identity and external login binding
• paired device identity and revocable device credentials
• OAuth clients, grants, and tokens needed for the MCP connection

What EKORD does not persist

• file bodies, patches, or project snapshots
• command input or output history
• shell history

Credentials and revocation

Each paired device holds its own credential. A device credential can be revoked server-side; after revocation the Agent is rejected and must pair again.

Tools

• inspect — read, list, stat, and search (read-only)
• apply — create, write, append, delete, or make directories
• exec — run a command and return bounded output

Stopping the Agent removes remote execution availability.