Security / Scope and limits
Know where
the boundary ends.
Zyphr provides local visibility and scoped egress policy. It is not an OS security boundary, a sandbox, or proof that a coding agent is safe.
01 / Separate mechanisms
Observation is permissive.
Proxy policy is explicit.
Native hooks record session and tool events for Claude Code, Cursor, and Pi. They observe first. Hook or collector failure must not deny tool execution.
The process-scoped HTTP(S) proxy can allow or deny requests under an explicit egress policy. A runtime-scoped certificate authority supports HTTPS inspection. Zyphr does not install that CA in the OS trust store.
Failure behavior matters.
Permissive hooks do not mean the proxy can always fail open. A proxy transport failure may interrupt a request. An uncertain write must not be retried silently.
An inspection budget limits copied evidence, not the application data forwarded in observe mode. A capture limit is not a traffic limit.
02 / Trust boundary
Same user, same authority.
A process running as your user can change user-owned hooks, binaries, keys, configuration, and records. It can stop the collector. It may route traffic around the optional proxy.
- Policy covers HTTP(S) traffic routed through the Zyphr proxy.
- Unproxied requests and unsupported sources are coverage gaps.
- Zyphr does not claim OS-wide capture, eBPF monitoring, or tamper-proof enforcement.
- Managed endpoints, additional sensors, and fleet policy distribution are architecture and roadmap work, not a hosted service you can enable today.
Use separate OS or network controls when you need isolation from code running under your own account.
03 / Data handling
Local storage still needs care.
Session records live in local SQLite. Zyphr has no accounts and no hosted cloud data collection. Your coding agent still makes its own network requests to model providers and other destinations.
- Prompt capture
- Off by default. Optional capture uses redaction and encryption. It is a separate choice from recording event metadata.
- Redaction
- Redaction can miss a secret. Test with synthetic values. Do not assume a captured prompt is safe to share.
- Encryption
- Optional prompt capture is encrypted. This is not a claim that all SQLite records are encrypted. Same-user access to keys remains a limit.
- Exports and backups
- Local records can still contain sensitive paths, destinations, and session details. Review exports before sharing them. Protect local keys and backups.
04 / Interpretation
Keep observation apart
from inference.
A policy denial proves that the proxy applied a rule. It does not prove malicious intent. A socket connection alone does not prove which plaintext crossed TLS.
Local security findings should cite their supporting events and state what was not captured. A tool event, a proxy decision, and an inferred risk are different records. Findings do not independently block tool execution.
Inspect the sample record05 / This website
No data-collection form.
This is a static information site. It has no account system, contact form, analytics script, or marketing cookie. Fonts and images are served with the site. The sample session is synthetic and does not connect to a running Zyphr instance.
Cloudflare serves this site and can process web request metadata, including IP addresses. The privacy notice describes website traffic and contact messages separately from local application records.
06 / Responsible reporting
Keep vulnerability details private.
Email the maintainer to arrange a private reporting channel. Keep credentials, private session records, and exploit details out of the initial message and public issues.
Contact the maintainerPublic source publication and a repository security policy are still in preparation. There is no promised response time.
What to include in your first messageYour machine
destinationAllowed requests only
Traffic that bypasses the proxy is outside this policy path.