Security

The model

Mori, her tools, her memory and her record of what she did live on your computer. On your own keys, model calls go straight from the app to the provider you chose. On a plan's credits they go through Studio Mori's own service, and a cloud machine runs only when you send a thread to one.

The layers, from the outside in:

• Your system's own permissions: Screen Recording, Accessibility, Microphone and Camera on the Mac, which macOS asks you for. See Permissions.
• Mori's rails: the commands, files and installs she refuses unless you asked. See Asking and the safety rails.
• App tiers: which apps she may press, which she may only look at.
• Checkpoints before every file she overwrites or deletes.
• A record of every step.

No approval cards, and where you still decide

Mori does not stop to ask you to click Allow: edits, commands, installs and tests just run. You can turn asking back on in Settings > Agent, or for one chat. What you always decide, whatever is switched:

• An ad is turned on or given a budget only after your yes on Mori's own card, and that yes covers exactly the requests it shows.
• A job above the amount you set in Settings > Spend asks first.
• In your Chrome and on your screen, Mori never presses a final pay button and never types a password or card details. Her built-in browser stops at the order review with Place the order, and presses pay once only after you tap it or tell her to.
• A post for your socials waits in a queue in Settings > Business until you publish it.

Apps she may press

Every click and keystroke is checked against the app it lands in, and no setting changes the answer:

• Look only: banking and trading apps, and browsers driven through the screen. Mori may read them and never press anything.
• Click only: terminals and code editors: a left click, a double click and scrolling.
• Full control: everything else.

Mori never clicks her own window, her Stop bar or her HUD.

Text never gives orders

A web page, a file, an email or a message can say anything. Mori reads it as information, never as an instruction to act, and no switch changes that. Your keys are never sent anywhere you did not choose.

Unattended runs

A scheduled run, a webhook or a turn nobody is watching keeps every rail on, never drives your screen, never makes video, and never spends on ads. A webhook's turn gets only a short list of safe tools.

Checkpoints before every write

Before Mori overwrites or deletes a file, its earlier bytes are saved to a checkpoint history in the app's own folder. list_checkpoints shows what is saved for a file and rollback_file brings the last copy back. When Mori deletes a file, the result says a checkpoint was saved.

The record

Every tool call is written down with its time, what it touched and how it ended. A step that ran with no card is marked as having run with no card because asking is off. Settings > Activity Log shows the record.

Bots and strangers

On Discord and Telegram the owner is pinned to your platform account ID, captured the first time you message the bot, never to a display name. Anyone else gets a conversation from the model alone: no tools, no files, no screen, and none of your memory. See Discord, Telegram and your phone.

Mori as an MCP server

Other agents and tools can use Mori over MCP. The server is off until you turn it on in Settings > Connections, listens only on your own computer (port 4519), and refuses any request without its token. See MCP.