Security
Mechanisms, not adjectives
This page is for people who read install scripts before piping them into sudo. Every claim below names a shipped mechanism in the app or the agent. Nothing more.
Your phone
your own ssh key
rootmote-agent
127.0.0.1:7676 · loopback only
docker · systemd · firewall · storage
claude code / codex sessions
Shipped mechanisms
Five locks, all on by default
Loopback-only agent
rootmote-agent refuses to start on anything but a loopback address. The only way in is the SSH tunnel your phone opens, authenticated by your own SSH key. Nothing new listens on the internet.
Pairing key on the control plane
The agent generates a 32-byte pairing key, exposed only over the SSH channel. Every WebSocket upgrade must present it as a bearer token, compared in constant time. It is on by default.
Host keys pinned on first use
The app pins each server's host-key fingerprint on first connect and hard-fails if it ever changes. That covers the runtime tunnel, the install probe, and the installer itself. A changed key is an error, never a silent reconnect.
Gated mutations
Mutating actions are gated on the agent: biometric approval on your phone, a confirmation token, and an audit log. Approval sheets show the exact script, including when it runs as root, before you decide.
Rate-limited push enrollment
The push relay's registration endpoint requires a bearer secret and is rate-limited per IP, so alert delivery can't be abused as an open endpoint.
Current limits
AI coding sessions currently run as the same user as the agent, so a misbehaving session could read the pairing key; dedicated-uid isolation is on the roadmap. Host keys are pinned on first use (trust-on-first-use); explicit fingerprint confirmation at first connect is coming. We keep this list current: when a limit closes, its sentence disappears.
Don't trust it. Read it.
The agent is a single Go binary you can review before piping anything into sudo.