# Defense-in-depth score: jcode

**Repo:** https://github.com/1jehuang/jcode · **Commit:** `e46eff2e6c6818c5be7291297d1867323cce7eb0` · **Reviewed:** 2026-10-05
**What it is:** Rust terminal coding agent with a multi-session daemon, swarm sub-agents, persistent memory and MCP support.
**Category:** Coding
**Scored configuration:** Interactive TUI (`jcode`) with its auto-started local daemon, no flags, fresh install, default ~/.jcode/config.toml.
**Agent surface (default):** code execution yes · filesystem write yes · network egress yes · external credentials yes · persistent memory yes · untrusted input yes · third party extensions yes · sub agents yes · external communication opt-in

## Score: 1.5 / 10.0 (Minimal)

| # | Criterion | S | C | D | B | Raw | Cap | Score | Confidence |
|---|---|---|---|---|---|---|---|---|---|
| C1 | Identity & least privilege | L0 | L1 | L0 | L0 | 0.07 | none | **0.07** | High |
| C2 | Approval gates | L0 | L0 | L0 | L1 | 0.05 | C2-SELFAPPROVE | **0.05** | High |
| C3 | Tool & action scoping | L1 | L1 | L0 | L0 | 0.15 | none | **0.15** | High |
| C4 | Code-execution isolation | L0 | L0 | L0 | L0 | 0.00 | none | **0.00** | High |
| C5 | Untrusted input blast radius | L0 | L0 | L0 | L0 | 0.00 | C5-WORSTCASE | **0.00** | High |
| C6 | Memory, context & configuration integrity | L0 | L0 | L1 | L1 | 0.10 | C6-REPOCONFIG | **0.10** | High |
| C7 | Third-party extensions | L1 | L0 | L0 | L1 | 0.12 | none | **0.12** | High |
| C8 | Secrets & sensitive-data protection | L2 | L1 | L1 | L0 | 0.28 | none | **0.28** | High |
| C9 | Audit & traceability | L2 | L2 | L2 | L2 | 0.50 | none | **0.50** | High |
| C10 | Limits & kill switch | L1 | L1 | L1 | L0 | 0.20 | none | **0.20** | High |


jcode runs model-chosen shell commands, file writes and web requests directly on your machine with no human approval and no sandbox. Its only built-in check is a destructive-command filter that the model can clear by giving a written justification, apart from a short list of catastrophic targets it always refuses. Opening a repository also loads its MCP server config and system-prompt files without asking, so a cloned repository can add tools that run as you. Treat it as having your full account authority whenever it reads untrusted content.

## Critical gaps
- Risky shell commands are confirmed by the model itself: re-sending the call with a short justification satisfies the check, and no human approval exists by default. (ASI09, ASI02, T10; C2). Evidence: [crates/jcode-command-risk/src/gate.rs:89-96](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-command-risk/src/gate.rs#L89-L96); [crates/jcode-command-risk/src/gate.rs:75](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-command-risk/src/gate.rs#L75); [crates/jcode-command-risk/src/lib.rs:5-7](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-command-risk/src/lib.rs#L5-L7)
- A hijacked session can exfiltrate data through web fetch or the shell and take irreversible actions with no human in the loop. (ASI01, T6, LLM01; C5). Evidence: [crates/jcode-app-core/src/tool/webfetch.rs:78](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/webfetch.rs#L78); [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678); [crates/jcode-app-core/src/tool/mod.rs:955](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L955)
- Project MCP config files in the working directory add servers that start automatically, and a project file can replace the system prompt, with no workspace-trust decision. (ASI06, ASI04, T1; C6). Evidence: [crates/jcode-base/src/mcp/protocol.rs:586-591](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/protocol.rs#L586-L591); [crates/jcode-base/src/mcp/protocol.rs:250-254](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/protocol.rs#L250-L254); [crates/jcode-base/src/prompt.rs:15-18](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/prompt.rs#L15-L18)
- Model-written commands run unsandboxed on the host with the user's full filesystem, network and environment. (ASI05, T11, LLM05; C4). Evidence: [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678)
- Tools act with the user's whole ambient authority, and the shell inherits the daemon's full environment including provider credentials. (ASI03, T3; C1). Evidence: [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678); [crates/jcode-base/src/mcp/client.rs:171-181](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/client.rs#L171-L181)

## Criterion details

### C1 Identity & least privilege: 0.07 (high confidence)

jcode runs as the local user and uses whatever authority that user has. The shell tool starts every command with the background daemon's full environment, so provider API keys and any cloud or Git credentials in that environment reach every command the model runs, and the credential files jcode stores under the home directory are readable by those commands. MCP servers are the one path where jcode strips known provider credentials from the inherited environment. Optional Gmail access can be limited to a read-and-draft scope, but there is no general narrowing of the user's authority.

- **S L0:** Tools act with the operator's full ambient authority; the shell inherits the daemon environment, including provider credentials. Evidence: [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678); searched `rg -n -e 'env_clear'` in `crates/jcode-app-core/src/tool` → 1 hits (The only hit is a test helper (tests/mcp_collision.rs); the bash tool inherits the daemon's full environment.) (verified)
  - *To reach the next level:* No narrowing of ambient credentials for the shell or file tools (scoped tokens, environment scrubbing, or a deterministic authorization gate).
- **C L1:** Only MCP server launches strip known provider credentials from the inherited environment; shell commands and built-in tools do not. Evidence: [crates/jcode-base/src/mcp/client.rs:171-181](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/client.rs#L171-L181); [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678) (verified)
  - *To reach the next level:* Built-in tools, the shell and sub-agents do not use a scoped identity; only MCP launches scrub credentials.
- **D L0:** The default install acts with the user's full privileges; nothing is narrowed without manual hardening. Evidence: [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678); searched `rg -n -e 'env_clear'` in `crates/jcode-app-core/src/tool` → 1 hits (The only hit is a test helper (tests/mcp_collision.rs); the bash tool inherits the daemon's full environment.) (verified)
  - *To reach the next level:* No narrower default (for example a scrubbed shell environment or read-only credentials) ships on.
- **B L0:** A hijacked session reaches everything the user's account and stored credentials can reach: provider subscriptions, Git remotes, cloud CLIs and the home directory. Evidence: [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678); [crates/jcode-storage/src/lib.rs:567-570](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-storage/src/lib.rs#L567-L570) (verified)
  - *To reach the next level:* Nothing limits the reach of a hijacked session below the user's whole account.
- **Cap:** none

### C2 Approval gates: 0.05 (high confidence)

jcode has no human approval step for tool calls in its default configuration: the shell, file writes and network tools run as soon as the model calls them. The shell has a built-in destructive-command check that refuses commands it classifies as risky until the model re-sends them with a written justification, so the model can satisfy it by itself. A small set of targets (the root, the home directory and credential stores) is refused outright. An external pre-tool hook can block calls, but it is off unless the user configures it, and there is no undo or checkpoint for file changes.

- **S L0:** The only check before a risky shell command is a reflection prompt that the model satisfies itself by re-issuing the call with a 25-character justification. Evidence: [crates/jcode-command-risk/src/gate.rs:89-96](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-command-risk/src/gate.rs#L89-L96); [crates/jcode-command-risk/src/gate.rs:75](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-command-risk/src/gate.rs#L75); [crates/jcode-command-risk/src/lib.rs:5-7](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-command-risk/src/lib.rs#L5-L7) (verified)
  - *To reach the next level:* No per-call human approval; the confirmation is answered by the model, not a person.
- **C L0:** The shell, write, edit, web and MCP tools all execute directly from the registry with no approval check on the path. Evidence: [crates/jcode-app-core/src/tool/mod.rs:955](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L955); [crates/jcode-app-core/src/tool/mod.rs:927-929](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L927-L929); [crates/jcode-app-core/src/tool/mod.rs:401](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L401) (verified)
  - *To reach the next level:* The most powerful tools (shell, file writes, network) are not routed through any human gate.
- **D L0:** The only gate that could involve a human is the external pre_tool hook, which runs only when the user configures it. Evidence: [crates/jcode-app-core/src/tool/mod.rs:927-929](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L927-L929); [crates/jcode-command-risk/src/lib.rs:5-7](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-command-risk/src/lib.rs#L5-L7) (verified)
  - *To reach the next level:* Approval is not on by default.
- **B L1:** An action that passes the model's self-justification can still not delete the root, home directory or credential stores, but force-pushes, deletions elsewhere and outbound messages are irreversible and there is no checkpoint for file edits. Evidence: [crates/jcode-command-risk/src/gate.rs:81](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-command-risk/src/gate.rs#L81); searched `rg -n -i -e 'checkpoint|undo|rollback'` in `crates/jcode-app-core/src/tool/write.rs crates/jcode-app-core/src/tool/edit.rs` → 0 hits (File-writing tools keep no checkpoint or undo.); [crates/jcode-app-core/src/tool/gmail.rs:452](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/gmail.rs#L452) (verified)
  - *To reach the next level:* No checkpoints or rollback for file and code state, and no previews for external actions.
- **Cap:** C2-SELFAPPROVE: The destructive-command confirmation and the Gmail send confirmation are both satisfied by the model re-issuing the call with a justification or confirmed flag.
- **Notes:** The pre_tool hook lets a user plug in an external policy program; it is not a jcode approval mechanism and was not scored as an alternative.

### C3 Tool & action scoping: 0.15 (high confidence)

The default tool set gives the model a general shell, file writes to any path, and fetching of any http or https URL. The shell command check classifies commands by what they would destroy and refuses a small set of catastrophic targets, which is a filter rather than an allowlist. File tools accept absolute paths anywhere on disk, and the web fetch tool checks only the URL scheme, with no block on internal or metadata addresses. A per-session allow or deny list of tools exists for SDK and swarm sessions, but the interactive default enables everything.

- **S L1:** Validation is a destructive-command classifier with a hard deny list of catastrophic targets; file paths and URLs are otherwise passed through. Evidence: [crates/jcode-command-risk/src/gate.rs:81](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-command-risk/src/gate.rs#L81); [crates/jcode-app-core/src/tool/write.rs:60](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/write.rs#L60); [crates/jcode-app-core/src/tool/webfetch.rs:78](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/webfetch.rs#L78); searched `rg -n -i -e 'private|loopback|169\.254|is_global|redirect'` in `crates/jcode-app-core/src/tool/webfetch.rs` → 0 hits (webfetch has no host allowlist or internal-address block.) (verified)
  - *To reach the next level:* No allowlist validation in code: no resolved-path containment for file tools and no host allowlist or internal-address block for web fetch.
- **C L1:** Only the shell (and deletions in apply_patch) are checked; write, edit, web fetch and MCP tools are not. Evidence: [crates/jcode-app-core/src/tool/apply_patch.rs:176-183](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/apply_patch.rs#L176-L183); [crates/jcode-app-core/src/tool/write.rs:60](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/write.rs#L60); [crates/jcode-app-core/src/tool/webfetch.rs:78](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/webfetch.rs#L78) (verified)
  - *To reach the next level:* Most built-in tools do not validate their arguments.
- **D L0:** Shell, write, network, email, scheduling and swarm tools are all registered in the default tool set. Evidence: [crates/jcode-app-core/src/tool/mod.rs:401](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L401); [crates/jcode-app-core/src/tool/mod.rs:375](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L375); [crates/jcode-app-core/src/tool/mod.rs:420](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L420); [crates/jcode-app-core/src/tool/mod.rs:454](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L454) (verified)
  - *To reach the next level:* Dangerous tools cannot be selected out by default in interactive sessions; everything ships enabled.
- **B L0:** A misused tool can run any command, write any file and reach any host the user can. Evidence: [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678); [crates/jcode-app-core/src/tool/write.rs:60](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/write.rs#L60); [crates/jcode-app-core/src/tool/webfetch.rs:78](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/webfetch.rs#L78) (verified)
  - *To reach the next level:* Tools are not scoped to the workspace or bounded in quantity.
- **Cap:** none
- **Notes:** D is L0 because every tool ships enabled, not because the classifier is opt-in; G1 does not apply.

### C4 Code-execution isolation: 0.00 (high confidence)

Model-written shell commands run directly on the host as the user through bash, in the session's working directory. There is no container, OS sandbox profile or separate low-privilege user anywhere in the codebase, and MCP servers, background jobs and hooks also run as ordinary host processes. A timed-out command is moved to the background rather than killed.

- **S L0:** Commands run as a same-user host subprocess via bash -c. Evidence: [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678); searched `rg -n -i -e 'landlock|seccomp|bwrap|bubblewrap|sandbox-exec|seatbelt|nsjail|firejail|gvisor|firecracker'` in `crates src` → 0 hits (No OS sandbox, container or microVM backend anywhere in the workspace.) (verified)
  - *To reach the next level:* No isolation primitive (container, OS sandbox profile, or separate user).
- **C L0:** No execution path is isolated: shell, background tasks and MCP server launches all run on the host. Evidence: [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678); [crates/jcode-base/src/mcp/client.rs:178](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/client.rs#L178); searched `rg -n -i -e 'landlock|seccomp|bwrap|bubblewrap|sandbox-exec|seatbelt|nsjail|firejail|gvisor|firecracker'` in `crates src` → 0 hits (No OS sandbox, container or microVM backend anywhere in the workspace.) (verified)
  - *To reach the next level:* Not even the main shell tool is isolated.
- **D L0:** There is no sandbox to enable. Evidence: searched `rg -n -i -e 'landlock|seccomp|bwrap|bubblewrap|sandbox-exec|seatbelt|nsjail|firejail|gvisor|firecracker'` in `crates src` → 0 hits (No OS sandbox, container or microVM backend anywhere in the workspace.) (verified)
  - *To reach the next level:* No isolation is on by default.
- **B L0:** Executed code has the user's full filesystem, network and environment, including stored credentials. Evidence: [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678); searched `rg -n -e 'env_clear'` in `crates/jcode-app-core/src/tool` → 1 hits (The only hit is a test helper (tests/mcp_collision.rs); the bash tool inherits the daemon's full environment.) (verified)
  - *To reach the next level:* Executed code is not confined to the workspace, cut off from the network, or stripped of credentials.
- **Cap:** none

### C5 Untrusted input blast radius: 0.00 (high confidence)

jcode reads web pages, search results, repository files, MCP tool results and swarm messages straight into the model's context, with no marking of where content came from and nothing that changes what the agent may do afterwards. Because tools run without approval, injected instructions in any of these sources can drive the shell and the web fetch tool in the same session. A hijacked session can therefore both send data out and take irreversible actions with no person involved. A few helper prompts tell sub-models to treat page content as untrusted, which is guidance only.

- **S L0:** Nothing structurally limits a hijacked session; untrusted-content handling is prompt text in a browser helper only. Evidence: [crates/jcode-app-core/src/tool/browser_jev.rs:75](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/browser_jev.rs#L75); searched `rg -n -i -e 'untrusted'` in `crates/jcode-app-core/src/agent crates/jcode-app-core/src/tool/webfetch.rs crates/jcode-app-core/src/tool/websearch.rs crates/jcode-app-core/src/tool/mod.rs` → 0 hits (Tool results from web, files and MCP enter context with no provenance marking or taint handling.) (verified)
  - *To reach the next level:* No capability is disabled or put behind approval once untrusted content has been read.
- **C L0:** Tool results from web, files, MCP and swarm peers enter context with the same standing as other messages. Evidence: [crates/jcode-app-core/src/tool/mod.rs:955](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L955); searched `rg -n -i -e 'untrusted'` in `crates/jcode-app-core/src/agent crates/jcode-app-core/src/tool/webfetch.rs crates/jcode-app-core/src/tool/websearch.rs crates/jcode-app-core/src/tool/mod.rs` → 0 hits (Tool results from web, files and MCP enter context with no provenance marking or taint handling.) (verified)
  - *To reach the next level:* Untrusted sources are not distinguished from the principal's input.
- **D L0:** No untrusted-input control exists to be on by default. Evidence: [crates/jcode-app-core/src/tool/mod.rs:955](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L955); searched `rg -n -i -e 'untrusted'` in `crates/jcode-app-core/src/agent crates/jcode-app-core/src/tool/webfetch.rs crates/jcode-app-core/src/tool/websearch.rs crates/jcode-app-core/src/tool/mod.rs` → 0 hits (Tool results from web, files and MCP enter context with no provenance marking or taint handling.) (verified)
  - *To reach the next level:* No containment for untrusted input ships on.
- **B L0:** A hijacked session can read local secrets and exfiltrate them through web fetch or the shell, and can push, delete or send, all without a human. Evidence: [crates/jcode-app-core/src/tool/webfetch.rs:78](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/webfetch.rs#L78); [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678); [crates/jcode-command-risk/src/gate.rs:89-96](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-command-risk/src/gate.rs#L89-L96) (verified)
  - *To reach the next level:* Exfiltration and irreversible actions are not behind human approval.
- **Cap:** C5-WORSTCASE: Worst case (B L0): a hijacked agent can leak data and take irreversible actions unattended.

### C6 Memory, context & configuration integrity: 0.10 (high confidence)

Several files in the working directory are loaded automatically with no trust prompt: project MCP config files (in jcode's own format and Claude Code's), a project system prompt file that replaces the built-in system prompt, AGENTS.md, prompt overlays and project skills. Project MCP servers are enabled unless marked disabled and are started when the session begins, so a cloned repository can add tools that run as the user. The model can also write long-term memories at project or global scope with no validation, and those memories are recalled into later sessions. Memories are stored per project, and a single user's sessions share them.

- **S L0:** Repository files can add MCP servers and replace the system prompt with no prompt, and the model can write arbitrary persistent memories. Evidence: [crates/jcode-base/src/mcp/protocol.rs:586-591](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/protocol.rs#L586-L591); [crates/jcode-base/src/prompt.rs:15-18](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/prompt.rs#L15-L18); [crates/jcode-app-core/src/tool/memory.rs:155-163](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/memory.rs#L155-L163) (verified)
  - *To reach the next level:* No workspace-trust decision before project config adds tools or replaces instructions, and no gating of memory writes.
- **C L0:** No memory store or auto-loaded file is controlled. Evidence: [crates/jcode-base/src/mcp/protocol.rs:586-591](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/protocol.rs#L586-L591); [crates/jcode-base/src/prompt.rs:970-971](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/prompt.rs#L970-L971); [crates/jcode-app-core/src/tool/memory.rs:155-163](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/memory.rs#L155-L163); searched `rg -n -i -e 'trust'` in `crates/jcode-base/src/mcp/protocol.rs crates/jcode-base/src/mcp/manager.rs` → 0 hits (No workspace-trust decision in the MCP config loader or manager.) (verified)
  - *To reach the next level:* Neither the memory store nor auto-loaded project files pass through any validation or approval.
- **D L1:** Memories are kept in per-project stores by default, but the model can write to the global scope that every project reads. Evidence: [crates/jcode-app-core/src/tool/memory.rs:155-163](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/memory.rs#L155-L163) (verified)
  - *To reach the next level:* The model can write across namespaces (project and global), so isolation is not enforced against it.
- **B L1:** A poisoned memory or project file persists across the user's sessions and can steer tool use, which runs without approval. Evidence: [crates/jcode-app-core/src/tool/memory.rs:155-163](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/memory.rs#L155-L163); [crates/jcode-app-core/src/tool/mod.rs:1468-1470](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L1468-L1470) (verified)
  - *To reach the next level:* Poisoned context persists and can trigger ungated tool use; it is not limited to text or gated actions.
- **Cap:** C6-REPOCONFIG: Project-local MCP config files in the working directory add servers that are started automatically, with no workspace-trust decision.

### C7 Third-party extensions: 0.12 (high confidence)

MCP servers are launched from user config, from Claude Code's config files and from project config files in the working directory, using whatever command and package version the config names, with no pinning, hash check or re-approval when a server changes. Project-level MCP servers are enabled automatically. Each server runs as a separate process as the user; jcode removes known provider credentials from the environment it passes, but the process can still read the user's files.

- **S L1:** Servers run whatever command the configuration names, with no version pinning or integrity check enforced by jcode. Evidence: [crates/jcode-base/src/mcp/client.rs:178](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/client.rs#L178); [crates/jcode-base/src/mcp/protocol.rs:250-254](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/protocol.rs#L250-L254) (verified)
  - *To reach the next level:* Extension versions are not pinned or verified.
- **C L0:** No extension type (MCP servers, skills) is verified. Evidence: [crates/jcode-base/src/mcp/client.rs:178](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/client.rs#L178); searched `rg -n -e 'sha256|SHA256SUMS'` in `crates/jcode-base/src/mcp crates/jcode-base/src/skill.rs` → 0 hits (No integrity checks for MCP servers or skills.) (verified)
  - *To reach the next level:* No extension type is verified.
- **D L0:** Project config files in the workspace add MCP servers that are enabled by default and started without consent. Evidence: [crates/jcode-base/src/mcp/protocol.rs:586-591](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/protocol.rs#L586-L591); [crates/jcode-base/src/mcp/protocol.rs:250-254](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/protocol.rs#L250-L254); [crates/jcode-app-core/src/tool/mod.rs:1468-1470](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L1468-L1470) (verified)
  - *To reach the next level:* Workspace files can add extensions silently.
- **B L1:** Each MCP server is a separate process running as the user; a denylist strips known provider credentials from its environment, but it can read the user's files. Evidence: [crates/jcode-base/src/mcp/client.rs:171-181](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/client.rs#L171-L181); [crates/jcode-base/src/mcp/client.rs:427](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-base/src/mcp/client.rs#L427) (verified)
  - *To reach the next level:* Extensions are not limited to their own configuration and credentials; the scrub is a denylist and file access is unrestricted.
- **Cap:** none
- **Notes:** D is L0 because workspace config adds servers silently; G1 does not apply. The optional pre_tool hook is a user-supplied program, not an extension control.

### C8 Secrets & sensitive-data protection: 0.28 (high confidence)

Credentials that jcode stores are written to files with owner-only permissions, and its log writer redacts fields that look like keys or tokens. Saved session transcripts are kept unredacted on disk; redaction is applied only to the optional transcript upload. Anonymous usage telemetry is on by default and described as content-free, with full transcript sharing a separate opt-in. Long-lived provider keys in the daemon environment reach every shell command the model runs.

- **S L2:** Stored credentials are plaintext files with restrictive permissions, and log fields with key-like names are redacted. Evidence: [crates/jcode-storage/src/lib.rs:567-570](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-storage/src/lib.rs#L567-L570); [crates/jcode-logging/src/lib.rs:620-634](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-logging/src/lib.rs#L620-L634) (verified)
  - *To reach the next level:* No OS keychain or encryption at rest, and no redaction before model-bound messages.
- **C L1:** Log fields are redacted; local transcripts, model-bound messages and the shell environment are not. Evidence: [crates/jcode-logging/src/lib.rs:620-634](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-logging/src/lib.rs#L620-L634); [crates/jcode-app-core/src/agent.rs:1198-1202](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/agent.rs#L1198-L1202); searched `rg -n -e 'env_clear'` in `crates/jcode-app-core/src/tool` → 1 hits (The only hit is a test helper (tests/mcp_collision.rs); the bash tool inherits the daemon's full environment.) (verified)
  - *To reach the next level:* Saved transcripts and subprocess environments are not protected.
- **D L1:** Usage telemetry is on unless the user opts out; transcript content sharing is a separate opt-in. Evidence: [crates/jcode-telemetry-core/src/lib.rs:471-482](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-telemetry-core/src/lib.rs#L471-L482) (verified)
  - *To reach the next level:* Telemetry is not opt-in.
- **B L0:** Long-lived provider API keys and OAuth refresh tokens are reachable by every shell command the model runs. Evidence: [crates/jcode-app-core/src/tool/bash.rs:677-678](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L677-L678); [crates/jcode-storage/src/lib.rs:567-570](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-storage/src/lib.rs#L567-L570) (verified)
  - *To reach the next level:* Keys reachable by the model are long-lived and broadly scoped.
- **Cap:** none

### C9 Audit & traceability: 0.50 (high confidence)

Every tool call goes through one registry that writes structured start, done, error and blocked events with session, message and tool-call identifiers, touched paths and timings to a daily log under the jcode home directory, and full arguments and results are kept in the saved session. The log is flushed per line and errors are reported. There is no separation between agent and human actions, and the shell tool can edit or delete the log because it runs as the same user.

- **S L2:** Structured per-call lifecycle events with session and tool-call identifiers, plus the saved session transcript. Evidence: [crates/jcode-app-core/src/tool/mod.rs:670-683](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L670-L683); [crates/jcode-app-core/src/tool/mod.rs:948-951](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L948-L951) (verified)
  - *To reach the next level:* No actor attribution (approver or requesting principal) or cross-agent correlation identifiers.
- **C L2:** All registry tool calls, including MCP tools and hook blocks, are logged. Evidence: [crates/jcode-app-core/src/tool/mod.rs:948-951](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L948-L951); [crates/jcode-app-core/src/tool/mod.rs:955](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/mod.rs#L955) (verified)
  - *To reach the next level:* Sub-agent and swarm correlation was not shown to be recorded in a linked way.
- **D L2:** Logging is on by default and stored under the jcode home directory, outside the workspace, but the agent's shell can modify it. Evidence: [crates/jcode-logging/src/lib.rs:195](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-logging/src/lib.rs#L195) (verified)
  - *To reach the next level:* Logs are written by a process the model's shell can alter.
- **B L2:** Each record is flushed as it is written and write failures are printed; actions proceed regardless. Evidence: [crates/jcode-logging/src/lib.rs:210-216](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-logging/src/lib.rs#L210-L216) (verified)
  - *To reach the next level:* High-risk actions do not wait for a durable record, and full replay depends on the session file.
- **Cap:** none

### C10 Limits & kill switch: 0.20 (high confidence)

The agent loop has no cap on steps, tool rounds or spend in the default configuration; it runs until the model stops or the user cancels, and cancellation is checked between steps. Shell commands have a two-minute default timeout, but a command that exceeds it is moved to the background instead of being killed, and background commands have no timeout unless the model sets one. Swarms are limited to 32 concurrently running workers by default, with an absolute ceiling of 1000. A daily token budget exists only for the optional ambient mode.

- **S L1:** Only a per-command shell timeout exists, and it hands the command to the background instead of stopping it; there is no step or cost cap. Evidence: [crates/jcode-app-core/src/tool/bash.rs:1009](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L1009); [crates/jcode-app-core/src/tool/bash.rs:1179](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L1179); searched `rg -n -i -e 'max_turns|max_iterations|max_steps|max_tool_rounds'` in `crates/jcode-app-core/src/agent` → 0 hits (The agent turn loop has no step or tool-round cap.) (verified)
  - *To reach the next level:* No iteration cap and no enforced token or cost budget.
- **C L1:** Cancellation applies to the top-level loop; background commands and swarm workers have no shared budget. Evidence: [crates/jcode-app-core/src/agent/turn_loops.rs:78-84](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/agent/turn_loops.rs#L78-L84); [crates/jcode-app-core/src/tool/bash.rs:1379](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L1379); [crates/jcode-config-types/src/lib.rs:635-641](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-config-types/src/lib.rs#L635-L641) (verified)
  - *To reach the next level:* Tool timeouts do not stop work, and sub-agents do not count against a shared budget.
- **D L1:** Defaults are a 32-worker swarm limit and a two-minute shell timeout the model can raise to ten minutes per call; nothing bounds steps or spend. Evidence: [crates/jcode-config-types/src/lib.rs:635-641](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-config-types/src/lib.rs#L635-L641); [crates/jcode-swarm-core/src/lib.rs:48](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-swarm-core/src/lib.rs#L48); [crates/jcode-app-core/src/tool/bash.rs:1009](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L1009) (verified)
  - *To reach the next level:* Steps and spend are unlimited by default and the model can raise its own timeouts.
- **B L0:** A runaway session can loop and spend indefinitely, and promoted background commands keep running. Evidence: searched `rg -n -i -e 'max_turns|max_iterations|max_steps|max_tool_rounds'` in `crates/jcode-app-core/src/agent` → 0 hits (The agent turn loop has no step or tool-round cap.); [crates/jcode-app-core/src/tool/bash.rs:1179](https://github.com/1jehuang/jcode/blob/e46eff2e6c6818c5be7291297d1867323cce7eb0/crates/jcode-app-core/src/tool/bash.rs#L1179) (verified)
  - *To reach the next level:* No ceiling on steps, time or spend for a session.
- **Cap:** none

## Rule-of-Two check
[A] untrusted input: web fetch/search, repository files and MCP results (crates/jcode-app-core/src/tool/mod.rs:420) · [B] sensitive data/systems: daemon environment credentials and ~/.jcode credential files reachable from the shell (crates/jcode-app-core/src/tool/bash.rs:677) · [C] state change / egress: bash and webfetch run without approval (crates/jcode-app-core/src/tool/mod.rs:955) · Same default session? Yes

## Highest-impact improvements
1. Require a per-call human approval for shell commands, file writes outside the workspace and outbound requests, showing the exact command or URL, instead of a model-written justification. (C2 S L0→L3, +0.225 before caps; Playbook 5)
2. Ask for a workspace-trust decision before loading project MCP config, project system-prompt replacements and project skills. (C6 S L0→L3, +0.225 before caps; Playbook 2)
3. Run the shell tool under an OS sandbox profile (Landlock/Seatbelt) with writes limited to the workspace and network off unless approved. (C4 S L0→L3, +0.225 before caps; Playbook 3)
4. Add a default per-turn step and token cap, and kill timed-out commands instead of moving them to the background. (C10 S L1→L2, +0.075 before caps; Playbook 3 step 3)
5. Scrub provider credentials from the shell tool's environment, as is already done for MCP servers. (C1 C L1→L2, +0.075 before caps; Playbook 4)

## Re-audit log
- C2 B: L0 → L1. Defending the zero: the catastrophic-target deny in the command-risk gate (gate.rs:81) and in apply_patch deletes still holds when the model self-justifies a call, so the root, home directory and credential stores cannot be deleted through those paths.
- C8 C: L2 → L1. Attacking the rating: redaction of saved transcripts applies only to the opt-in upload (agent.rs:1202); local session files, model-bound messages and the shell environment are unprotected, leaving logs as the only redacted path.

## Limitations
- Static source review of the pinned commit only; nothing was executed, installed, or probed.
- The pinned commit has no release tag; Cargo.toml declares version 0.90.1.
- Scored the interactive TUI and daemon on Linux/macOS. Opt-in features (ambient mode, messaging-channel integrations and the desktop app) were not scored, and Windows-specific code paths were not examined.
- The codebase is about 770k lines of Rust; the review concentrated on the tool registry, shell tool, command-risk crate, MCP loader, prompt assembly, memory tool, logging and telemetry.
- No text aimed at AI reviewers was found in AGENTS.md, CLAUDE.md or the docs examined.