Safety & Privacy

Last updated: September 2026

MXterm Pro does not upload your SSH passwords, terminal output or agent transcripts. It sends a short, listed set of data to mxterm.net and Google Analytics, and you can switch off the usage reports. It is not a sandbox. A pane is as powerful as the shell behind it, and that includes any AI agent inside.

When MXterm Pro is the wrong choice

The controls here suit a developer who runs agents in repositories they can reset and wants to see what the app sends. Agents get real shells, and you decide how far to trust each one. Some needs are better met elsewhere.

• You need a hard boundary around untrusted agent output. Use a container or virtual machine, because a pane here has your user's full access.
• Your policy forbids every outbound connection. No setting turns off the update check or the free-tier limits request. You can block mxterm.net at your firewall, and the app keeps working.
• You need an Authenticode-signed Windows installer. The current one is not signed.
• You need Linux. There is no Linux release.

What leaves your machine

This table lists what the app sends by itself. Each request also shows your IP address to the server that receives it. The reports behind the switch never contain terminal output, commands, file paths, SSH hosts or license keys, and a check drops any payload that trips a list of such terms.

Builds you compile yourself carry none of the reporting keys, though they still make the update and limits requests. The switch is re-read before every send. The telemetry reference lists every field.

Two things sit outside the table. Tools you run inside a pane, such as Claude Code or Codex, make their own calls to their vendors. Anything you connect to, such as an SSH host, a Machine or a page in the preview column, receives what you send it. The app makes no request to an AI model itself: Command Recipes (⌘J) is a local keyword table.

What stays on your machine

MXterm Pro has no cloud account, so what it stores is stored here. The list below says where each kind of data sits and how it is protected.

What an agent pane can do

An agent pane is a real terminal running the agent's command line tool in your folder, as your user. It can read and delete the files you can, use your git credentials and reach your network. MXterm Pro adds no permission layer to what an agent runs.

Bypass Mode

Bypass Mode is a checkbox in the new-tab composer, off by default. When on, it appends the agent's own skip-approval flag as the pane starts, and that agent then runs commands and edits files without asking. Older versions defaulted to on; installs that never changed it now start off.

The table shows some of them. Fourteen agents get their own flag, and Goose uses an environment variable set only in Settings. Agents with neither get nothing, so the setting changes nothing for them.

The check on your own typing

One check sits in front of what you type. If a line you type or paste matches a short fixed list, such as rm -rf / or git push --force, a confirmation asks first. The list is a handful of substrings, so other spellings pass. It does not watch what an agent runs on its own.

What the MCP server lets an agent do

MXterm Pro runs a local MCP server so agents can drive parts of the app. It has eight tools, and none of them reads another pane's output.

One tool deserves care. mxt_room.send in execute mode types text into another agent's terminal in the same room. It cannot target the Moderator, it is capped at 20 messages a minute and 8,192 bytes, and the receiving agent is told the text is a handoff from a peer, not from you. File claims are advisory: nothing blocks a write.

The session token and the files it touches

Each pane's session token is its terminal ID, a random UUID. MXterm Pro exports it into the pane's environment as MXTERM_SESSION, so any program in that pane can read it. The server listens on loopback only. Any local program can reach the port, but every call needs the token of a live pane, and closing the pane ends the token.

So that agents can find the server, the app edits configuration outside its own folder at every launch. It adds an mxterm entry to ~/.claude.json, ~/.codex/config.toml and ~/.omp/agent/mcp.json, creating them if missing. It also appends one line to ~/.zshrc when that file exists. None of these holds a secret, and the entries stay after you quit.

Gemini CLI cannot read the token from the environment. For a Gemini pane, the live token is written to .gemini/settings.json in the project, and MXterm Pro adds that path to the project's .gitignore so it is not committed by accident.

Worktrees and what they do not do

Git worktrees give each agent its own branch and folder under .worktrees, which lowers the chance that one agent's change collides with another's. They do not undo a bad command inside a worktree, and they do not stop an agent from reaching files outside it. In a repository that has no commits yet, worktree isolation first makes an Initial commit that holds only an empty .gitkeep file, and nothing else in the folder is committed. The worktree guide explains the mechanism.

Remote access

The host server that lets another device drive your panes is off until you press Start Server in Settings → Remote Access & Devices. One setting, Start the host server when MXterm opens, is off by default. When you turn it on, the server starts each time MXterm opens and retries for up to 5 minutes while the network comes up. It listens on a Tailscale address if the Mac has one, and also on its private network addresses if you turned on Allow devices on my local network; otherwise this Mac only. It never listens on a public address.

Sharing is per pane and off by default. You share a pane as view only or with control, for 30 minutes, 1 hour, 8 hours or until you stop it. A paired device sees only shared panes, and can type only in a pane shared with control, one writer at a time. On Free, at most 5 panes can be shared at once by default. MXterm Pro is built to restore your shares after a restart once each pane is running again, and to drop any share it cannot verify.

A new device pairs with a six-character code that expires after 5 minutes and works once, and repeated wrong codes lock pairing for 5 minutes. You can also turn on an access password, which lets a new device pair with the password instead of a code. It is accepted over Tailscale and, if you allow local network access, over the local network, where it is not encrypted. It is off by default. A Free license can set a Temporary password of up to 8 hours (minimum length 6 characters); a Standing password with no time limit and Temporary passwords of up to 7 days need Pro. Device tokens are 256-bit, stored as hashes on the host, expire after 30 idle days and can be revoked at once. On Free, by default, 1 other computer can be paired to control this one; the MXterm phone app and browsers are not counted.

While the host server is running and at least one pane is shared, MXterm Pro keeps the computer from going to sleep on its own, so a paired device can still reach it. The screen can still turn off, and a sleep you cause, such as closing the lid on battery, still happens. This is on by default and has a switch in Settings → Remote Access & Devices. It is built for macOS and Windows; the Windows side is unverified.

The server speaks plain HTTP and WebSocket and adds no TLS of its own. On a local network, others on it could read the traffic, and Settings warns you. Tailscale encrypts connections between your devices, so a tailnet address is the safer choice. Which address MXterm Pro uses covers the order.

License checks

A license is an Ed25519-signed token. The app checks its signature against a public key built into the app, on your machine, at every launch. When you are online it also asks mxterm.net whether the license is still valid, at launch and about once a day. Nothing expires: the token records an issue date for provenance, and the app never compares it to the clock.

Activating a pasted key and the periodic re-check are the license steps that use the network. The app sends the key, a machine fingerprint, your computer's hostname, the app version and the platform to mxterm.net, which counts the seat and returns the signed token. The fingerprint is a shortened SHA-256 hash of the hardware ID, and the ID itself is not sent.

Deactivate frees the seat the same way, and pasting a signed token activates offline. A re-check that fails or finds you offline changes nothing. Only a clear answer that the license or seat is gone, given twice in a row, removes Pro. Seats are counted only when you activate.

Downloads, signing and updates

The macOS build is signed with a Developer ID certificate, uses the hardened runtime, and is notarized by Apple and stapled. It is a universal binary. It has no App Sandbox and holds no entitlements. Check it yourself: compare the DMG's SHA-256 with the changelog value, then run spctl -a -t exec -vv on the app. The source line should read Notarized Developer ID.

An update downloads only after you click. The updater then verifies a minisign signature against the public key inside the app before anything is installed. That check is separate from Apple's signing, and it protects updates on both platforms.

The Windows x64 installer is not Authenticode-signed, so SmartScreen shows Unknown publisher on first run. Windows support is new. These are unverified on Windows: the credential store, the SSH file panel and tunnels, agent detection in plain panes, and the remote host server and its keep-awake.

The app window sets no content security policy. It loads only code bundled with the app, and page previews open in separate webviews.

Permissions the app asks for

On macOS you may see these prompts.

• Folder access for Desktop, Documents and Downloads, when a shell in a pane touches them. The prompt text says why.
• Notifications, the first time the app sends an agent banner.
• Open at login, only if you switch it on in Settings → General. macOS lists it under Login Items.
• Reading Claude Code's saved sign-in, only after you enable Plan limits in Settings → Token Meter.

On the Mac, the app uses the microphone only when you press the dictation button, and it declares no camera or location use. The phone app uses the camera only to scan a pairing QR code or to take a photo you send to your own computer, and the microphone only when you tap the mic to dictate.

What MXterm Pro does not claim

It does not sandbox or restrict a terminal, or an AI agent inside one. It does not promise that worktrees, file claims or the typed-input check prevent data loss. They lower risk; they are not guarantees.

Safety FAQ

Questions about safe use? Write to support@mxterm.net. See also the privacy policy.