Full control.
Your rules.

Tenux puts an AI agent on your own computer — so the security model isn’t a feature, it’s the product. This page is exactly how it keeps you in charge.

Commands are proposed, not just run

Out of the box, anything that executes — a shell command, keystrokes typed into your terminal — is proposed before it runs. You see the exact command, the agent’s stated reason for running it, and why you’re being asked. Nothing touches your terminal until you approve, and an unanswered ask is a no after 45 seconds.Approve something “always” and it stops asking for exactly that — the same command or keystrokes, in the same folder. Your choice, remembered on your device.

The approval window, as it appears on your phone. The command is always shown in full — never summarized.

Your keys stay out of reach

The chat agent’s file tools cannot read or write your credential stores — or Tenux’s own config files, where your device secret lives. These denies are baked into every session: no rule, grant, or approval can remove them, in any mode.

  • ~/.ssh
  • ~/.aws
  • ~/.npmrc
  • ~/.netrc
  • ~/.config/gh
  • ~/.git-credentials
  • ~/.claude/.credentials.json
  • ~/.claude.json

Why “file tools” and not just “the agent”? Because a shell command can always be quoted around a path filter — pretending otherwise would be a promise we can’t keep. That is exactly why commands are proposed to you in full instead.

Rules you can commit

Permission rules are plain files, not hidden switches. Commit .claude/settings.json to your repo and every teammate’s agent follows the same guardrails — reviewed in pull requests like any other code. A local overlay and your user-global file layer on top.

// .claude/settings.json — committed with your code
{
  "permissions": {
    "deny":  ["Read(./secrets/**)"],
    "ask":   ["Bash(git push:*)"],
    "allow": ["Bash(pnpm lint)"]
  }
}

Deny beats ask beats allow. A project file can add deny and ask rules. Its allow rules stay off until you review and trust them in chat settings, and if they change, they stay off until you trust them again. Strict mode ignores allow rules entirely. And when a rule blocks the agent, the chat shows a receipt naming the rule that stopped it — every tool call the agent makes, allowed or denied, is a visible row in the transcript, kept on your device.

Three modes. You pick.

StrictEvery command, write, and browser action asks first — even ones you've allowed before.
StandardCommands are proposed with an explanation. Edits ask once per folder. Safe reads and browser actions run without prompts.
AutonomousNever asks — chat can run anything on this machine unprompted. Opt-in behind a second confirmation tap, and one committed setting disables it entirely.

Whatever the mode, the credential denies above still hold — they sit in front of every other layer.

We’re the pipe, not the destination

Your phone reaches your computer through encrypted tunnels and a managed relay. We monitor resource usage, connection state, and abuse signals — not the contents of your traffic. We don’t inspect your code, files, terminal output, or chats. (Tenux Chat on credits passes through our servers so we can meter it and forward it to the AI provider; we don’t store or review it.)

The full data story — what we store, for how long, and who processes it — is in the Privacy Policy and the sub-processor list.

On your device, not our servers

The workspace’s working state lives on your machine: your chats and their tool-activity record under ~/.tenux, your always-allow choices, and a content-free tally of permission decisions — counts by outcome and rule layer, never commands or file contents — that Tenux never stores.

Who’s responsible

Security at Tenux is led by Raul Avila, founder.

Found a vulnerability or a security concern? Report it to [email protected] rather than disclosing it publicly. The same contact is published in /.well-known/security.txt.