Security model

Keys stay on the server

API keys live in the server process, read from the environment or the macOS Keychain. The browser never sees them, and they are never written to a file.

Local by default

The server listens on 127.0.0.1 only and refuses requests from other websites.

Paired devices

Every API call needs a paired device or the local API token. To pair a browser, create a one-time code on a device that is already paired and enter it on the new one. The code expires after ten minutes. Failed attempts are rate limited.

Tool containment

• One folder. File and command tools work only inside the workspace folder.
• Sandboxed commands. Commands, background processes, and the Build mode checks run in a macOS sandbox. They can’t read X6’s own data (tokens, paired devices, chats), signal processes they didn’t start, or write outside their temporary folders.
• Sandboxed previews. HTML previews run with an opaque origin and can’t reach X6’s API (see Files and preview).
• Safer fetches. fetch_url reaches public addresses only. MCP requests that carry secret headers don’t follow redirects.

Logging

Note

X6’s logs record sizes, status, and timing for each request and tool call, never message content. Every tool call that runs without an approval click is logged with its reason.

Model behavior

Errors are shown exactly as the model service returns them. X6 never quietly switches models to get around an access error.