How Gimotty protects your servers

Gimotty is a tool that runs commands on purpose, not a sandbox. This page says plainly what it does to keep that power in your hands, and what it does not promise.

SSH encryption comes from OpenSSH

Gimotty runs the OpenSSH client that ships with Windows. It does not implement its own cryptography.
It ignores your user and system SSH config so inherited ProxyCommand, Match exec and trust overrides cannot run. A private temporary config carries the same policy to every jump hop.
It keeps its own known_hosts. Desktop tabs ask you to confirm a new host key and refuse a changed one. MCP and exec never ask; they only accept keys you trusted beforehand with a matching SHA256 fingerprint.

Passwords stay encrypted and out of reach of AI

The vault is one XChaCha20-Poly1305 ciphertext keyed by Argon2id (64 MiB, 3 passes) from your master password. Weakened parameters fail to decrypt.
A saved password is typed only when that session’s own prompt asks for it (for SSH, a prompt naming its user@host), within 60 seconds of connecting, and only once. Jump hosts and sudo never receive it.
The assistant, the MCP server and exec never read the vault. Session logs record only [saved password sent].

AI acts only with your approval

Only lookups run without asking. Every connection, input, command and file read or write waits for approval and expires after 5 minutes.
Tool output and file content are treated as untrusted data, never as instructions. This is defense in depth; no software can promise immunity from prompt injection.
Model traffic uses HTTPS, except loopback and private addresses you allow. Redirects are refused, and provider error bodies are not shown because they can echo credentials.

MCP access is set by the person who starts it

Startup flags (--allow-connect, --allow-write, --allow-local) bound everything; tool arguments cannot raise them.
Folders and sessions can be hidden from AI or made read-only.
Without --allow-local, file tools cannot read or overwrite arbitrary files on your PC.

Everything is recorded on your PC

The audit log records connections, input, commands and file calls, with results, including denied and expired approvals.
Files are saved atomically. Session saves are locked and refuse to overwrite changes made elsewhere.
Unix configuration files are owner-only. On Windows, a saved API key is protected with DPAPI for your account.

Gimotty contacts only what you tell it to

No account, no telemetry, no automatic update check, no Gimotty cloud.
License activation is offline. The device ID is a one-way digest of the Windows installation ID, with no hardware serials, user names or MAC addresses.
The only connections are to your servers, your proxies and the model endpoint you configure.
Conversations are kept in memory and not written to disk.

What we do not claim

Gimotty is not a sandbox. Commands run with your rights or the server account’s rights.
It has not had an external security audit yet.
Early-access builds are not Authenticode-signed yet. Check the SHA-256 file that comes with each download.
A cancelled command can leave detached processes running on the server.

Need a security review?

We answer security questionnaires and can walk your team through the design. Email us with your requirements.

Request a security review