ReferenceSafety
What a job can and can’t touch
Workers run code, browse and make files. Here is what keeps that away from your machine, your keys and your folders.
Swarm runs as its own user
Swarm and its agents run as their own locked-down user, not as you. By default agents run their commands on the machine as that user, without permission prompts. Want more isolation? Turn on the gVisor sandbox (install.sh sandbox on) so each project’s jobs run away from the machine and your local network, or give a folder an environment: a container its agents’ commands run in, with only that folder’s secrets.
Nothing lands until it’s merged
Every job works on its own branch. Your folders stay as they are until your AI delivers the job: a local merge, or a pull request if you set up publishing. Swarm never pushes on its own.
Keys stay out of reach
You type model keys on Swarm’s setup page, never in chat. Agents see a stand-in, and only inside an environment; the real secret is added on the way out, only to the websites you allowed, for the folders you granted.
You see every key that reaches Swarm
Your AI’s key, your apps’ keys and your bots’ keys each work while they’re used and stop after 90 days unused, so nothing breaks on a date and nothing needs renewing. Your AI lists every key with when and where it was last used, hears when one is used from a new place, and revokes any of them in one step.
No public ports
Swarm listens on the machine only. Other devices reach it over your Tailscale network, or through a relay in your own Cloudflare account that your machines dial out to.
Spending limits
Set a daily limit and Swarm refuses new runs once it’s reached. Ask “what did it cost?” any time.
Agents that face the public are sealed
A custom agent on your site has no shell, files or web, only the tools your app defines. Its token reaches that one agent and nothing else.