Security
Your agents do real work on real systems. My Maestro AI is built to keep them to the work you allow, on hardware you own, and to tell you when something needs your attention.
My Maestro AI is built to keep agents within the limits you set. Still, a team of agents with real access depends on many moving parts, and each one is part of your security. Here is each of them, and how we recommend using your Maestro.
Your Maestro runs on your computer and listens only there, unless you turn on remote access, which needs two-factor. Keeping it safe also depends on that computer: its updates, passwords and disk encryption, and who else can use it. Agents that run directly on the computer can do what its user account can do; others run in a container that sees only the folders you grant.
A cloud model (Claude, GPT, Gemini and others) receives what an agent sends it: your messages, the conversation so far, the files and pages it works on, and tool results. The provider handles them under its own terms. A model running on your computer processes requests there, though tools and connected accounts can still send information out.
Email, calendars, chat apps, wallets and other accounts give agents more reach. Each connection is another path for information to come in or go out, and an agent can act through it.
Web pages, emails and documents can hide instructions meant to steer an agent. Agents are told to treat what they read as information, and your Maestro checks the actions they take, but agents can still be misled and no check catches everything.
My Maestro AI gets security reviews and fixes, but like any software it can still have flaws. Fixes arrive as updates that you choose to install. From version 5.7.0, your Maestro tells you when an update is ready and marks the ones that fix security problems.
My Maestro AI is provided as is, without warranty. See the license.
Conversations, memories, records and files live on your own machine, in plain files and SQLite you can read and back up yourself. Processing follows the model you choose: a hosted model sees the turns it handles, under its provider's terms, and a local model sends nothing off the machine. Agents that handle sensitive matters can be kept on local models.
Agents act through tools, and your Maestro checks their tool calls against a policy you set before they run.
Each tool call is classified as a read, a write, a send, an administrative, destructive or money action, and checked against the agent's role and your overrides. One switch halts every agent at once.
Choose which kinds of action always wait for you, such as destructive actions or actions that spend money, and approve them from a card on your desktop or phone.
Administrator rights on the machine are reserved for the lead agent, unless you lend another agent root for a set time. Your Maestro logs the root commands it sees. For added protection, don't let the computer account your Maestro runs under use administrator rights without a password (password-free sudo).
Trading wallets are built to sign only within the limits and the address book you set, and money actions can be set to wait for your approval.
Each agent can be limited to what it needs.
An agent's shell can run inside its own container, which mounts only its workspace and the folders you grant, and its file tools check where symbolic links lead before following them.
Members' agents run in containers, with access controls designed to keep each member's agents and files apart, and members get only the permissions you grant them. Sharing an agent with a member lets them use and change it and see its files, so share only with members you trust.
A script gets a token scoped to what it needs, usable only from your Maestro's own computer unless you allow more, with an expiry you can set and one-click revoke.
Accounts sign in with a password and an authenticator code, and the security check flags any account that has not set it up.
Security is not a setting you choose once. Your Maestro checks itself every day.
Every night your Maestro reviews its accounts and two-factor, network exposure, file permissions, agent permissions, tokens and open services, and tells you what to fix. It runs from a terminal too, even when your Maestro is down.
Every turn is kept in the transcript, every root command and permission change is logged, and every turn is costed in the ledger. You can always see who did what, and when.
Releases that fix a security issue, newest first.
Node.js fixed high-severity security issues (Node.js security releases). New installs get Node.js 22.23.4. The security check now flags a Maestro whose Node.js is missing those fixes and shows the fix for that install. How to update.
My Maestro AI is source-available under the PolyForm Noncommercial license. Personal, research and self-hosted non-commercial use is free. Commercial deployment, including use on behalf of clients, is available under a separate commercial license. Ask about commercial licensing.
One computer and an AI provider of your choice is all it takes.
My Maestro AI