Security¶

• Clients use HTTPS to the agent only. No native EVE REST from laptops or CI.
• Pin or Trust the agent certificate. CLI has no TOFU UI.
• Do not put username/password in the agent URL.
• Agent session Bearer tokens are not EVE GUI cookies. Open Lab uses a one-time browser token.
• Do not store passwords in Git, chat, or MCP JSON.
• Destroy / prune / wipe / replace require an explicit confirmation channel (IDE modal, CLI --yes, MCP confirm=true).
• Mutating API calls are not silently replayed after EVE session expiry.

See also CLI security and Connect.