Docs
Security and data handling
How the app treats your information, feature by feature, stated plainly. The design rule behind all of it: the app organizes your tools; it does not sit between you and them.
The promises
- Local-first. Workspaces, history, layouts, and settings live in local storage on your machine. There is no account and no sync backend.
- Never broker auth. Each agent CLI authenticates your own account itself. The app never stores, proxies, pools, or meters provider credentials, and takes no cut of your AI spend.
- Consent before capability. Anything that gives an agent reach beyond its own terminal, like driving the browser, is off until you grant it, per workspace.
- Telemetry is opt-in, off by default. And even opted in, it never carries terminal content.
What lives where
| Feature | Where it lives | What leaves your machine |
|---|---|---|
| Terminals and command history | On your machine (local database and scrollback) | Never |
| Your code and project files | Your disk; the app reads what the CLIs you launch read | Never |
| Provider credentials (Claude, OpenAI, Google, ...) | By each official CLI itself, exactly as if you ran it in a plain terminal | Never touch the app, never touch us |
| Usage meter reads | Token read from the CLI's own store, held in memory for one request, then dropped | One request to the provider's own usage endpoint, from your machine |
| Usage API keys you paste (optional) | Your OS keychain, write-only: the app can use them, the UI can never display them back | Only to that provider, from your machine |
| Browser dock pages | An isolated session partition, separate from every other profile on your machine | Only the sites you browse, as any browser would |
| Workspace settings and layouts | Local database | Never |
| Crash reports and analytics | Nothing by default; telemetry is off until you opt in | Only if you opt in, and never terminal output, prompts, code, paths, or credentials |
Your provider credentials
There are two ways an app like this could give you AI: sit in the middle of your provider accounts, or host the official CLIs and stay out of the way. Workspace only ever does the second. Claude Code signs into Claude, Codex into OpenAI, Gemini CLI into Google, each exactly as it would in a bare terminal. The app launches them, watches their terminal signals, and organizes their panes. Your keys never move, and there is nothing of yours on our side to leak.
How usage meters read your plan
The usage gauge needs to ask your provider how much quota is left, and that requires the session your CLI already owns. The rules the meters live by:
- Adapters read the token from the provider CLI’s own known config location, hold it in memory for that one request, and drop it. No caching, no copies.
- The app never writes to any CLI’s credential store, for any reason.
- Tokens never appear in errors, logs, IPC payloads, or tooling output.
- If you paste an API key for a provider that meters that way, it goes straight into the OS keychain, write-only: the app can use it, but no screen can ever display it back.
- Usage values (plan names, percentages) never enter telemetry.
Browser dock isolation
The dock is a sandboxed page with no access to the app: no preload, no node integration, popups denied, http(s) only. It runs in its own session partition with a deny-all permission handler, so it shares nothing with your daily browser and cannot ask for your camera, location, or notifications. The app injects nothing into pages and reads nothing from them.
Agent control over the dock is a separate, explicit grant per workspace. Until you consent, every agent tool call against the browser is refused.
The local control plane
Everything scriptable, the mogging CLI and the MCP server, talks over local sockets only: a unix socket or named pipe plus a token in a file readable only by your user account. Nothing the app ships ever listens on a TCP port, so there is no surface for another machine to reach.
Crash reports and analytics
Telemetry defaults to off, and the app is fully functional with it off. If you opt in, crash reports and explicit product events may be sent, under hard rules: never terminal or PTY output, never prompt text, never code or file contents or paths, never environment variables, never credentials, never usage values. Event properties are simple values only, by construction.
This website
The site you are reading sets no cookies on visitors and counts traffic in cookieless aggregate. Forms are protected by a cookieless bot check that loads only when you use them. The full policy, including your rights and every processor we use, is in the privacy policy.
Reporting a security issue
Found something? Write to hello@mogginglabs.com or use the contact page. Security reports are read first and answered fastest.