Security
How LocalPilot limits what an AI agent can do on your machine — approvals, workspace confinement, worktree isolation, trust boundaries for MCP, skills and hooks — and how to report a vulnerability.
LocalPilot runs an AI agent that can read your project, edit files and run commands. This page explains what it can reach, what stops it, and where you have to make a trust decision yourself. For what data leaves your machine, see Privacy.
Where data flows
localhost~/.localpilot and .localpilot/approvals.network)skills.autoInstall is onNo account, no telemetry upload, no analytics SDK and no update check in the extension.
What the agent can do, and what stops it
| Action | Default | Limits |
|---|---|---|
| Read files | Allowed | Confined to the open workspace folders (or the agent’s worktree). A path that points outside them, through .. or an absolute path, is refused. To give access to another folder, add it to the VS Code workspace. |
| Create and edit files | Allowed (approvals.write: always) |
Same confinement. Every edit is snapshotted first; in a git repo the agent works in its own worktree and nothing reaches your workspace until you click Apply. |
| Delete files | Asks (approvals.delete: ask) |
Same confinement. |
| Run commands | Asks (approvals.terminal: ask) |
Commands run in a real shell as your user, so they are not confined to the workspace. This is the main thing to approve carefully. |
| Web search, web fetch, MCP tools | Allowed (approvals.network: always) |
Set ask to approve each call or never to block them. |
Set each policy to always, ask or never in Settings → Agent & approvals, or pick the Careful, Balanced or Autonomous preset. You can add finer rules in .localpilot/settings.json or .claude/settings.json, in Claude Code’s format: for example, "deny": ["Read(.env)", "Bash(rm *)"]. A deny rule always wins over ask and allow.
Trust boundaries
These are the places where text or code from someone else can influence the agent. Each one is a decision you make.
Untrusted repositories. A project can contain .claude/settings.json or .localpilot/settings.json files that allow commands without asking, and hooks that run shell commands when a session starts or a tool runs. In VS Code, LocalPilot does not run in Restricted Mode, so opening a repository you don’t trust in Restricted Mode keeps it switched off. The localpilot CLI has no Restricted Mode: only run it in projects you trust, or set localpilot.hooks.enabled to false.
Prompt injection. Files, web pages, tool output and MCP results can contain instructions aimed at the model. A local model is not better at ignoring them than a cloud model. The approvals above are the safety net: keep approvals.terminal on ask when the agent reads content you didn’t write.
Skills. A skill is a Markdown file of instructions the model follows. Skills installed automatically from the repositories in localpilot.skills.repositories are third-party text. Set localpilot.skills.autoInstall to ask to review each one, or off.
MCP servers. Each server is a program you configure. It runs with your user account and inherits your environment variables. Add only servers you would run yourself, and set approvals.network to ask to see each tool call.
Secrets. Provider API keys and the web search key are stored in your VS Code settings file as plain text, the same as other VS Code settings. Local servers usually need no key. If you turn on Redis storage for metrics, keep Redis on 127.0.0.1 or protect it with a password.
Isolation with git worktrees
With localpilot.worktrees.mode set to always (the default) in a git repository, each chat edits a separate worktree under ~/.localpilot/worktrees. Your working copy and open editors stay untouched until you review the diff and apply it. Commands the agent runs start in the worktree, but they are not sandboxed: a command can still write anywhere your user can.
Reporting a vulnerability
Please report security problems privately through GitHub security advisories rather than in a public issue. Include the LocalPilot version, your OS, and steps to reproduce. You will get an acknowledgement, and the fix will be credited in the changelog unless you prefer otherwise.
Non-sensitive bugs go to GitHub issues.