Security and data

This page is for security reviewers and team leads evaluating BMO before a pilot. For the full threat model, see Security posture and the canonical threat model.

Data flows

Data	Local use	Possible destination
Prompts and selected repository content	Conversation and tool context	Configured model provider, including file excerpts and tool results supplied as context
Credentials	Environment, config, or credential store	The service they authenticate
Session and run records	BMO data directory	Conversation history can become model context; configured exports or telemetry can send records elsewhere
Web and MCP tool requests	Agent tool calls	Requested websites or configured MCP servers

The execution environment also matters: a remote sandbox can receive files and commands. HTTP/MCP services expose configured BMO capabilities to their clients. Review provider, tool, sandbox, service, and optional telemetry configuration when deciding what data may leave your machine.

Controls operators rely on

Approval gates — tool requests are evaluated against policy and grants. Allowed tools, existing grants, and auto-approval settings can permit actions without a new prompt; do not assume every write asks for confirmation.
Sandbox backends — options.sandbox.backend selects local, docker, ssh, or buildkit. The default, local, executes commands on your host. See Sandbox for each backend’s boundary.
Tool policy — options.disabled_tools, per-agent allowlists, permissions.
SSRF and path guards — documented in the threat model; not a substitute for network policy.

BMO does not claim hermetic sandboxing, formal verification, or safe execution of arbitrary third-party MCP servers because they can be configured.

Audit after the fact

Question	Surface
What tools ran?	Agent Debugger, File tools telemetry
What was approved or denied?	Permission prompts, session status
Cross-surface session truth	Session observability parity
Support incident package	`/incident`, Incident response

Remote and enterprise surfaces

HTTP/MCP server — bind address, token auth, TLS; see HTTP server and MCP server.
Private-network MCP — BMO dials configured URLs or stdio on reachable hosts; no first-party MCP tunnel. See Enterprise networking.

Disclosure

Report vulnerabilities via SECURITY.md (GitHub private reporting).

Why BMO — fit and comparison
Team adoption — rollout controls