The self-hosted agent hardening checklist

This is the checklist we run on every setup. It is published in full and deliberately not gated behind an email form. If you work through it yourself and never hire anyone, that is a good outcome.

The framing that matters: an agent worth having can read your email, send messages as you, and run commands on your machine. That is the point of it, and it is also the entire problem. Everything below is about reducing what goes wrong when — not if — something behaves unexpectedly.

1. Get your credentials out of plaintext

Most agent runtimes write credentials to a config file as readable text. That typically includes your model provider API key and an access token for every messaging account you connect.

• Move keys into your OS keychain or a secrets manager, and reference them rather than inlining them.
• Check file permissions on the config directory. It should not be world-readable.
• Check whether your backup tool is copying that directory to a cloud service. This catches people out constantly.
• Grep your shell history for keys you pasted while setting up, then clear those entries.

2. Scope every token down

The default instinct is to grant full access so things “just work”. Resist it.

• Create a separate API key for the agent, never reuse a personal one.
• Where the provider supports read-only or per-scope tokens, use them.
• For email, prefer a scoped app password or OAuth grant over your account password.
• Write down which keys exist and where. You cannot rotate what you have forgotten.

3. Set hard spend caps

Set these at the provider, not just in the agent’s config — an agent that loops does not respect its own settings.

• A monthly hard cap that stops requests, not just an alert.
• A separate billing alert at roughly half that.
• Check the actual spend daily for the first week. Usage patterns are never what you predict.

4. Do not expose the management interface

The management port should never be reachable from the internet.

• Bind to 127.0.0.1, not 0.0.0.0.
• If you need remote access, use a private network overlay such as a WireGuard tunnel or Tailscale. Not port forwarding.
• If it runs on a VPS, put a firewall in front and default-deny inbound.
• Verify from outside your network rather than assuming. Try to reach it from your phone on cellular.

5. Run it as its own user

Do not run the agent as your primary account, and never as an administrator.

• Create a dedicated service user with no admin rights.
• Containerise it, or otherwise confine it, with an explicit list of directories it may read and write.
• Give it your project folder, not your entire home directory.
• On macOS, be deliberate about which privacy permissions you grant. Full Disk Access is almost never actually required.

6. Control the supply chain

Extensions and skills are code that runs with your agent’s access.

• Pin a known-good runtime version rather than tracking latest.
• Turn off automatic skill updates. This is a live supply-chain path.
• Read third-party skills before installing them. If that is not realistic, do not install them.
• Prefer a smaller set of skills you understand over a large set you do not.

7. Decide what it may not touch

This is the step people skip, and it is the one that limits damage.

• Write down every account, folder, and capability the agent can reach. If that list surprises you, it is too long.
• Gate irreversible actions — sending, publishing, deleting, spending — on explicit confirmation.
• Keep regulated data out of scope entirely: medical records, client trust funds, anything under a compliance regime.
• Set up a separate email alias for the agent rather than giving it your main account, where the workflow allows it.

8. Have a kill switch you have actually tested

• One command or one click that stops everything.
• Write it down somewhere you can reach from your phone.
• Test it. A kill switch you have only read about is not a kill switch.
• Snapshot the machine before you install anything, so you can roll back cleanly.

What this does not fix

Hardening reduces blast radius. It does not make an agent safe the way a calculator is safe.

Prompt injection remains unsolved industry-wide. Hidden instructions in a webpage, an email signature, or a calendar invite can still be followed as though you had typed them. Everything above limits what a successful injection can reach — that is the honest claim, and anyone promising more is selling something.

New advisories will keep landing, because this software is young and moving quickly. Whoever runs it needs to be reading them and applying patches. That can absolutely be you.

---

We run this checklist on every setup we do, and we will walk you through doing it yourself in a workshop. If you would rather it were just done, that is what we are for.