Security
Security isn't a feature.
It's the architecture.
TKA doesn't bolt security on as an afterthought. Every layer — from database permissions to task dispatch to agent isolation — is designed to fail secure. Open source means you can verify every claim on this page yourself.
HMAC-SHA256 Task Signing
Every task is cryptographically signed before execution. If a single byte is tampered with, the system halts, logs the event, and alerts you. Constant-time comparison prevents timing attacks.
Tasks are signed over their full metadata: title, executor, description, model, workspace context, and knowledge references. Canonical JSON encoding prevents signature bypass via formatting changes.
Three-Tier Database Isolation
Three separate MySQL users with granular permissions. The web process cannot mutate execution state — even if compromised.
Engine: full access for the CLI runner. Web: can only insert boss actions and task logs. Readonly: agents can query but never write. A compromised web server cannot change task status, HMAC signatures, or flow state.
Runner / Web Separation
Two completely separate application instances. The web server never executes agents. The runner never serves HTTP.
No shared process space. The web instance accepts your commands and writes them as boss actions. The runner reads those actions and decides what to do. Complete compartmentalization.
Agent Trust Levels
Two-tier permission model. Trusted agents get full filesystem access for development work. Sandboxed agents can read but not write.
Trust level is enforced at dispatch time, not by the agent itself. Sandboxed agents are used for ideation, proposals, and analysis — they can't modify source code or system state.
Encrypted Boss Notes
All notes from the human operator are AES-encrypted in the database. Decrypted only on retrieval.
Uses Laravel's AES-256-CBC encryption with the application key. Even raw database access doesn't expose your instructions to agents or other systems.
Prompt Injection Guards
Proposal content is explicitly marked as DATA, not instructions. Agents are told to block and report if they detect injection attempts.
Every proposal artifact includes an injection guard preamble. If an agent detects directives to modify behavior, ignore instructions, or act outside scope, it blocks the task and reports the attempt.
Fail-Secure Architecture
HMAC verification failure doesn't just log — it pauses the entire system and can send an alert to your preferred channel.
The system assumes the worst. A single failed signature check halts all execution until the operator investigates. No degraded mode, no "continue anyway." Immutable audit trail in the system events table.
TOTP Two-Factor Authentication
Google Authenticator compatible 2FA on your account. Required before accessing any management interface.
Standard TOTP with 6-digit codes. Enforced via middleware — routes are blocked until verification is complete. Session-based challenge prevents replay.
Weight Budgeting
Concurrent execution limits prevent runaway agent storms. The system can't accidentally spawn unlimited parallel tasks.
Configurable weight budget (default 20). Each task consumes weight while executing. Dispatch is blocked when the budget is exhausted. Prevents both accidental and malicious resource exhaustion.
OAuth Token Isolation
Each headless agent session gets an independent authentication token. No shared credentials between concurrent tasks.
Tokens are injected into the subprocess environment at dispatch time. No credential file sharing between tasks — prevents race conditions and token contention.
Your only real attack vector
If someone has access to your command line, TKA's security doesn't matter — your entire machine is already compromised. Everything else is locked down. We don't ask you to YOLO. We built the guardrails so you don't have to.
Get Started