Agctor is pre-1.0. Security fixes are applied on main. Please upgrade to the
latest commit (or release, once tagged) rather than carrying private patches.
Do not open a public GitHub issue for security bugs.
Please report vulnerabilities through GitHub Security Advisories or email rahamohebbi@gmail.com.
Include:
- A description of the issue and impact
- Steps to reproduce, or a proof of concept
- Affected commit / version if known
You should receive an acknowledgement within a few days. We will coordinate a fix and public disclosure with you.
Agctor is designed for trusted operators building agent systems. Several components can take destructive actions if an untrusted party can send them messages:
| Component | Risk |
|---|---|
CodeExecutorTool |
Compiles and runs C# (Roslyn) and Python (IronPython) in-process. There is no OS sandbox. |
FileSystemTool |
Reads and writes any path the process can access. Paths are not rooted or allow-listed. |
| MCP listener | Accepts TCP messages and routes them to agents. Default bind is loopback (127.0.0.1). Binding 0.0.0.0 exposes it to the network. |
| Host HTTP API | No authentication in this version. Do not publish it to the public internet. |
Recommended defaults:
- Run Host/CLI only on a machine you control.
- Keep
Mcp:Hostat127.0.0.1unless you add your own auth and firewall. - Do not wire code-execution or filesystem tools to agents that accept untrusted prompts without a sandbox you own.
- Keep Swagger and CORS (
AllowAll) limited to development.
OpenTelemetry.Api / Zipkin / Jaeger exporters currently carry moderate advisories.
Fixing the API/Zipkin issues requires OpenTelemetry 1.15.3+, which is a breaking
jump from 1.6.0 and is left for a follow-up. Prefer OTLP over the last Jaeger
exporter (1.5.1). Dependabot is enabled for remaining package updates.
Never commit API keys, connection strings, or appsettings.*.local.json. Use
environment variables or user secrets
for local overrides.