Security
An AI agent that can run commands, change files or spend money can do real harm, and an AI system that improves itself must never be able to switch off the checks on it. G6 is built around both risks.
Early alpha. Individual capabilities have been tested; general application-level improvements have not yet been established.
G6 runs on your own computer. It is a library and an MCP server you install yourself. There is no G6 service, account or server of ours behind it, so nothing you do with G6 reaches us.
What G6 does to protect you
- The MCP server opens no network port. It talks to your agent over standard input and
output on your computer. An operation a component marks as sensitive, because it runs a program on your
computer, reaches the network or changes your machine, is refused over MCP unless the person who runs the server
lists it in
G6_MCP_SENSITIVE. - The meta-harness changes nothing on its own. It proposes a change, tests it on held-out tasks, and waits for a person to approve it.
- A worked example's page is served only to your computer (127.0.0.1). It refuses requests from other websites, and its controls need a random token made fresh each time it starts.
- A model provider's key stays on your computer. G6 reads a key only from your key file,
~/.g6/.env: a plain text file, not encrypted, that you write yourself. A worked example's page never takes a key, and G6 sends a key only to its provider. Delete its line to remove it.
What G6 is not
G6 is not a security boundary on its own: do not use it as the only check in front of something that acts in
the real world (see the FAQ). G6 runs untrusted code for you only inside an
operating-system boundary: on Linux, bubblewrap, with a private loopback and no other network, and only its own
run folder writable; on Windows, once you have run the one-time access grant that g6 doctor prints,
an AppContainer: no network, and only its own run folder writable. Where no operating-system boundary can confine it (macOS, Linux without bubblewrap, and
Windows before the one-time access grant), G6 refuses to run untrusted code for you (a patch, a generated script,
a repository's tests) unless you allow it once with g6 setup. Code you allow then has your own rights: it can read
your key file ~/.g6/.env and your other files, and its network guard works inside Python only. You are responsible
for what you run. G6 is open-source software provided "as is", without warranty, under the
Apache License 2.0.
This website
The site is a set of static pages: no accounts, no forms, no cookies and no analytics, served with a strict content security policy. See Privacy.
Reporting a vulnerability
Write to us privately, not in a public issue, with what you found and how to reproduce it, using , and please give us a chance to fix it before you publish. There is no bug bounty.