Security model

Worth reading before you install anything that can edit your project.

What it is

A loopback-only TCP listener inside your editor, and a local process that talks to it. Both run as you, on your machine.

What it protects against

Remote access. The listener binds to 127.0.0.1 and is not reachable from another machine. There is no configuration that exposes it, deliberately.

Accidental connections. A random token is generated per editor session and written to the session files. Clients must present it. This stops another local program from stumbling into your editor by opening a port.

Runaway capability. There is deliberately no arbitrary code execution tool. Every operation is a specific, typed tool with a JSON schema, so what HullForge can do is knowable by reading its tool list rather than by trusting a promise. The cost is real: anything not implemented is simply unreachable, and no clever phrasing gets around it. That is the intended trade.

What it does not protect against

A hostile user already logged into your machine. The session token is stored in plaintext, because anyone running as your account can read your project’s Saved directory and reach 127.0.0.1 regardless. Encrypting it would be theatre.

HullForge is not a security boundary against local attackers and is not intended as one. If someone has your login, the bridge is not your problem.

Anything you tell Claude. Whatever a tool returns becomes part of your conversation exactly as if you had typed it. An asset path, a screenshot, a log line. That conversation is governed by Anthropic’s Privacy Policy, and Jigwright is not a party to it.

Network behaviour

None. HullForge makes no outbound connection of any kind. No analytics, no telemetry, no crash reporting, no licence check, no update check. There is no Jigwright server anywhere for it to reach.

You can verify this: block the process at your firewall and everything continues to work.

What it writes

Two session files, described in How it works, holding a port, a token, the project name and path, and a process id. Both are deleted when the editor closes.

Everything else it writes is your project, and only when a tool you asked for does it.

Reviewing it yourself

The tool list is the contract. hf_describe_tools returns every tool with its full JSON schema and its annotations, so you can read exactly what is exposed before you use it. Tools that change your project are annotated as writes, and the six that can destroy work are annotated destructive.

If a tool’s behaviour ever disagrees with its description, that is a bug worth reporting to support@jigwright.com.