Back to OpsTether
Security
OpsTether uses an outbound device agent, one-time pairing credentials, per-device tokens stored as hashes server-side, tenant isolation, bounded tool output and audit metadata. Operational results can contain secrets; review what you request and share with your connected AI client.
Authentication
Public MCP access uses OAuth-compatible bearer tokens validated against issuer, audience, expiry, scopes and JWKS signature keys. Internal tunnel credentials are separate from public user authentication.
Administrative mode
Root access is opt-in during installation. Because root access is intentionally unrestricted, security depends on protecting your AI account, OAuth session and paired-device credentials.