What leaves your machine, and what the server never does
What leaves your machine and who decides it, and the gestures the server never makes. The provider of a hosted model receives the pages of the sites you allow.
What leaves your machine
One thing leaves by design: the content of the pages of the sites your profile allows. The image, the tree and the elements of an observation go to the model; if the model is hosted, its provider receives them. What a provider keeps of what it receives is not confirmed by this project. A frame of another site embedded in an allowed page travels with that page: the server masks frames in the image and never reads their text, but it cannot filter what the model receives from elsewhere.
| What | Leaves? | Set by |
|---|---|---|
Pages of the sites the policy admits (under strict, the allowed sites) | yes: image, tree, elements, to the model | you |
| Pages the policy does not admit | no, only their origin | you, by the origin policy |
| Passwords and other secrets | no: read in the server’s memory at typing time, sent to the browser over the local connection, never in a result, a log, an address or an argument | the code |
| Sensitive fields on screen | no: masked in every image, values withheld; no image if a mask fails | the code |
| Addresses of pages | origin and path; values of sensitive parameters and the fragment withheld | the code |
| Titles and addresses of your other tabs | no | the code |
| Error messages | only through the same exit point as every result | the code |
| Files of your disk | no: no navigation to a local file, no upload | the code |
| Journal and captures | no: written in the encrypted directory | the code |
What is set by you is set by your origin policy, your list of sites and your choice of model; what is set by the code, no profile key and no tool parameter changes. No other emission to a third party exists in the code; adding one would be a choice of yours.
What the server never does
- It never mounts or unmounts the encrypted directory and never knows its password.
- It opens no listening port. It connects only to the browser’s debugging port
on
127.0.0.1. - It runs no script that the model or a page provides; the only scripts it sends to a page are constant texts written in its code.
- It uploads no file, opens no local file, and does not touch the clipboard.
- It does not list or read the tabs you opened. It lists the tabs it opened, the windows their pages opened, and the tabs an earlier run of it left open; those it can close, not drive.
- It does not start or close the browser.
- It never pays, deletes or changes a secret without your confirmation, and no parameter of a tool can approve one.
- It changes the operator profile in one case only: under
discovery, when you answerAjouter à la liste, it writes that one origin in the list of sites. No tool of the model changes the profile.
The setup assistant, mcp-server-diwall-browser-setup, is another program, which you run in your own terminal: it creates and opens the encrypted directory, starts the browser, and closes both. No module of the server imports it, and it never reads the password, which gocryptfs asks for on your terminal.
These hold for a model that has only the fourteen tools. A model to which the client also gives a shell under your account is not bounded by them: see Limits.
What you can check afterwards
Every tool call adds one JSON line to journal/operations.jsonl in the
encrypted directory, with the intent the model gave. Around a payment, a deletion or a change of secret, the server
keeps a capture before and after in evidence/<date>/<operation_id>/, with the
same masks as the image the model received.