Security
The long version of the homepage data-flow diagram: what stays on your device, what has to leave, the safeguards you can verify in the code, and the promises we don't make.
Stays on your device
- Chat history (SQLite) — Stored in a SQLite database in your data directory; deleting a bot deletes its chats.
- Long-term memory (Markdown) — Markdown files in your data directory with a journal.jsonl change log; passwords, keys and ID numbers are refused.
- Workspace files — The bot's own workspace; writes stay here by default and anything beyond needs your approval.
- Model key (isolated, last 4 shown) — Kept in the gateway process and config; the agent process never sees the real key; the UI shows only the last 4 characters.
- Console: 127.0.0.1 + token — Listens on 127.0.0.1 and checks the Host header by default; Docker mode requires an access token.
Leaves your device
- What you send to the model (including screen content during computer use) travels through the Modelflare gateway to the provider you choose.
- Modelflare keeps request logs for a retention period (you can pick 7–365 days in your profile) per its “Data retention” doc; when a request ultimately fails, or a route fails before a fallback succeeds, the gateway keeps one copy of the raw request (without the Authorization header) for troubleshooting and deletes it after 72 hours (same doc).
- Messages in WeChat and Feishu pass through those platforms' servers by nature.
Modelflare’s “Data retention” doc
AnyModelBot compared with typical cloud-hosted assistants
| AnyModelBot | Typical cloud-hosted assistants | |
|---|---|---|
| Where it runs | Your computer / your server | The vendor's cloud |
| Where chats and memory live | Your disk | Vendor servers |
| Models | Any model on Modelflare, swap any time | Usually tied to the vendor's own models |
| Billing | Free app; models billed per use by Modelflare | Usually a monthly subscription with tiers |
| Computer use | Operates your own computer (24 bounded actions) | Operates a cloud computer the vendor provides |
| Do inference requests leave your device? | Yes, via Modelflare to the model provider | Yes |
| Auditable code | MIT | Mostly no |
“Typical cloud-hosted assistants” describes the common approach of vendor-hosted, monthly-subscription products, not any specific product.
Safeguards in the code
- The console listens on 127.0.0.1 by default and checks the Host header; binding a non-loopback address requires an access token.
src/web/server.ts - Model keys never enter the agent process; the UI shows only the last 4 characters.
src/agent/bridge.ts · src/agent/host.ts - Files and commands run in a sandboxed workspace, with approval for anything beyond; on Linux, bubblewrap also hides the data directory.
src/agent/host.ts - Memory refuses passwords, keys and ID numbers.
src/agent/memory.ts - Telemetry environment variables of the computer-use driver (Cua) are set to 0; magpie's auto-update is disabled.
src/agent/cua-driver.ts · src/magpie/supervisor.ts
Limits and promises we don't make
- No offline or local models; inference requests always leave your device.
- Computer use runs automatically by default (switchable to ask before UI-changing actions); the direct macOS mode hasn't been verified on real machines.
- The app's network behaviour hasn't been audited by a third party, so we don't claim “zero telemetry”.
- Platforms other than Linux don't get the bubblewrap layer; sandbox strength varies by platform.
Found a vulnerability? Email support@anymodel.bot.