Raven

Raven runs as the operator's own OS user and holds the model-provider and web API keys from its config. Its main shell tool strips the environment down to an allowlist, so API keys and cloud credentials in environment variables do not reach shell commands. Nothing narrows file access by default, though: the read tool has no fence and reading files is auto-allowed, so ~/.ssh, ~/.aws and other credentials on disk are one call away. Third-party CLI sub-agents are given a full capture of the user's login-shell environment.

Every tool call, including MCP tools and built-in sub-agents, passes one permission gate with a parsed read-only shell allowlist, a catastrophe deny list and per-call prompts that show the exact call. But the shipped mode is 'smart': an LLM reviewer approves most ask-tier calls itself and is told to allow pushing branches, installing dependencies and running scripts; a human is asked only when it escalates, and the reviewer also runs in unattended turns. Third-party ACP sub-agents have every permission request auto-approved. The strict per-call 'ask' mode exists but is opt-in.

The default tool set includes an arbitrary host shell, file write and edit, web fetch and a browser, all enabled at once. Some validation is strong: web fetch blocks private and metadata addresses and rechecks every redirect hop with DNS pinning, and the shell's auto-allow list is a carefully parsed read-only command set. But file tools resolve paths with no containment by default, and the shell itself is a raw command string. An opt-in restrictToWorkspace mode adds resolved-path containment for file tools.

Shell commands run directly on the host as the user by default; the code even logs a warning saying prompt-injected commands run with full host privileges. An opt-in Boxlite microVM backend is a strong boundary and fails closed if it cannot start, but it mounts the workspace read-write with open network by default, and third-party CLI sub-agents still run on the host. Environment scrubbing keeps API keys out of shell commands, but the home directory is fully reachable.

Every tool result is wrapped in a nonce-tagged 'untrusted data' fence before the model sees it, and chat channels deny unknown senders by default. Nothing acts on that fence: reading files and fetching arbitrary URLs are auto-allowed, and the default LLM reviewer approves pushes, installs and script runs. A prompt-injected session can therefore read local secrets and send them out through a fetched URL, and take irreversible actions, without a human.

Raven's own settings load only from the user's home, but plugin loading from the working directory is not gated by a trust decision. Long-term memory (user.md) is written automatically from conversations and re-injected into the system prompt unfenced, under a single default user id, while the EverOS recall block is fenced.

Raven loads plugins from four places and imports them into its own process with no verification. The Skill Hub installs router-picked skill bundles automatically by default, with no hash checks. The built-in plugin catalog is curated and some entries are pinned, but others launch npx packages at @latest. MCP stdio servers run as separate processes with a reduced environment, but in-process plugins get everything.

Raven scrubs the exact credential values it holds from every tool result before the model, trace spans and the client see them, redacts common secret patterns on the editor wire, gives shell commands an allowlisted environment, and stores OAuth tokens with owner-only permissions. No third-party telemetry was found. But secrets that are not Raven's own, such as ~/.aws/credentials or a repo's .env, are readable without approval and go to the model unredacted, and provider keys are long-lived.

Every registry tool call is recorded as a structured span with arguments, result, and the permission decision (rule, LLM reviewer verdict, or human choice), in local JSONL under ~/.raven/traces, on by default. Records sit where the agent's own unfenced file and shell tools can edit them, and tracing can be turned off through a setting the LLM reviewer may approve. Write errors are swallowed.

Each turn is capped at 40 tool iterations, shell commands time out (60 s default, 600 s max) and their whole process group is killed, model calls have timeouts, and sub-agents are limited to 8 at once and 30 spawns an hour. There is no token or spend cap, sub-agents get their own iteration budgets, and the iteration cap (up to 200) is a setting the LLM reviewer may raise. Long playbook runs and scheduled tasks can continue for days.