# Defense-in-depth score: Kimi Code CLI

**Repo:** https://github.com/MoonshotAI/kimi-code · **Commit:** `21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3` · **Reviewed:** 2026-10-05
**What it is:** Moonshot AI's terminal coding agent (TUI, print mode, ACP and web server) that reads and edits code, runs shell commands, fetches web pages and delegates to subagents.
**Category:** Coding
**Scored configuration:** Interactive TUI (`kimi`) with no flags on a fresh install, default "Always Ask" (manual) permission mode, working folder accepted at the startup trust prompt, inside a git repository on macOS/Linux.
**Agent surface (default):** code execution yes · filesystem write yes · network egress yes · external credentials yes · persistent memory no · untrusted input yes · third party extensions opt-in · sub agents yes · external communication no

## Score: 2.7 / 10.0 (Minimal)

| # | Criterion | S | C | D | B | Raw | Cap | Score | Confidence |
|---|---|---|---|---|---|---|---|---|---|
| C1 | Identity & least privilege | L0 | L0 | L0 | L1 | 0.05 | none | **0.05** | High |
| C2 | Approval gates | L3 | L2 | L2 | L2 | 0.57 | G2 | **0.25** | High |
| C3 | Tool & action scoping | L2 | L2 | L1 | L1 | 0.40 | none | **0.40** | High |
| C4 | Code-execution isolation | L0 | L0 | L0 | L0 | 0.00 | none | **0.00** | High |
| C5 | Untrusted input blast radius | L1 | L0 | L1 | L0 | 0.12 | C5-WORSTCASE | **0.12** | High |
| C6 | Memory, context & configuration integrity | L0 | L1 | L1 | L1 | 0.17 | none | **0.17** | High |
| C7 | Third-party extensions | L1 | L1 | L2 | L1 | 0.30 | none | **0.30** | High |
| C8 | Secrets & sensitive-data protection | L2 | L2 | L1 | L0 | 0.35 | none | **0.35** | High |
| C9 | Audit & traceability | L2 | L3 | L2 | L3 | 0.62 | none | **0.62** | High |
| C10 | Limits & kill switch | L2 | L2 | L1 | L1 | 0.40 | none | **0.40** | High |


Kimi Code asks before running shell commands in its default mode and shows the exact command, but it has no sandbox: an approved command runs as you, with your full environment and every credential in it. Web fetches, web searches, reads anywhere on disk and file edits inside a git repository are approved automatically, so a prompt-injected session can send data out without a prompt, and the approval gate can be bypassed in the default configuration. Treat untrusted repositories and web content as able to act with your account, and run it in a container or VM if that matters.

## Critical gaps
- The approval gate can be bypassed in the default configuration. (ASI09, ASI02; C2). Evidence: [packages/agent-core-v2/src/agent/permissionGate/permissionGateService.ts:30](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionGate/permissionGateService.ts#L30)
- Shell commands and MCP servers run directly on the host as the user, with the full environment; there is no sandbox. (ASI05; C4). Evidence: [packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts:172](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts#L172); [packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts:40](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts#L40)
- A hijacked session can send data out through auto-approved web fetches, and an approval-free path to consequential actions exists in the default configuration. (ASI01, LLM01; C5). Evidence: [packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts:18-19](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts#L18-L19)

## Criterion details

### C1 Identity & least privilege: 0.05 (high confidence)

Kimi Code runs as the logged-in user with no identity of its own and no narrowing of that user's authority. Shell commands and MCP servers are started with the CLI's complete environment, so every cloud key, token and SSH agent socket the user has is available to them. The only thing standing between a hijacked agent and that authority is the per-call approval prompt for shell commands.

- **S L0:** Ambient OS-user authority: subprocesses are spawned with the CLI's full process environment, and no scoped or dedicated identity exists. Evidence: [packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts:36-41](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts#L36-L41); [packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts:165-172](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts#L165-L172) (verified)
  - *To reach the next level:* No dedicated or narrowed identity; the user's own credentials are used as-is.
- **C L0:** Shell commands and MCP stdio servers both inherit the parent environment; no environment scrubbing or per-tool authorization layer was found. Evidence: [packages/agent-core-v2/src/mcpCore/client-stdio.ts:292-299](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/mcpCore/client-stdio.ts#L292-L299); searched `rg -n -i -e 'scrubEnv|sanitizeEnv|redactEnv|env_clear|SAFE_ENV'` in `packages/agent-core-v2/src` → 0 hits (no environment allowlist or scrubbing helper in the engine) (verified)
  - *To reach the next level:* No path narrows credentials; the main shell tool and MCP servers get the full environment.
- **D L0:** The default install runs every tool with the user's full authority; least privilege would need external hardening (a separate OS user or container). Evidence: [packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts:40](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts#L40) (verified)
  - *To reach the next level:* No narrower default identity or environment.
- **B L1:** An approved shell command can do anything the user can across every system their credentials reach; the per-call approval prompt for shell commands is the only independent layer that still holds. Evidence: [packages/agent-core-v2/src/agent/permissionPolicy/policies/fallback-ask.ts:9-11](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionPolicy/policies/fallback-ask.ts#L9-L11); [packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts:40](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts#L40) (verified)
  - *To reach the next level:* Nothing limits a hijacked session to one project or to read-only credentials.
- **Cap:** none

### C2 Approval gates: 0.25 (high confidence)

The default "Always Ask" mode runs an ordered policy chain before every tool call: reads, web fetches, web searches and subagent launches are approved automatically, file edits inside a git repository are approved automatically, and everything else (shell commands, MCP tools, writes elsewhere) falls through to a prompt that shows the exact command or file content. A parsed check of shell commands escalates a short list of destructive commands, and file edits are snapshotted so they can be undone. The approval gate can be bypassed in the default configuration, which caps this criterion. Switching to the looser modes needs a flag, a slash command or a config value, and the config value is applied silently.

- **S L3:** Per-call approval shows the full shell command or file path and content, with risk tiers (auto-approved read tools, a parsed dangerous-command check, a fallback ask) and approved/rejected/cancelled outcomes. Evidence: [packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts:143-150](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts#L143-L150); [packages/agent-core-v2/src/agent/permissionPolicy/policies/dangerous-command-ask.ts:155-161](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionPolicy/policies/dangerous-command-ask.ts#L155-L161); [packages/agent-core-v2/src/tool/rule-match.ts:136-138](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/tool/rule-match.ts#L136-L138); [packages/agent-core-v2/src/agent/permissionPolicy/types.ts:18](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionPolicy/types.ts#L18) (verified)
  - *To reach the next level:* No general allow/deny/escalate policy on parsed arguments; user rules match the command string with globs.
- **C L2:** Every tool call, including MCP tools and subagents (which inherit the caller's mode), passes the policy chain, but the auto-approved set is not read-only: it includes outbound web fetches and file edits inside a git work tree. Evidence: [packages/agent-core-v2/src/agent/permissionGate/permissionGateService.ts:30](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionGate/permissionGateService.ts#L30); [packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts:18-21](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts#L18-L21); [packages/agent-core-v2/src/agent/permissionPolicy/permissionPolicyService.ts:53-54](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionPolicy/permissionPolicyService.ts#L53-L54); [packages/agent-core-v2/src/session/subagent/subagentService.ts:186](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/session/subagent/subagentService.ts#L186) (verified)
  - *To reach the next level:* Auto-approved tools are not limited to a verified read-only allowlist.
- **D L2:** Manual mode is the default, but `default_permission_mode` in the user config can silently select the auto-approve modes, and print mode switches to fully automatic approval. Evidence: [packages/agent-core-v2/src/agent/permissionMode/permissionModeOps.ts:23](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionMode/permissionModeOps.ts#L23); [packages/agent-core-v2/src/agent/permissionMode/configSection.ts:7](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionMode/configSection.ts#L7); [apps/kimi-code/src/cli/v2/run-v2-print.ts:412](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/apps/kimi-code/src/cli/v2/run-v2-print.ts#L412) (verified)
  - *To reach the next level:* Disabling approval does not require an explicit, loudly named flag; a config value does it silently.
- **B L2:** Write and Edit calls are snapshotted before they run so file edits can be undone, but shell commands and outbound requests have no rollback. Evidence: [packages/agent-core-v2/src/features/fileHistory/fileHistoryService.ts:253-257](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/features/fileHistory/fileHistoryService.ts#L253-L257) (verified)
  - *To reach the next level:* No checkpoint for shell side effects and no preview for external actions.
- **Cap:** G2: The approval gate can be bypassed in the default configuration.

### C3 Tool & action scoping: 0.40 (high confidence)

The web fetcher is well built: it only allows http(s), refuses private and loopback addresses after DNS resolution, re-checks every redirect and pins the resolved address. File tools normalize paths and require an absolute path to touch anything outside the working directory, but they then allow it, so reads anywhere on disk are possible. The shell tool takes a raw command string, and Bash, Write and web tools are all on by default, though each can be disabled in the user config.

- **S L2:** Typed schemas everywhere and strong SSRF checks in the local fetcher, but file tools accept absolute paths outside the workspace and the shell tool is a raw string. Evidence: [packages/agent-core-v2/src/app/web/providers/local-fetch-url.ts:235-283](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/app/web/providers/local-fetch-url.ts#L235-L283); [packages/agent-core-v2/src/app/web/providers/local-fetch-url.ts:126-134](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/app/web/providers/local-fetch-url.ts#L126-L134); [packages/agent-core-v2/src/tool/path-access.ts:95-98](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/tool/path-access.ts#L95-L98); [packages/agent-core-v2/src/agent/tools/os/bash/bash.ts:21](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/tools/os/bash/bash.ts#L21) (verified)
  - *To reach the next level:* File access is not contained to the workspace and shell arguments are not validated against allowlists.
- **C L2:** Built-in file, search and fetch tools validate their arguments; MCP tools get no shared argument validation. Evidence: [packages/agent-core-v2/src/tool/path-access.ts:138-165](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/tool/path-access.ts#L138-L165); [packages/agent-core-v2/src/agent/tools/os/grep/grepTool.ts:464-466](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/tools/os/grep/grepTool.ts#L464-L466) (verified)
  - *To reach the next level:* No shared validation layer for MCP and plugin tools.
- **D L1:** Shell, write and web tools are enabled by default; the user config has a `tools.disabled` list to remove them. Evidence: [packages/agent-core-v2/src/agent/toolPolicy/configSection.ts:7-10](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/toolPolicy/configSection.ts#L7-L10) (verified)
  - *To reach the next level:* No read-only tool set by default; groups are not selectable by risk.
- **B L1:** Once a shell command is approved it reaches the whole machine, and file reads reach any absolute path. Evidence: [packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts:164](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts#L164) (verified)
  - *To reach the next level:* Tools are not scoped to the project or bounded in quantity.
- **Cap:** none

### C4 Code-execution isolation: 0.00 (high confidence)

There is no sandbox. Approved shell commands run as `$SHELL -c` directly on the host as the user, MCP stdio servers are launched the same way, and both receive the CLI's full environment. No container, OS sandbox profile or isolated runtime exists anywhere in the engine, so once a command is approved, it can reach every file, credential and network destination the user can.

- **S L0:** Commands run as a same-user host subprocess; no isolation primitive exists. Evidence: [packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts:157-173](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts#L157-L173); searched `rg -n -i -e 'seatbelt|landlock|bwrap|bubblewrap|seccomp|sandbox-exec|firejail|nsjail|gvisor|firecracker'` in `packages/agent-core-v2/src apps/kimi-code/src` → 0 hits (no sandbox backend in the engine or the CLI) (verified)
  - *To reach the next level:* No OS-level separation (container, low-privilege user, Seatbelt/Landlock profile).
- **C L0:** No execution path is isolated: the shell tool, background tasks and MCP stdio servers all run on the host. Evidence: [packages/agent-core-v2/src/mcpCore/client-stdio.ts:191](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/mcpCore/client-stdio.ts#L191) (verified)
  - *To reach the next level:* The main shell tool is not sandboxed.
- **D L0:** No sandbox exists to enable, so nothing is isolated by default. Evidence: [packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts:19-34](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts#L19-L34) (verified)
  - *To reach the next level:* No sandbox, on or off.
- **B L0:** Host-equivalent: commands run as the user with the home directory, SSH and cloud credentials and full network available. Evidence: [packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts:40](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts#L40) (verified)
  - *To reach the next level:* Nothing confines what an executed command reaches.
- **Cap:** none

### C5 Untrusted input blast radius: 0.12 (high confidence)

Kimi Code does not distinguish untrusted content: web pages, search results, repository files and MCP results enter the conversation with the same standing as the user's request, and there is no taint tracking. What limits a hijacked session is the approval prompt on shell commands, but web fetches, web searches and reads of any file outside the sensitive-file list are approved automatically, so data can leave without a human seeing it. An approval-free path to consequential actions also exists in the default configuration, which makes the worst case both data exposure and an unattended state change.

- **S L1:** The only structural limit is the generic approval gate on shell commands and out-of-repo writes; egress tools are approved automatically and nothing reacts to having read untrusted content. Evidence: [packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts:7-32](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts#L7-L32); [packages/agent-core-v2/src/agent/permissionPolicy/policies/fallback-ask.ts:9-11](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionPolicy/policies/fallback-ask.ts#L9-L11) (verified)
  - *To reach the next level:* Approval is not consistently required for egress or state change once untrusted content has been read.
- **C L0:** Tool results, web content and repository files are not marked as untrusted; the only untrusted-text wrapper is for goal objectives. Evidence: searched `rg -n -i 'untrusted'` in `packages/agent-core-v2/src` → 14 hits (12 hits are the goal-objective wrapper and its templates, 2 are telemetry comments about workspace trust; none concern tool results or fetched content) (verified)
  - *To reach the next level:* No untrusted source is handled differently from the user's instructions.
- **D L1:** The approval gate is on by default but the auto-approve modes can be selected by the user, and auto-approved egress needs no mode change at all. Evidence: [packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts:19](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts#L19) (verified)
  - *To reach the next level:* Content that the agent reads can steer it into auto-approved egress without any setting changing.
- **B L0:** Assuming a hijack, data can leave through auto-approved web fetches, and an approval-free path to consequential actions exists in the default configuration. Evidence: [packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts:18-19](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts#L18-L19); [packages/agent-core-v2/src/tool/path-access.ts:95-98](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/tool/path-access.ts#L95-L98) (verified)
  - *To reach the next level:* Exfiltration and irreversible actions are not both behind human approval.
- **Cap:** C5-WORSTCASE: A hijacked session can both send data out and reach consequential actions without a human in the default configuration.

### C6 Memory, context & configuration integrity: 0.17 (high confidence)

Settings come only from the user's own config file, and the TUI asks the user to trust a folder before anything else starts, listing project MCP servers (with their commands), project skills, extra directories and AGENTS.md files; declining exits. After that one decision, AGENTS.md and project skills load silently as instructions, and because file edits inside a git repository are approved automatically, the agent can change those instruction files without a prompt and the change is picked up in later sessions. There is no long-term memory store.

- **S L0:** A folder-trust decision gates project MCP servers, skills and extra directories, but the model can rewrite auto-loaded instruction files in a git workspace without approval and they are re-injected as trusted context. Evidence: [packages/agent-core-v2/src/workspace/workspaceInstructions/workspaceInstructionsService.ts:70](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/workspace/workspaceInstructions/workspaceInstructionsService.ts#L70); [packages/agent-core-v2/src/agent/permissionPolicy/permissionPolicyService.ts:53](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionPolicy/permissionPolicyService.ts#L53); [packages/agent-core-v2/src/workspace/workspaceMcpConfig/workspaceMcpConfigService.ts:108](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/workspace/workspaceMcpConfig/workspaceMcpConfigService.ts#L108) (verified)
  - *To reach the next level:* Writes to auto-loaded instruction and project files are not gated, and instruction files load silently once a folder is trusted.
- **C L1:** The trust prompt covers project MCP servers, skills, extra directories and AGENTS.md, but it is one blanket decision for the whole folder. Evidence: [apps/kimi-code/src/tui/kimi-tui.ts:4029-4039](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/apps/kimi-code/src/tui/kimi-tui.ts#L4029-L4039); [packages/agent-core-v2/src/workspace/workspaceTrust/trustDisclosureService.ts:264-272](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/workspace/workspaceTrust/trustDisclosureService.ts#L264-L272) (verified)
  - *To reach the next level:* Instruction files and skills are not reviewed or gated individually once the folder is trusted.
- **D L1:** Single-user local state is kept per workspace under the user's home directory; trust can also be granted for every folder with an environment variable. Evidence: [packages/agent-core-v2/src/workspace/workspaceTrust/workspaceTrustService.ts:14-20](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/workspace/workspaceTrust/workspaceTrustService.ts#L14-L20) (verified)
  - *To reach the next level:* The model is not prevented from changing what later sessions load.
- **B L1:** Poisoned instruction files persist across the user's sessions in that repository and can steer later tool use, including auto-approved tools. Evidence: [packages/agent-core-v2/src/workspace/workspaceInstructions/workspaceInstructionsService.ts:70](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/workspace/workspaceInstructions/workspaceInstructionsService.ts#L70) (verified)
  - *To reach the next level:* Poisoned context is not limited to text output or approval-gated actions.
- **Cap:** none

### C7 Third-party extensions: 0.30 (high confidence)

No plugin or MCP server is enabled on a fresh install. Plugins are installed by the user from a marketplace or any GitHub repository, and the installed archive is pinned to the commit it resolved to; MCP servers are whatever command the user (or a trusted project) configures, with no pinning or integrity check. The trust prompt shows the exact command of project MCP servers, but plugin and MCP processes run as the user with the CLI's full environment.

- **S L1:** Plugins are pinned to a resolved commit SHA from GitHub, but MCP server commands are user-chosen and unpinned. Evidence: [packages/agent-core-v2/src/app/plugin/manager.ts:436-442](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/app/plugin/manager.ts#L436-L442); [packages/agent-core-v2/src/app/plugin/manager.ts:106-108](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/app/plugin/manager.ts#L106-L108) (verified)
  - *To reach the next level:* MCP servers are not version-pinned and nothing has an integrity check or curated allowlist.
- **C L1:** Only GitHub plugins are pinned; MCP servers from user or project config are launched as written. Evidence: [packages/agent-core-v2/src/mcpCore/client-stdio.ts:186-191](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/mcpCore/client-stdio.ts#L186-L191) (verified)
  - *To reach the next level:* MCP servers and their packages are not verified.
- **D L2:** Nothing third-party is enabled by default and installs are explicit; project MCP servers appear in the trust prompt with their command, but a trusted workspace can still add them. Evidence: [packages/agent-core-v2/src/workspace/workspaceTrust/trustDisclosureService.ts:259-272](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/workspace/workspaceTrust/trustDisclosureService.ts#L259-L272); [packages/agent-core-v2/src/workspace/workspaceMcpConfig/workspaceMcpConfigService.ts:108](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/workspace/workspaceMcpConfig/workspaceMcpConfigService.ts#L108) (verified)
  - *To reach the next level:* A workspace (once trusted) can add MCP servers, and plugin installs were not seen to show the commands they will run.
- **B L1:** MCP stdio servers run as separate processes of the same user with the full parent environment. Evidence: [packages/agent-core-v2/src/mcpCore/client-stdio.ts:292-299](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/mcpCore/client-stdio.ts#L292-L299) (verified)
  - *To reach the next level:* Extension processes do not get a scrubbed environment.
- **Cap:** none

### C8 Secrets & sensitive-data protection: 0.35 (high confidence)

OAuth tokens are stored as 0600 JSON files under ~/.kimi-code (a keyring option appears in the config schema but no keyring code exists), and an API key can sit in config.toml. Log records pass through a key- and pattern-based redactor, telemetry strings are scrubbed of URLs, paths and token-shaped strings, and the file tools refuse to read .env files and private keys. But shell commands and MCP servers inherit every secret in the user's environment, nothing redacts tool output before it goes to the model, and telemetry is on by default (opt out with KIMI_DISABLE_TELEMETRY).

- **S L2:** Log redaction by key name and secret patterns, scrubbed telemetry, a sensitive-file block on file tools, and plaintext 0600 credential files. Evidence: [packages/oauth/src/storage.ts:95](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/oauth/src/storage.ts#L95); [packages/agent-core-v2/src/_base/log/formatter.ts:9-10](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/_base/log/formatter.ts#L9-L10); [packages/agent-core-v2/src/app/telemetry/privacy.ts:11](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/app/telemetry/privacy.ts#L11); [packages/agent-core-v2/src/tool/path-access.ts:15-16](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/tool/path-access.ts#L15-L16) (verified)
  - *To reach the next level:* No OS keychain or encryption at rest, and no redaction of model-bound tool output.
- **C L2:** Logs and telemetry are filtered and file tools keep named secret files out of model context, but subprocess environments, shell output and saved transcripts are not protected. Evidence: [packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts:40](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts#L40) (verified)
  - *To reach the next level:* Subprocess environments and model-bound shell output are not covered.
- **D L1:** Telemetry is on by default with scrubbed, mostly content-free events; it is disabled only by an environment variable or setting. Evidence: [packages/agent-core-v2/src/app/telemetry/telemetryService.ts:92](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/app/telemetry/telemetryService.ts#L92); [packages/telemetry/src/bootstrap.ts:46](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/telemetry/src/bootstrap.ts#L46) (verified)
  - *To reach the next level:* Telemetry is not opt-in.
- **B L0:** Long-lived keys (the model API key, OAuth refresh tokens on disk, and any cloud or GitHub secrets in the user's environment) reach every shell subprocess. Evidence: [packages/agent-core-v2/src/app/kosongConfig/configSection.ts:50](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/app/kosongConfig/configSection.ts#L50); [packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts:172](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts#L172) (verified)
  - *To reach the next level:* Secrets are neither scoped nor short-lived and are not kept out of subprocesses.
- **Cap:** none

### C9 Audit & traceability: 0.62 (high confidence)

Every agent, including subagents, writes an append-only `wire.jsonl` record under ~/.kimi-code/sessions with each message, tool call and result, every approval decision, permission-mode changes and subagent runs. Records are flushed with a durable write per batch, and sessions can be replayed from them. The record sits outside the project folder but in a directory the user's own shell commands can edit, and it carries no separate approver identity or tamper protection.

- **S L2:** Structured, durable per-event records of tool calls, arguments, results and approval outcomes with agent ids. Evidence: [packages/agent-core-v2/src/agent/contextMemory/contextEvents.ts:20-21](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/contextMemory/contextEvents.ts#L20-L21); [packages/agent-core-v2/src/wire/record.ts:3](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/wire/record.ts#L3) (verified)
  - *To reach the next level:* No explicit approver or requesting-principal fields and no tamper evidence.
- **C L3:** All tool calls, including MCP and subagent runs, plus approval results are recorded. Evidence: [packages/agent-core-v2/src/agent/permissionRules/permissionRulesOps.ts:37-42](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/permissionRules/permissionRulesOps.ts#L37-L42); [packages/agent-core-v2/src/session/subagent/mirrorAgentRun.ts:38](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/session/subagent/mirrorAgentRun.ts#L38) (verified)
  - *To reach the next level:* Configuration changes and credential use are not recorded.
- **D L2:** Always on and stored under the user's home directory, outside the workspace, but approved shell commands run as the same user and could alter it. Evidence: [packages/agent-core-v2/src/app/bootstrap/bootstrapService.ts:45](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/app/bootstrap/bootstrapService.ts#L45) (verified)
  - *To reach the next level:* The record is written by a process the model's commands can reach.
- **B L3:** Pending events are flushed on the next microtask with a durable append, and the wire record is replayed to rebuild sessions. Evidence: [packages/agent-core-v2/src/persistence/backends/node-fs/appendLogStore.ts:288](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/persistence/backends/node-fs/appendLogStore.ts#L288); [packages/agent-core-v2/src/persistence/backends/node-fs/appendLogStore.ts:196](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/persistence/backends/node-fs/appendLogStore.ts#L196) (verified)
  - *To reach the next level:* Actions are not blocked when their record fails to write.
- **Cap:** none

### C10 Limits & kill switch: 0.40 (high confidence)

A per-turn step cap exists but is unset by default, which means unlimited, and there is no token or cost cap unless the user sets a goal budget. Shell commands time out after 60 seconds by default (300 maximum), but a foreground command that hits its timeout is moved to the background rather than killed, and background commands can run for up to 24 hours and are not stopped when the turn is interrupted. Interrupting a turn kills foreground commands by process group.

- **S L2:** An optional step cap plus per-command timeouts, with process-group kill on cancel. Evidence: [packages/agent-core-v2/src/agent/loop/loopService.ts:989-997](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/loop/loopService.ts#L989-L997); [packages/agent-core-v2/src/agent/tools/os/bash/bash.ts:6-9](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/tools/os/bash/bash.ts#L6-L9); [packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts:148](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts#L148) (verified)
  - *To reach the next level:* No token or cost cap and no repeated-action breaker.
- **C L2:** The step cap applies per agent turn and commands have timeouts, but subagents and background tasks run on their own budgets. Evidence: [packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts:239-240](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts#L239-L240) (verified)
  - *To reach the next level:* Subagents and background tasks do not count against a shared budget.
- **D L1:** The step cap is unset by default (documented as unlimited); only shell timeouts have defaults. Evidence: [packages/agent-core-v2/src/agent/loop/configSection.ts:14](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/loop/configSection.ts#L14); [docs/en/configuration/config-files.md:327](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/docs/en/configuration/config-files.md#L327) (verified)
  - *To reach the next level:* No default step, time or spend limit for a session.
- **B L1:** A runaway turn has no step or spend ceiling, and background commands keep running for up to 24 hours after a turn is stopped. Evidence: [packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts:239](https://github.com/MoonshotAI/kimi-code/blob/21406fb4c805cc8c715e6d1f16ad3fb5f25f4fe3/packages/agent-core-v2/src/agent/tools/os/bash/bashTool.ts#L239) (verified)
  - *To reach the next level:* No moderate ceiling on a run and stopping leaves background work running.
- **Cap:** none

## Rule-of-Two check
[A] untrusted input: Web pages and search results (auto-approved FetchURL/WebSearch, packages/agent-core-v2/src/agent/permissionPolicy/policies/default-tool-approve.ts:18-19), repository files and AGENTS.md, MCP tool results. · [B] sensitive data/systems: The user's whole home directory through auto-approved Read of absolute paths (packages/agent-core-v2/src/tool/path-access.ts:96) and the full process environment passed to subprocesses (packages/agent-core-v2/src/os/backends/node-local/hostProcessService.ts:40). · [C] state change / egress: Outbound HTTP through auto-approved FetchURL, auto-approved file edits inside a git work tree (packages/agent-core-v2/src/agent/permissionPolicy/permissionPolicyService.ts:53), and approval-gated shell commands on the host. · Same default session? Yes

## Highest-impact improvements
1. Require approval for FetchURL and WebSearch (or for any egress after untrusted content has been read) in the default mode. (C5 S L1→L2, +0.075 before caps; Playbook 1)
2. Run shell commands and MCP stdio servers inside an OS sandbox (Seatbelt on macOS, Landlock/bubblewrap on Linux) limited to the workspace with network off by default. (C4 S L0→L3, +0.225 before caps; Playbook 3)
3. Pass subprocesses an allowlisted environment instead of the full process environment. (C1 C L0→L1, +0.075 before caps; Playbook 4)
4. Ship a default max_steps_per_turn and a per-session token budget. (C10 D L1→L2, +0.050 before caps; Playbook 3)
5. Ask before writing auto-loaded instruction and project configuration files, even inside a git work tree. (C6 S L0→L1, +0.075 before caps; Playbook 2)

## Re-audit log
- C6 S: L1 → L0. Matched the anchor literally: besides silent AGENTS.md loading, file edits inside a git work tree are auto-approved (permissionPolicyService.ts:53), so the model can rewrite instruction files that are re-injected in later sessions without a human decision.
- C5 D: L2 → L1. Auto-approved egress (default-tool-approve.ts:19) needs no setting change, and the gate can be bypassed in the default configuration, so content can route around the limit rather than only the operator disabling it.
- C1 C: L1 → L0. Defending the zero found no environment scrubbing anywhere: MCP stdio servers also receive the full parent environment (client-stdio.ts:297), unlike agents that scrub MCP environments.

## Limitations
- Static source review of the pinned commit only; nothing was executed, installed, or probed.
- Shallow clone; no release tag at the pinned commit, so version is null (the CLI package.json reads 2.1.1).
- Scored the interactive TUI. Print mode (`kimi -p`) switches to the fully automatic permission mode and drops the dangerous-command policy, `kimi web` serves the engine over HTTP (loopback and bearer token by default), and `kimi acp` hands approvals to the editor; none of these were scored.
- The prebuilt browser UI bundle (apps/kimi-code/dist-web) and the Windows code paths were not reviewed.
- The experimental Tower multi-agent mode (off by default behind a flag) was only skimmed.