Security
Tandem assumes an agent should be able to do real work in a session but should never be able to give itself more access than you gave it.
Local only
Tandem’s service listens on 127.0.0.1 and nowhere else. Every request needs a token, and requests with an unexpected Host header are refused, which stops websites you visit from reaching it through DNS rebinding.
There’s no account and no cloud service in between. Sessions, recordings and settings stay on your PC.
Two tokens
| Token | Who has it | What it opens |
|---|---|---|
Agent token, in %LOCALAPPDATA%\SharedSSH\token |
your MCP client settings | the MCP server only |
| Viewer token | the Tandem app and viewer | the viewer’s controls and recordings |
Agents are never given the viewer token and nothing hands it out. So an agent can’t use its own token, or any request it makes, to:
- make a private session visible
- change guardrail modes or approve its own requests
- open the password vault
- accept a changed host key
- read recordings
Kept for you
- Password and 2FA prompts only appear in the viewer and aren’t recorded. See Passwords and host keys.
- Private sessions don’t exist as far as agents can tell. See Guardrails.
- On guarded hosts, risky actions need your approval and are denied after two minutes without an answer.
Record of what happened
Everything in a session is recorded with who did it, so you can go back and see what an agent ran and what it saw. See Recordings.