English security path

Security model

Read this before exposing the server beyond your machine. This project is a remotely reachable code-execution channel into your local shell—not multi-tenant SaaS, not Anthropic’s official mobile app.

Source of truth: README.en.md · Security Model · Chinese handbook: 安全模型 ·

Danger Anyone who passes authentication has the same power you have at a terminal on that host. Do not run a shared instance for multiple people. Do not expose it to the public internet without token, device trust, CLI allow-list review, and (recommended) Cloudflare Access.

Is it safe on the public internet?

Only if you deliberately open it. This is a code-execution channel into your shell. Default is locked to loopback without AUTH_TOKEN. Before any public URL: set a strong token, review CLI allow-lists, use device trust (and prefer Cloudflare Access for production). Details below.

Four iron rules

1. Single-user per instance

One operator, one instance. There is no multi-user account system. Anyone who passes auth has the same power as you at that host’s terminal. Do not treat Claude Chat Mobile as multi-tenant SaaS or share one instance across people.

2. No token, no leaving the host

Empty AUTH_TOKEN ⇒ bind 127.0.0.1 only. There is no “empty = open to the world” path. Phones on LAN and tunnels cannot connect until you set a token and restart. Reaching the public internet requires a non-empty token.

3. CLI permissions are inherited

No second “Web super-allowlist.” Auto-approve is the merged permissions.allow from your existing Claude config (global ~/.claude/settings.json, project, and local settings)—the same sources as the terminal. Matches run; everything else is suspended and pushed to the phone with full command + working directory.

Before public exposure Audit your global allow-list. Old broad Bash(...) / Write rules will auto-approve here too, without a phone prompt.

Web runtime modes (dontAsk / auto / bypassPermissions) and approval TTL are not “UI equals interactive terminal step for step”—shared is the settings source, not every interaction.

4. Device trust (TOFU)

A valid token alone is not enough for the first non-local client. Approve the device once on the host:

node scripts/device.js list
node scripts/device.js approve <ID>
# revoke: node scripts/device.js deny <ID>

Loopback and Cloudflare Access JWT clients can skip TOFU. Temporary random cloudflared tunnels have no Access—you still need device.js approve.

Quotable facts

Checklist before public exposure

  1. Set a strong non-empty AUTH_TOKEN.
  2. Prefer fixed domain + Cloudflare Access 2FA for production (see repo docs/deployment.md / Chinese 生产部署).
  3. Review global and project CLI allow-lists for overly broad Bash / write rules.
  4. Approve only devices you control (device.js).
  5. Keep the instance single-user—never share credentials across people.

Next