ARCANATrust & Security
Arcana is a terminal-native tool that runs on your machine. Understanding what it can read, write, remember, and expose is critical for using it safely — especially in enterprise environments.
Core Principle: BYOK, Local-First
Arcana follows a bring your own key (BYOK) model. Your API keys, sessions, memory, and code never leave your machine unless you explicitly enable cloud sync or the proxy API.
What Arcana May Read
| Data | When | Where it goes |
|---|---|---|
| Files in your project | When you ask it to analyze code | Sent to your configured LLM provider |
| Shell output | When tools execute commands | Stays local (sent to LLM only if agent reads it) |
| Git history | When reviewing commits/PRs | Sent to LLM provider |
| Environment variables | At startup for provider detection | API keys sent to respective providers |
| Skill files (SKILL.md) | When skills are loaded | Included in system prompt to LLM |
| Memory database | At session start for context | Relevant facts included in prompt |
What Arcana May Write
| Data | Location | Can be disabled? |
|---|---|---|
| Session transcripts | ~/.arcana/data/sessions/ | No (required for history) |
| Memory facts | ~/.arcana/data/memory.db | Yes (memory.enabled: false) |
| Cron job definitions | ~/.arcana/data/cron-jobs.json | Yes (don't create jobs) |
| Workspace trust fingerprints | ~/.arcana/data/workspace-trust.json | No (security requirement) |
| Skill cache | ~/.cache/arcana/skills-cache.json | No (auto-rebuilt) |
| Project files | Your working directory | Only when you approve tool calls |
What Arcana Remembers
Memory persists across sessions and includes:
- Extracted facts — key decisions, architecture notes, conventions
- Skill usage stats — which skills you use most often
- Session metadata — timestamps, token usage, model used
Memory is stored locally in SQLite. It never leaves your machine unless you enable cloud sync.
What Arcana May Expose
| Data | When | Mitigation |
|---|---|---|
| API keys | Sent to LLM providers for inference | Use env vars, never commit to git |
| Code snippets | Sent to LLM provider when analyzing | Choose providers with strong data policies |
| Memory facts | If cloud sync is enabled | Disable cloud sync if sensitive |
| Gateway messages | Chat platforms (Telegram, Discord, etc.) | Use allowlists to restrict access |
Tool Permissions
Arcana's tools (shell, filesystem, git, MCP) require explicit permission. You control access through:
- Interactive approval — default mode, asks before each tool call
- Workspace trust —
arcana trustallows project-level extensions - Autonomy modes — from read-only to full execution
- Gateway allowlists — restrict who can interact with your agent
Data Residency
- Local by default — all data stays on your machine
- Provider egress — prompts are sent to your chosen LLM provider
- AWS Bedrock — data stays within AWS (no external egress)
- Ollama — fully local, no data leaves your machine at all
Enterprise Considerations
- Use
ARCANA_DISABLE_WORKSPACE_TRUST=1to skip trust checks in CI - Use
ARCANA_TRUST_WORKSPACE=1for automated environments - AWS Bedrock + IAM provides the strongest data residency guarantees
- Disable cloud sync and gateway for air-gapped environments