> For the complete documentation index, see [llms.txt](https://docs.gotempest.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gotempest.app/ai-and-automation/tempest-ai-security-model.md).

# Storm AI Security Model

How Tempest keeps its AI assistant on a leash — what Storm AI is and isn't allowed to do on its own, and how that changes when you bring your own agent through the CLI.

Tempest's AI features can type into your terminal, read what's on screen, and act on your servers for you. That's powerful, and it's also exactly the kind of thing you don't want to hand over with no guardrails. Here's what actually keeps that in check, in plain terms.

## The built-in Storm AI workflow works inside a fence

Storm AI is always on and needs no setup to enable. It's built for convenience, which means it's designed to be safe by default even when the model behind it makes a mistake. Concretely:

* It can only act inside the terminal session you're already looking at. It can't quietly open a new connection to another server or go looking through your saved hosts on its own.
* It never handles your actual login credentials — those stay in Tempest's encrypted vault and are never shown to the model.

## Every risky command gets checked before it runs

Whatever Storm AI wants to do passes through a safety check first, with three possible outcomes:

* **Just runs** — everyday, harmless commands like checking status or listing files
* **Asks you first** — anything broad or expensive but not dangerous, like scanning your whole filesystem — you get a quick approve/deny prompt before it happens
* **Always blocked** — genuinely destructive patterns, like wiping a disk or a runaway resource-consuming command, are refused outright, no matter what. This can't be talked around or auto-approved away.

If Storm AI ever tries something in that last category, it doesn't just block the one command — the whole session drops into a "look but don't touch" mode until you explicitly give it permission to act again. One bad suggestion can't snowball into a series of worse ones.

Worth knowing honestly: this protection happens before a command runs, not by isolating what the command can do once it's allowed to run. If you approve something on a real server, it happens for real — there's no sandbox catching mistakes after the fact. Treat Storm AI's suggestions the way you'd treat a capable but junior teammate's: helpful, but worth a second look before approving anything you can't undo.

## Bringing your own agent (CLI) is a different deal

If you'd rather drive Tempest with your own AI agent — Claude Code, Codex CLI, Gemini CLI, OpenCode, or anything else — you can connect it directly and it gets the full range of what Tempest can do: connecting to servers, managing sessions, moving files, all of it. See [Use Tempest in AI Agents (Desktop or CLI)](/ai-and-automation/install-tempest-mcp-server-in-ai-clients.md) to set that up.

The reasoning is simple: at that point you've chosen your own model and your own agent's approval flow, so Tempest trusts that setup rather than adding a second layer of restrictions on top. The built-in assistant's fence exists specifically because it's the option that needs to be safe with zero configuration.

## What the assistant can — and can't — see

* It only sees your conversation with it, the terminal output it reads back to you, and any files you hand it directly. It doesn't have standing access to your full server list or terminal history beyond that.
* Your SSH credentials are decrypted locally from your vault only at connection time, and never pass through the model.
* If you bring your own API key for a model provider (Anthropic, OpenAI, Google, or a self-hosted endpoint), your requests go straight from your device to that provider — Tempest isn't in the middle. See [How Tempest Protects Your Privacy](/accounts-vaults-and-privacy/how-tempest-protect-your-privacy.md) for the full picture.

## See also

* [Storm AI](/ai-and-automation/tempest-ai-assistant.md) — the chat panel this protects
* [Use AI Agents in Tempest](/ai-and-automation/using-ai-agents-to-manage-servers.md) — work with an agent inside the app
* [Use Tempest in AI Agents (Desktop or CLI)](/ai-and-automation/install-tempest-mcp-server-in-ai-clients.md) — how to connect an external agent
* [How Tempest Protects Your Privacy](/accounts-vaults-and-privacy/how-tempest-protect-your-privacy.md)
* [AI terminal](https://gotempest.app/ai-terminal) — the product page for this feature