> For the complete documentation index, see [llms.txt](https://docs.gotempest.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gotempest.app/productivity/tempest-ai-security-model.md).

# Tempest AI Security Model

How Tempest keeps its AI assistant on a leash — what Copilot is and isn't allowed to do on its own, and how that changes when you bring your own agent through the CLI.

Tempest's AI features can type into your terminal, read what's on screen, and act on your servers for you. That's powerful, and it's also exactly the kind of thing you don't want to hand over with no guardrails. Here's what actually keeps that in check, in plain terms.

## The built-in assistant (Copilot) works inside a fence

The in-app AI assistant — Copilot — is always on and needs no setup to enable. It's built for convenience, which means it's designed to be safe by default even when the model behind it makes a mistake. Concretely:

* It can only act inside the terminal session you're already looking at. It can't quietly open a new connection to another server or go looking through your saved hosts on its own.
* It never handles your actual login credentials — those stay in Tempest's encrypted vault and are never shown to the model.

## Every risky command gets checked before it runs

Whatever Copilot wants to do passes through a safety check first, with three possible outcomes:

* **Just runs** — everyday, harmless commands like checking status or listing files
* **Asks you first** — anything broad or expensive but not dangerous, like scanning your whole filesystem — you get a quick approve/deny prompt before it happens
* **Always blocked** — genuinely destructive patterns, like wiping a disk or a runaway resource-consuming command, are refused outright, no matter what. This can't be talked around or auto-approved away.

If Copilot ever tries something in that last category, it doesn't just block the one command — the whole session drops into a "look but don't touch" mode until you explicitly give it permission to act again. One bad suggestion can't snowball into a series of worse ones.

Worth knowing honestly: this protection happens before a command runs, not by isolating what the command can do once it's allowed to run. If you approve something on a real server, it happens for real — there's no sandbox catching mistakes after the fact. Treat Copilot's suggestions the way you'd treat a capable but junior teammate's: helpful, but worth a second look before approving anything you can't undo.

## Bringing your own agent (CLI) is a different deal

If you'd rather drive Tempest with your own AI agent — Claude Code, Codex CLI, Gemini CLI, OpenCode, or anything else — you can connect it directly and it gets the full range of what Tempest can do: connecting to servers, managing sessions, moving files, all of it. See [Install Tempest MCP Server in Claude Code, Codex, Cursor & More](/productivity/install-tempest-mcp-server-in-ai-clients.md) to set that up.

The reasoning is simple: at that point you've chosen your own model and your own agent's approval flow, so Tempest trusts that setup rather than adding a second layer of restrictions on top. The built-in assistant's fence exists specifically because it's the option that needs to be safe with zero configuration.

## What the assistant can — and can't — see

* It only sees your conversation with it, the terminal output it reads back to you, and any files you hand it directly. It doesn't have standing access to your full server list or terminal history beyond that.
* Your SSH credentials are decrypted locally from your vault only at connection time, and never pass through the model.
* If you bring your own API key for a model provider (Anthropic, OpenAI, Google, or a self-hosted endpoint), your requests go straight from your device to that provider — Tempest isn't in the middle. See [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy.md) for the full picture.

## See also

* [Tempest AI Assistant](/productivity/tempest-ai-assistant.md) — the chat panel this protects
* [AI Agents for Server Automation](/productivity/using-ai-agents-to-manage-servers.md) — using your own agent through the CLI
* [Install Tempest MCP Server in AI Clients](/productivity/install-tempest-mcp-server-in-ai-clients.md) — how to connect an external agent
* [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy.md)