Privacy, permissions & boundaries

IFox9 connects clients to the browser using authenticated local transport. The AI client or its model provider may still receive page text, screenshots, prompts, and tool results. Review that client’s data policy and model settings. Avoid using sensitive sessions until you understand that path.

Profile isolation separates browsing state; it does not hide a selected profile’s content from the AI client you allow to control it.

Begin with a dedicated test profile and a read-only request. Tools can interact with authenticated pages, cookies, storage, files, and in-page JavaScript. Explicitly identify the target, permitted actions, and output location. Never paste API tokens or credentials into public reports or issue trackers.

The bundled Skill asks the assistant to obtain approval before separate purchases, money transfers, publishing, deletion, or security changes unless already explicitly authorized. This is a behavioral instruction, not an enforced approval dialog for every tool call. Review consequential actions yourself.

CAPTCHA, passkeys, device approval, and other human verification must be completed by the user in visible mode. Browser automation does not control unrelated desktop apps or native operating-system dialogs.

Uploads are limited to Desktop, Documents, Downloads, and the operating-system temporary directory. Downloads and screenshot copies go under Downloads/IFox9 MCP. Check output before sharing; screenshots and cookies may contain secrets.

This browser-control path does not require macOS Accessibility or Screen Recording permission, or Windows UI Automation. Ordinary file access and endpoint-security policies can still affect operation.

MCP uses a per-app-launch token and local broker transport. The optional HTTP API requires a bearer token and binds only to loopback. Token storage uses Electron safeStorage encryption when the host provides it; it is not guaranteed on every host. Do not forward either interface to the public internet.