Kandle runs in your browser and keeps layouts, scripts and API keys in that browser's storage. Keys are sent only to the provider they belong to.

The MCP server listens on 127.0.0.1 only, accepts the app only after you turn on the agent bridge, and needs a pairing code. See "Use it with your AI agent" in the README for the details.

To report a vulnerability, please use GitHub's private vulnerability reporting on this repository (Security tab, "Report a vulnerability") instead of a public issue.