Security & license

An agent workforce is only trustworthy if you can see where the data lives, who can sign in, and who says yes. This page is the plain-language version of Muster's security model, how to report a problem, and what the license lets you do.

Local-first Self-hostable Signed receipts BSL 1.1

The security model

Four layers, each independently checkable:

Local-first data. Transcripts, keys, and events live in ~/.muster on the machine running the server — not in a cloud. The mobile companions own nothing; your computer stays the source of truth.
Keys on your server. Provider API keys are stored write-only and never echoed by the API. The Privacy Shield masks emails, phones, and secrets before a prompt reaches a cloud model, leaving a counts-only receipt.
Claim-gated workspaces. muster up pairs your phone with a claim code: single-use, five-minute TTL, an unambiguous 8-character alphabet, and a per-IP lockout after five failed redemptions. The default server binds loopback-only, rejecting non-loopback hosts and origins (DNS-rebinding and CSRF protection); on desktop installs, state-changing requests must be same-origin with the Host header.
Approval gating. Shell commands and file edits surface as approval cards you Allow or Deny; standing "always allow" grants are scoped per capability, and anything destructive stops and asks a human anyway. Per-agent token budgets and daily USD caps bound the blast radius of a runaway loop.

Expose a self-hosted server and it hardens: every /api/* route requires a valid session — only sign-in (rate-limited to five attempts per minute per IP, twelve-character minimum passwords) and health checks are excepted. Cross-origin clients must be allow-listed via OMB_ALLOWED_ORIGINS, and peer-agent comms on /api/internal/* never leave loopback, even on an exposed deployment.

Work, too, is verifiable: every settled task ends in a job receipt (bot, duration, tokens, cost, final word), and shared receipts carry a detached HMAC signature anyone can verify at /api/receipts/verify — proof-of-work you can paste anywhere.

Full details: The controls above are covered in depth on Approvals & privacy, and the deployment side — TLS, reverse proxy, environment variables — in Self-hosting.

Reporting a security issue

Found something? Please report it privately — don't open a public issue with exploit details. Contact the team privately through the site at orazen.online and we'll take it from there. We'd rather hear about it from you than from someone else.

The license: Business Source License 1.1

You can	You can't
Copy, modify, create derivative works, redistribute, and sublicense the work.	Offer Muster (or a substantially similar product) as a managed service to third parties on infrastructure you control — the SaaS carve-out.
Use it free for personal, internal business, development, testing, and non-commercial purposes. Commercial use is permitted as long as you don't turn it into a competing managed service.	Remove, alter, or obscure proprietary notices, licenses, or disclaimers.
Self-host forever, free — this grant has no expiry.	Use Muster's name, trademarks, or logos to endorse or promote derived products without prior written permission.

Content under a /proprietary directory, if present, is licensed separately under LICENSE_PROPRIETARY.md; everything else is BSL 1.1.

Change date: On 2030-08-19, Muster converts to the Apache License, Version 2.0 — a fully permissive, OSI-approved open-source license. Everything published before that date falls under the same conversion. Self-hosting stays free the entire time.

Why BSL instead of MIT or Apache today? It keeps the source open for inspection while drawing one bright line — no reselling Muster itself as a service — until the change date arrives. After 2030-08-19 that line dissolves on its own.

What Muster does not do

No cryptocurrency. Muster has no token. Any coin using the Muster name is not created, endorsed, or affiliated with this project, Orazen, or its maintainers — no tokens, payment, or allocation have ever been received from anyone.
Your data doesn't become ours. Transcripts and keys live on your machine by default; a self-hosted server keeps them on your hardware. Thin mobile clients store nothing.
Untrusted input isn't instruction. Inbound agent mail, room messages, routine webhooks, and team-library packs are treated as data, not commands — a bot only acts on a channel its human approved, for that peer.

Where to go next

For the human-side controls: Approvals & privacy. For running Muster on hardware you own: Self-hosting. For the machine-readable security surface: For agents.