Skip to main content
  • Connections on loopback or stdio — the common deployment — MAY be plaintext; any connection that leaves the machine MUST use TLS (wss://, gRPC over TLS). [AWP-SEC-001]
  • Worlds MUST authenticate agents before initialize completes on any non-loopback connection; defined schemes: bearer token (Authorization: Bearer), mutual TLS. On stdio, process ownership stands in for authentication. On loopback, worlds SHOULD still require a bearer token — a local WebSocket port is reachable by every page in every browser on the machine, not just the intended agent tab. [AWP-SEC-002]
  • session.ready returns an unguessable session token used for session.resume and for binding stream connections to the session. Tokens MUST be scoped to one session. [AWP-SEC-003]
  • Stream endpoints MUST reject connections that do not present a valid session token. [AWP-SEC-004]
Threat model (informative). AWP assumes a potentially adversarial agent and a trusted world: all safety enforcement is world-side. A compromised world can feed false observations; agents operating in high-stakes settings SHOULD verify world identity (TLS pinning) and MAY cross-check observations against independent sensors.