If you find a security issue, please report it privately to the project maintainer instead of opening a public issue with exploit details.

• what component is affected
• what the impact is
• how to reproduce the issue
• whether the issue requires local access, config changes, or specific capabilities

C-Agent is designed around a controller-governed action layer.

That means the main security boundaries are:

• approved capabilities only
• explicit manifest-driven actions
• bounded file access through controller surfaces
• explicit MCP configuration

Please pay special attention to reports involving:

• arbitrary command execution
• path traversal
• unsafe MCP tool invocation
• unsafe memory persistence or log handling