Safety

gum is designed for agents that can make mistakes. The safety model is built around local credentials, a small initial MCP surface, risk-specific invocation, and explicit confirmation for destructive operations.

Local credentials

OAuth refresh tokens, API keys, service-account config, and plugin credentials are resolved on the host running gum. They are not copied into the MCP prompt.

Use stdin for OAuth client secrets:

bash

printf '%s' "$GOOGLE_OAUTH_CLIENT_SECRET" \
  | gum auth use-oauth-client --client-id "$GOOGLE_OAUTH_CLIENT_ID" --secret-stdin

Risk classes

Class	CLI path	MCP path	Extra gate
Read	`gum read`	`gum.read`	Credential and scope checks
Write	`gum write --allow-write`	`gum.write`	Explicit write authorization
Destructive	`gum destructive --token ... --confirmed`	`gum.destructive`	Confirmation token

gum call is available for direct dispatch and requires --risk=read|write|destructive.

Sandboxed code

gum code runs Risor scripts with a small host API. The sandbox has no filesystem, no os/exec, and no raw network access. Catalog calls still go through dispatch.

bash

gum code 'gum_print(gum_search("gmail labels"))'
gum code --allow-write @./script.risor

Use --allow-write or --allow-destructive only for scripts you have reviewed.

Both flags need your confirmation before the sandbox runs. On a terminal gum prints the script's capability on stderr and waits for y. Any other answer exits REQUIRES_CONFIRMATION and nothing runs. When stdin is not a terminal, such as in a script or a CI job, pass --yes instead. A read-only gum code confirms nothing.

--allow-destructive also needs --destructive-budget=N, where N is 1 to 20 and caps how many destructive calls the script may make. Narrow the target set further with repeated --destructive-scope op_id[:resource_key], at most 20 entries; a destructive call outside the scope fails before it reaches the API.

bash

gum code --allow-destructive --yes --destructive-budget 2 \
  --destructive-scope drive.files.delete:FILE_ID @./cleanup.risor

Secrets in agent workflows

gum protects Google credentials it owns. Project secrets such as deploy keys or service tokens still need a separate broker. For that workflow, use HASP or another local secret broker rather than pasting values into the prompt.