Reference
Security model
Understand the keys, the trusted endpoints, and the difference between encrypted transport and the machine running your code.
Where plaintext exists
Section titled “Where plaintext exists”| Part of the system | What it handles |
|---|---|
| Your approved device | Displays terminal contents and sends your actions. It is a trusted endpoint. |
| The agent machine | Runs the CLI, reads the project and uses the credentials needed for provider requests. Miko software on this machine is part of the trusted endpoint. |
| Miko’s gateway | Relays the encrypted session. It cannot read the terminal payload carried by that end-to-end connection. |
| Previews of websites your agents start | Encrypted in transit and passed through Miko’s servers without being stored. Unlike terminals, previews are not end-to-end encrypted. |
| Miko’s account services | Handle account, plan and billing information, machine/resource state and connection metadata. |
| Your AI provider | Receives the requests the CLI sends, including project information or prompts needed for that work. |
“Miko cannot read your terminal connection” describes the relay’s boundary. It does not mean software running on your machine cannot access the data it needs to do its job. A compromised device or an agent given access to a secret is outside that relay protection.
Sign-in and key storage
Section titled “Sign-in and key storage”Miko account sign-in and AI provider sign-in are separate. Miko supports passkey sign-in; new devices need approval through the trust flow. A provider subscription or API key authenticates the coding CLI, not your Miko account.
On Mac, provider sign-in runs through the provider’s own program. Codex uses one account-specific home and its own Keychain item; Miko checks status through the CLI and does not import or forward the login token. A separate profile for an account is not a filesystem sandbox.
For Host API-key accounts, the key is entered for a selected machine and stored in that Host’s local vault. The vault encrypts saved keys with AES-256-GCM and keeps its local encryption key on the same Host. The Host decrypts a key when its local provider proxy needs it. This is not protection from an administrator who controls that Host.
Host API-key accounts are machine-local; this vault is not a Cloud synchronization source. Signing out clears the saved secret for the API account. Removing the account removes its vault entry.
End-to-end terminal transport
Section titled “End-to-end terminal transport”Miko’s terminal channel uses Noise_IK_25519_AESGCM_SHA256. Pairing binds the connection to the machine’s identity; compare the three words on both screens. HTTPS and WSS carry the connection, while end-to-end encryption protects the session payload from the relay.
Approve new devices deliberately. Keep a recovery key private and separate from support messages. Device removal and account recovery are security actions, not ways to bypass approval of an unfamiliar device.
Cloud memory protection and verification
Section titled “Cloud memory protection and verification”Miko Cloud uses AMD SEV-SNP as its memory-isolation layer, alongside disk encryption and the encrypted terminal connection. Cloud machines open only with memory encryption in place, as described on the current Security page. Cloud protection does not turn your own Mac or Linux server into a confidential VM.
Download the AMD attestation report and certificate chain from Verify this machine… in the machine’s ⋯ menu. Use AMD’s open-source snpguest tools to check the signature, certificate chain and reported security version independently of Miko.
What these layers do not protect
Section titled “What these layers do not protect”They do not prevent an approved endpoint, a vulnerable program or an authorized agent from disclosing data. They do not stop data you choose to send to an AI provider. On Cloud and Linux Host, new agents started from the web app use Never ask, which skips approval prompts, unless you choose another mode or the provider supports only its own default. On the Mac, Claude Code and Codex run without their normal approval prompts in Miko’s configured terminal flow; Grok Build keeps its own prompts. Only use project folders and machines you intend those agents to access.