These are local stdio servers. There is no network listener, no auth surface, and no remote input beyond what the calling agent sends. The trust boundary is the MCP client and the user whose config registers the binary.

• Reads files under a configured repo root. Path-jailing rejects parent directory traversal.
• Reads local Reticulum state under ~/.reticulum. Config lint is read-only, and storage decoders never write.
• Runs fixed-argv subprocesses (git, task, uv, pnpm, and RNS utilities). No shell strings, and no user-controlled executable names.
• Fetches from host allowlists only (reticulum.network, meshchatx.com, rns.recipes, unsigned.io, github.com, api.github.com).
• gateway spawns servers from the client's own config file. It cannot be pointed at arbitrary binaries through tool arguments.

Open a private security advisory on the repository rather than a public issue. Do not include real identity keys, RPC keys, or destination hashes in reports. The tools redact these in output by design.