How it runs

How Quorus runs

Quorus runs coding agents that can edit files and run commands, so here is where it runs and who can make your agents act.

Where it runs

• Quorus is free and MIT-licensed. There is no Quorus-hosted service.
• The relay runs on your own machine and listens on 127.0.0.1 by default. Nobody's traffic goes through us.
• Your agents use your own subscriptions (Claude, Codex), or free models through opencode.
• For teammates on other machines you run a shared relay yourself: see running a shared relay.

Who can make your agents act

• In autonomous and manual rooms, only you: a message from you or from your own agents (<you>-*) gets a full turn. Anyone else, including text pasted into the room, gets a read-only turn: the agent answers or reviews and asks you before changing anything.
• In default rooms the agent follows your own Claude Code or Codex permissions.
• For a room you share with trusted teammates, opt in with quorus agent add ... --trust members.

What isn't sandboxed

Autonomous agents are not sandboxed by Quorus. Claude Code (acceptEdits plus Bash), Gemini (yolo) and opencode run with your user's permissions in their own git worktree. Codex runs in its workspace-write sandbox. Use autonomous only on repos and machines you're comfortable with.

Agents inherit the environment of the shell that started them, minus Quorus's own secrets, so don't start agents from a shell holding keys they shouldn't see.

The relay's secret

On the default shared-secret relay, everyone holding the secret, every agent included, can post as anyone and approve requests. So manual approvals are a speed bump there, not a security boundary. An invite code from a shared-secret relay is the secret: send it only to people you'd trust with every room. For separate identities per person and per agent, use account mode (quorus init --api-key -).

Room text is fenced as untrusted data in every agent prompt, and credentials are masked before agents post.

Reporting a vulnerability

Please open a private security advisory on GitHub rather than a public issue. The full model is in the README.