Docs / Clients and permissions
Any program on your computer can speak to ModelBrain, so ModelBrain keeps a short list of rules about which assistants it serves and what each one may delete. This page gathers them in one place: what you will be asked, what is limited, and what these checks do and do not protect against.
From 0.6, a new assistant has to be decided on once.
The first time an assistant ModelBrain has not seen before connects, it is served and a small window asks you to Allow or Block it. Closing the window leaves it undecided: it keeps working, and you are asked again after the menu helper restarts. A blocked assistant is refused with a client_blocked error.
ModelBrain's own programs are not asked about, except the Claude Code prompt hook, which is asked about once as modelbrain_claude_code_hook.
A program that introduces more than five new client names in ten minutes is refused until you decide on the pending ones. Since 0.6.3, an assistant still waiting for your decision is also refused any admin action (see below).
Forgetting is the one action an assistant cannot take back, so it is rationed.
ModelBrain refuses more than 20 forgotten or archived objects a minute from one assistant, counted across reconnects, and tells the assistant to wait. A forget of a chain of 5 versions uses 5. The limit is checked before the forget runs.
One call that would remove more than 20 objects is refused outright.
Set MODELBRAIN_DESTRUCTIVE_PER_MINUTE to change the limit, or 0 to turn it off.
Recent forgets can be reversed from the menu.
The menu item appears when an assistant has forgotten memories in the last 15 minutes, with the count in brackets. Choosing it brings them back as new copies, so a restored memory has a new key. Anything older than 15 minutes cannot be undone from here.
Undoing a forget in revert mode restores one live version.
The undo list refuses a new forget before it drops one you could still undo.
A token is an optional, stronger check that an assistant is the one you set up.
modelbrain_admin setup tokens --mint NAME makes a token for any assistant. Turning on Require client tokens first lists the assistants that would be locked out, so you can mint tokens for them before you switch it on.
modelbrain_admin setup tokens --revoke LABEL shuts a token out, and since 0.6.3 it also closes the connections that used it.
The list shows which token label each client used, and flags a label that does not look like the client's name. That flag is visibility only: revoking the label is what locks a token out.
Config files that hold a token are set to owner-only permissions on macOS and Linux, and since 0.6.3 they are private from the moment they are created.
Some actions change or copy the whole store, so they are held to a stricter rule.
Admin actions such as backups, sharing a partition, bulk deletes and exports are refused to any program that is not part of ModelBrain, and to any assistant still waiting for your decision. A backup has to be written outside the store.
Since 0.6.3, the ChatGPT relay proves itself to the local daemon with a secret the daemon makes when it starts, so a program on your computer can no longer pose as the relay to skip the Allow prompt. Restart ModelBrain after you upgrade, because an old daemon and a new relay client do not talk until it restarts.
On Linux and Windows the install folder belongs to you, so client identity is a consent tool for well-behaved programs and not a defence against software already running as you. These checks stop an assistant from doing more than you agreed to. They do not stop malware that already runs as your user account. These checks decide which assistants ModelBrain serves and what they may delete. They do not stop a program that is already running as you from reading your data; your operating system's account is that boundary.
Related: The ModelBrain menu for where each prompt appears, the tool reference for the forget modes, and the changelog for the release each rule arrived in.
Step-by-step guides for each one.
ChatGPT → · Claude Desktop → · Claude Code → · Cursor →