Nyral bundles device-control capabilities (SSH, shell, WebView automation, accessibility control) with local memory in one app, so security design is a core concern. This document describes the actual security mechanisms, the permission list, and the data boundaries, so you can assess the trust cost yourself.
DebugServer provides debugging capabilities: screenshots, simulated taps/input, WebView JS execution, and agent-pipeline calls. Protections:
- Not started in release builds: runtime check of
ApplicationInfo.FLAG_DEBUGGABLE; returns immediately when not debuggable - Disabled by default: requires tapping the version number 7 times to unlock the settings entry
- Binds to 127.0.0.1 by default: only the device itself /
adb forwardcan reach it; "LAN access" must be enabled manually and logs a prominent warning when on - Authentication: only the
X-Auth-Tokenrequest header is accepted (the query-parameter form was removed to prevent leaks via proxies/logs) - Non-local connections log warnings
- Default
autotier:ssh_run/sh_run/js_run/browser_eval/web_download/ file writes / browser click-input / third-party app control are rated HIGH and require confirmation before execution security_setis CRITICAL (configuration-change class)stricttier available: confirm every time, disables the 5-minute ticket reuse- Root auto-elevation is off by default
- SSH host-key verification: unknown hosts are rejected
- Dangerous-command interception (sh_run) + sandboxed execution (js_run ClassShutter)
| Permission | Purpose |
|---|---|
| INTERNET | Networking (model API / SSH / update check) |
| RECORD_AUDIO | Voice input |
| REQUEST_INSTALL_PACKAGES | Self-update APK install |
| FOREGROUND_SERVICE / FOREGROUND_SERVICE_DATA_SYNC | Foreground-service keep-alive |
| POST_NOTIFICATIONS | Notifications |
| WAKE_LOCK | Keep-alive when screen off |
| POST_PROMOTED_NOTIFICATIONS | Android 16+ promoted notifications (Live Updates) |
| SYSTEM_ALERT_WINDOW | Overlay window |
| SCHEDULE_EXACT_ALARM / USE_EXACT_ALARM | Exact-alarm wakeup for scheduled shifts (setAlarmClock path, exempt from user grant) |
| RECEIVE_BOOT_COMPLETED | Re-schedule timers after reboot |
| MANAGE_EXTERNAL_STORAGE | All-files access |
Notifications, microphone, overlay window, all-files access, install unknown apps. The last three are special authorizations; when root auto-elevation is enabled they are granted automatically via pm grant + appops set — off by default.
- On-device only: conversation history, long-term memory, token stats, SSH config (encrypted storage)
- Leaves the device: chat messages, attachments, and parsed text are sent to the model endpoint you configure (OpenAI-compatible). Self-host an endpoint for full privacy
- No behavioral tracking; the only outbound diagnostic is anonymous crash reporting (device model, Android version, crash stack, last 30 runtime log lines — never chat content or PII), on by default and one-tap disable in Appearance Settings → Quick Switches; crash reports are stored on the developer's server for up to 30 days and then automatically purged, with per-day and total upload quotas; the only other startup external request is the GitHub Release update check (404 ignorable)
- Install on a spare device first, using the Release-signed build (avoid debug builds — debug builds can enable DebugServer)
- Set the gate to
strict; keep root auto-elevation off - SSH: use dedicated low-privilege accounts, never point at production machines; use API keys with spending caps
- Grant capabilities gradually: start with read-only abilities (web_search / document parsing / local memory), then consider sh_run and app control once stable
Report security issues via GitHub Issues (prefix the title with SECURITY); for sensitive details, prefer reaching out privately through the contact info on the repository homepage.