What Handful sends, asks and does not protect
Handful is a server and a folder on your computer. This page says what leaves the computer, what a bot must ask you first, and where Handful gives no protection.
What leaves your computer
- Claude Code's own traffic. Each turn runs the Claude Code CLI, which talks to Anthropic with the account you signed in with. Handful does not read or store that login.
- One update check a day. The Mac app looks for a new release on GitHub once a day and installs it only when you say so. A copy built from source only tells you that a release is out. To turn the check off, put
"updates": {"autoCheck": false}in~/.handful/config.json, or setHANDFUL_NO_UPDATE_CHECK=1for a copy built from source. - What you connect. A connector that you add in
~/.handful/connectors.jsongives bots the tools of that server. - What bots do. A bot searches the web without asking. A command that you approve can go anywhere you can.
- Nothing else. Handful has no account, no analytics and no server of its own. A picture from the web in a chat shows as a link; Handful does not load it.
What a bot asks first
A bot reads files and searches the web without asking. Before it runs a command, changes a file or uses a connector's tool, it shows you a card: Allow once, Always allow, or Deny. A card you do not answer expires after 4½ minutes, or when the bot stops working.
What Handful does not protect
Handful has no account or login. It is safe only on a computer that one person uses.
- It listens on loopback only, and it rejects requests from other hosts and other web origins.
- Every write to the local API needs a key that Handful keeps in
~/.handful/ui-key. The key stops code that does not know about it. Bots run as your user and can read the key, so it does not stop a bot, or a script that a command you approve runs, that sets out to use it. - Bots run as your user. A command that you approve can do anything that you can do, so read each card.
- Bots are not isolated from each other. Any bot can read any file, including another bot's folder and the tokens of your connectors.
- A team keeps its members' work in one place. It is not a security boundary.