Trust
Honest boundaries
Section titled “Honest boundaries”HyoDo is deliberately narrow:
- It is not a runtime sandbox or process interceptor.
hyodo safeis an early-warning scanner, not a full security audit.- A DENY result must still be enforced by the caller.
- The legacy HyoDo score command is a review signal, never approval. It retains the older five-input geometric-mean method for compatibility while HyoDo’s replacement evaluation model is being updated. The current package has no general per-axis evaluator and defines no canonical score across the six reference values.
- The public MCP server supports loopback or authenticated Tailscale binding;
public
0.0.0.0listeners are not supported. - Missing, unreadable, or unmeasured evidence is never reported as healthy.
That scope is intentional: the tool should be useful locally without requiring a hosted service, model provider, or remote control plane.
What backs the release
Section titled “What backs the release”- Local-first. No hosted service and no model provider are required to
run
hyodo safe,hyodo init, orhyodo checkagainst your repository. - PyPI Trusted Publishing. Releases publish via OIDC — there is no long-lived PyPI API token stored as a repository secret — with build provenance/attestation generated for the published artifacts.
- SBOM on release. A CycloneDX SBOM of the public runtime surface is generated and checked for scope and reproducibility.
- SARIF output.
hyodo report --format sarifwrites a SARIF 2.1.0 visibility report for measured DENY and unreadable-ledger conditions. - Pre-commit hooks.
hyodo-checkandhyodo-safe-strictare available as pre-commit hooks on signed releases. - MCP loopback / Tailscale only. The optional MCP adapter binds to
127.0.0.1(loopback) or an authenticated private Tailscale address; no public0.0.0.0listener is supported.
See SECURITY.md for vulnerability reporting and keyword safety gates, and docs/SECURITY_SURFACE.md for the full security surface this page summarizes.