Keys never
leave your device.

USB security chip — Windows uses Koffi FFI to talk directly to the SIMKey SDK.

Keys are generated and used inside the secure chip; they never leave the hardware. Signing, encryption, and database key management all require physical U-Key confirmation; repeated PIN failures auto-lock. macOS / Linux fall back to software simulation.

SIM-card hardware security via Android OMAPI / iOS eSIM API.

Leverages secure elements built into SIM cards across all three Chinese carriers' USIM and 5G super-SIM cards. 12 security enhancements: eSIM OTA, NFC offline signing, deep TEE integration, post-quantum readiness, satellite-comm SIM, joint HSM authentication.

Full-database local encryption — keys guarded by U-Key.

SQLite + SQLCipher with WAL mode + busy_timeout for concurrency, parameterized queries to prevent injection. Keys are never stored in plaintext on disk — every unlock requires a hardware signature.

P2P end-to-end encrypted messaging · Double Ratchet.

Forward and backward secrecy. Offline message queue with automatic retry. Combined with libp2p + WebRTC for NAT traversal.

Sensitive data is forced through local model inference.

LLMManager smart routing: sensitive-tagged content → Ollama; general tasks → user-chosen provider. 14+ cloud LLMs available but never default. All prompt / response history stays local.

ML-KEM key encapsulation · ML-DSA signing · full RSA / ECDSA replacement.

Built on NIST FIPS 203 / 204 standardized algorithms, with SLH-DSA (FIPS 205) hash-based signing as a fallback. Ed25519 / X25519 hybrid mode covers the transition period — current certificates are already forward-secure against quantum threats.

zk-SNARK Groth16 · zk-STARK generated locally.

Proofs are generated on the user's device — raw data never reaches the verifier. Use cases: age / identity / asset-threshold proofs, compliance reports, cross-chain bridge security. STARK is post-quantum secure; SNARK is compact and efficient — the system selects per use case.

FIPS 140-3 compatible · Unified HSM interface.

Plug-and-play with major hardware wallets (Yubikey / Ledger / Trezor). Enterprise edition integrates Thales / Utimaco / Chinese-domestic HSMs. The unified interface hides backend differences — threshold signing, multi-sig policy, key escrow share one API surface.

MLPS Level 3 · 4 invention patents · group-standard co-author.

Co-author of the China Mobile Communications Association group standard Artificial Intelligence — Technical Requirements for Intrinsic Security of Agent (T/ZGCMCA 023—2025), drafted jointly with CAICT (China Academy of Information and Communications Technology) and ~30 other institutions; published and effective 2025-02-07. Enterprise edition supports full audit logging, DLP policy engine, SIEM export (CEF / LEEF / JSON), and automated SOC2 evidence collection.

Let agents invoke local tools without turning plugin code into ambient authority.

Public npm latest CLI 0.166.141 routes plugin hooks, MCP, LSP, monitors, PTYs, background tasks, and native bins through one Process Broker policy. Linux accepts only attested supported static ELF files for the current architecture, pins the plugin tree by descriptor, and enters a fixed bubblewrap filesystem/network boundary. Windows AppContainer binds the resolver-issued target handle, trusted environment, and policy digest. Copied, replayed, or stale contracts, dynamic loaders, malformed segments, and missing isolation primitives fail before launch. Public 0.166.141 passed exact-commit cross-platform gates and OIDC publication; workspace proxy-addr and SDK test dependency security updates are recorded in the CLI release notes.

Plugin management surfaces signature, SBOM, source, and managed-policy summaries. Plugin-bin and plugin-provided MCP usage is attributed by plugin/version without retaining tool arguments. Publication requires the exact release commit to pass CLI CI and CLI Strict Sandbox across Ubuntu, Windows, and macOS.

The 2026-08-31 execution-security closure adds a fixed renderer/main IPC capability manifest, network-denied workspace-write defaults, fail-closed approval/policy persistence, and durable redacted admission before high-risk process creation. External Cowork handlers still require Ed25519 and content-digest revalidation before one-shot isolated workers; bundled-handler network, process, environment, and credential access stays behind Skill- and authority-bound brokers. Exact-SHA qualification is not public native distribution.