JARVIS (david-darr/jarvis-app): Security Review & Harness Provenance
An in-depth code audit of JARVIS v1.14.0. We examine whether the application is safe to run on local workstations, inspect its Electron sandbox and backend boundaries, evaluate shell execution risks, and verify whether it builds upon an open-source agent harness like DeepSeek Harness (DSH).
Executive Summary
No. JARVIS is not built on DeepSeek Harness (DSH) or Cordis. It uses a bespoke Python (FastAPI) and Electron engine. While it borrows architectural patterns from Odysseus, Hermes Agent, and OpenClaw, it runs on a proprietary-style custom harness, so it does not benefit from community harness plugins or shared ecosystem improvements.
Yes, but with default privilege caveats. There is zero malicious code, backdoor logic, or hidden telemetry. However, pre-built binaries are not code-signed, and single-user installations automatically grant connected AI models terminal shell execution privileges unless manually revoked in permissions settings.
Harness Provenance: Why JARVIS is Not Built on DSH
A common question is whether JARVIS leverages DeepSeek Harness (DSH), the plugin-based open-source agent runtime maintained by DeepSeek AI. A full dependency and code scan confirms that JARVIS has zero DSH packages, zero Cordis meta-framework code, and zero DeepSeek runtime dependencies.
Instead, JARVIS was built from the ground up by its author, incorporating patterns from three separate agent systems referenced throughout the source code:
Odysseus Architecture Patterns
Application Design
Influenced the slim FastAPI router layout, the session state manager, the ring-buffer event bus (core/events.py), the loopback internal-tool token design, and the single-user versus multi-user authentication model.
Hermes Agent (Nous Research) Patterns
Supply Chain & Security
Adopted Hermes's strict supply chain policy (requirements.lock with pinned SHA-256 hashes per wheel), scheduled vulnerability scanning (osv-scanner.yml), and the static skill security scanner (services/skills_guard.py) used to inspect externally-sourced SKILL.md workflows.
OpenClaw Patterns
Untrusted Input Fencing
Adopted the "trusted gateway, untrusted execution" principle. External incoming data (like emails, calendar entries, and fetched web pages) is delimited using randomized cryptographic nonces (core/untrusted.py) so third-party text cannot forge system instructions.
Because JARVIS relies on its own custom runtime rather than an open harness standard like DeepSeek Harness (DSH) or the file-based OBSIA harness standard, it is an isolated software silo. Improvements, new tool drivers, and bug fixes must be authored specifically for JARVIS rather than inherited automatically from the wider open-source agent community.
In-Depth Security Audit: Strengths & Weaknesses
Our security assessment examined the codebase across four primary attack surfaces: network telemetry, desktop Electron boundaries, backend API authorization, and AI tool execution policies.
A. Verified Defensive Strengths
The application does not phone home to any central analytics service. Outbound HTTP requests are strictly confined to user-configured LLM endpoints, local Ollama ports, Hugging Face (only when the user clicks download on a local GGUF model), and GitHub for release checking.
The main window enforces contextIsolation: true and nodeIntegration: false. The preload bridge in electron/preload.js exposes only explicit, high-level functions rather than arbitrary IPC channels.
The in-app side browser runs in a separate Chromium partition (persist:jarvis-browser) with no preload script, denies media and camera permissions, and explicitly blocks loopback IPs (127.0.0.1 and localhost) to prevent external websites from reaching the backend.
When Electron launches the backend, it passes an ephemeral cryptographic secret via environment variable and immediately purges it from the process table. Only requests carrying the jarvis_ui HttpOnly cookie are accepted as the trusted local user.
Email passwords, API keys, and bot tokens are encrypted at rest using Fernet symmetric encryption (core/secret_storage.py). The encryption key is generated locally on first launch and restricted to 0o600 file permissions.
The bundled runtime packaging script (scripts/build_runtime.py) verifies SHA-256 digests of all downloaded Python runtimes and installs packages using --require-hashes against requirements.lock.
B. Critical Operational Risks & Default Caveats
Neither the macOS DMG (JARVIS-arm64.dmg) nor the Windows installer (JARVIS-Setup.exe) is code-signed with an Apple Developer or Microsoft Authenticode certificate. On macOS, Gatekeeper blocks the app by default. On Windows, SmartScreen raises an untrusted publisher warning.
Recommendation: For security-conscious operators, clone the repository and run from source using verified lockfiles rather than running unsigned pre-compiled binaries.
In standard single-user desktop mode (AUTH_ENABLED=false), the local user is granted full administrative status. As of commit b41c0fb, Bash and PowerShell tools are pre-seeded into Claude Agent SDK's allowed list without asking for user approval per command.
Furthermore, for external models (OpenAI, DeepSeek, Ollama, local models), core/external_brain.py exposes a run_shell tool that executes commands directly via asyncio.create_subprocess_shell with no user prompt if the user is admin. If an external email, document, or prompt injection bypasses the untrusted fence, the model has direct command-line execution capability on your workstation.
Recommendation: Open Settings → Permissions immediately after first launch, find the standing grants for shell tools (Bash, PowerShell), and revoke them so the application prompts you before executing terminal commands.
Developer Mode allows models or users to create custom tabs stored in <data-dir>/tabs/routes/tab_*.py. On startup, the backend automatically imports these Python modules dynamically via importlib. While powerful for customization, any file written to that directory executes inside the backend process on subsequent runs.
Recommended Safe Installation Checklist
If you are testing JARVIS on your personal machine or within a business evaluation environment, follow these four defensive practices:
Navigate to Settings → Permissions and revoke the pre-approved rule for Bash and PowerShell. This forces the agent to prompt you interactively with an "Allow once / Reject" dialog before any command executes.
If configuring Tailscale remote access to reach the app from your mobile device or another computer, set AUTH_ENABLED=true. Configure a strong password and enable TOTP two-factor authentication so the administrative API cannot be reached over the network unauthenticated.
Although JARVIS includes a static Skills Guard scanner, never import untrusted SKILL.md files without reviewing their instructions and external tool requirements.
Because connected models have write access to your chosen Markdown vault folder, initialize a local Git repository inside the vault directory. This ensures you can inspect diffs and roll back any unexpected file edits immediately.
How JARVIS Compares to the YAIBOS Standard
JARVIS receives a B+ grade on the YAIBOS implementation radar. It excels at sovereign desktop custody and Markdown memory visualization, but exhibits clear gaps when evaluated for founder-led small business operations:
- • Chats, notes, memory, and automations live in local plain Markdown files you own.
- • No proprietary database lock-in: your vault remains readable in Obsidian or standard text editors.
- • Zero-install desktop installers available for non-technical users.
- • Proprietary-style harness: does not participate in the shared open-source harness ecosystem (DSH / OBSIA).
- • Single-workstation design: lacks multi-user team RBAC and granular folder permissions.
- • Automations are prompt scripts rather than standard business SOP cards with duration and ROI telemetry.