mythos-router follows a zero-trust AI model.

AI outputs are never trusted by default. All file operations are verified against the actual filesystem before being accepted.

• AI-proposed file writes are routed through Strict Write Discipline (SWD) and verified against filesystem state.
• Normal SWD file operations do not execute shell commands.
• Git sandboxing uses fixed git subcommands with argument arrays.
• --test-cmd is an explicit user-supplied escape hatch. It runs the provided command through the local shell for test-healing workflows, so only pass commands you trust.
• There is no hidden shell lockdown mode; omit --test-cmd if you want model-driven sessions to avoid arbitrary shell execution.

• Sensitive values (e.g. API keys) require explicit configuration
• No implicit defaults are used for security-critical settings

mythos-router stores local state in predictable locations:

• MEMORY.md in the project root stores the human-readable agentic memory log.
• memory.db, memory.db-wal, and memory.db-shm in the project root are derivative SQLite indexes rebuilt from MEMORY.md.
• .mythos/receipts/ stores local SWD receipts. These may include prompts, file paths, hashes, provider metadata, budget data, test command names, and a short redacted test output tail. This directory is gitignored by default.
• ~/.mythos-router/sessions/latest.json stores the latest resumable conversation history and budget state.
• ~/.mythos-router/metrics.json stores local token, cost, duration, command, and project metrics for mythos stats.
• ~/.mythos-router/cache.db may store SDK response-cache entries when the cache API is used. Responses containing tool calls or SWD file actions are not cached.
• ~/.mythos-router/skills/ stores user-provided skill instructions loaded only when selected.

Treat session files, receipts, memory, and cache files as private project data. Delete the relevant file or directory to clear that local state.

This tool is designed for local execution only.

Users are responsible for:

• reviewing AI-generated actions
• validating changes before applying in production environments

If you discover a security vulnerability, please report it responsibly:

• X: @thewaltero (recommended)
• Or open a private security advisory on GitHub

Please avoid public disclosure until the issue has been reviewed.

Currently supported:

• Latest version on main

Older versions may not receive security updates.