How Bridgit keeps agents in check
An agent you connect to Bridgit gets real control of your phone. So Bridgit puts several protections in layers. The goal: a stolen key should be useless, and you should hear about anything unusual.
This page is for phone owners. It explains what each protection does and where to find its setting. The settings named below are in Bridgit under Settings › Security.
Always on
- Your private network only. Direct connections come only from your own private Tailscale network. Anything else is refused before a key is even checked.
- A key for each agent. Each agent has its own long random key (256 bits). The phone keeps only a salted hash of it, never the key itself. Rotating or removing an agent stops its key at once. For 7 days, the old key gets a clear answer that it was rotated or removed.
- Pause at any time. You can pause any agent. Permission changes take effect within a fraction of a second, even in the middle of a request.
- Permissions per agent. You choose what each agent may do. The two strongest powers, Fixer Mode and Super Powers, are yours alone to switch on. An agent can't grant them.
- Limits on guessing and overuse. 5 wrong sign-ins from one address, and it is stopped. Captures are limited per agent and per address, and requests per agent. The 6-digit pairing code lasts 5 minutes and closes after 5 wrong tries.
- A record of everything. The activity log lists every request: which agent, from where, what it asked for and the result.
- Relay protections. When agents reach your phone through the Bridgit relay, the phone proves who it is with its own identity key, kept in the phone's secure hardware. Agents' relay tokens are stored only as hashes. An optional sealed mode encrypts requests and replies end to end, so the relay itself can't read them.
New: agents locked to their device
On by default. Setting: Security › Lock agents to their device.
- The first device on your Tailscale network that uses an agent's key becomes that agent's device.
- The same key from any other device is refused. You get a notification with Allow (adds that device) and Block (pauses the agent).
- Tailscale addresses can't be faked. So a key copied from a chat log or a file is useless anywhere else.
- Rotating a key unlocks it, so the new setup can go on a new machine. You can also unlock it from the agent's page.
- Agents you added before this change are locked to the Tailscale address they last used.
New: single-use portal pairing links
On by default.
- A pairing link or QR code for Bridgit Portal works once.
- The iPhone, iPad or Android viewer makes its own new key on the device. The key in the link then stops working.
- A link nobody uses expires after 24 hours.
- Pairings made before this change keep working. Older Portal apps need an update to pair with new links.
New: alerts from new places
On by default. Setting: Security › Alert on new devices and networks.
- You get a notification when an agent connects from a new device (direct connections) or from a new network (through the relay, which now tells the phone the caller's network and country).
- One tap on Block stops it.
- An agent's first connection is simply remembered, without an alert.
Optional, off by default
Confirm with fingerprint
Setting: Security › Confirm with fingerprint. Turning on Super Powers or Maximum control, approving an agent's request on the phone, unlocking an agent's device and switching any of these security settings off then need your fingerprint, face or PIN. The Allow button leaves the new-device alert too: you unlock the agent from its page instead. Why it helps: an agent with Super Powers can tap the screen, but it can't pass a fingerprint check.
Relay: signed requests only
Setting: Security › Relay: signed requests only. Relay agents that can control the phone must then use sealed mode. Every request is encrypted and signed with a key that lives only on the agent's own machine, so a copied token alone is useless. Portals are read-only and keep working.
The trade-off: agents that connect like a claude.ai connector, signing in through the relay, stop working while this is on.
What this can't stop
If the agent's own computer is taken over, the attacker is on the right device. That's what permissions, pausing, alerts and the fingerprint option are for.
- Keep agent keys out of shared chats and documents.
- Remove agents you no longer use.
If you think a key leaked
- Open the agent in Bridgit on your phone.
- Tap Rotate key, or Remove if you no longer need the agent.
- Check the agent's activity log for anything you don't recognise.
- Check your paired portals and disconnect any you don't know.
Questions? See support. How Bridgit handles your data is in the privacy policy.