Security model

Cortex supplies knowledge and tools to an agent host. The host remains responsible for how the agent uses that context and when a person must approve an action.

Data access

Cortex sees data sent through its API, CLI, web application, or agent integration. Cortex does not inspect your repository, terminal, or agent session on its own.

An agent can send information from authorized work to Cortex when it creates or updates a Module, Issue, or comment. That can include decisions from a conversation or repository-derived knowledge. Give the agent clear scope for what it may preserve and which Account owns it.

Do not place credentials or secret values in Modules. Keep private customer and team material within its authorized boundary. Flash includes the target Module's dependency closure, so an agent preparing knowledge for wider access must check the included dependencies too. Automated maintenance does not make private knowledge public, and knowledge access does not authorize publication.

Choose how changes are reviewed

You can authorize the agent to maintain useful knowledge during work, or require it to propose changes and wait for your approval. Customize the instructions during setup; the agent still prepares the content and dependencies in either mode.

Instructions express your preference. Your host's tool-confirmation settings and Cortex's resource permissions enforce separate boundaries. If you require a confirmation for each tool call, retain that host setting. Saving guidance alone is not an access-control mechanism. Publication, deployment and other external actions retain whatever approval requirements you set for them.

Plugin guidance

The coding-agent plugin supplies Cortex instructions through a skill in Codex and Grok Build, or a SessionStart hook in Claude Code, Cursor and GitHub Copilot CLI. Those instructions teach the agent to retrieve relevant knowledge and preserve useful specifics from its work. They do not upload the whole repository or conversation automatically.

The SessionStart hook does not watch the Cortex inbox, invoke a coding agent, or execute remote work automatically.

MCP tools

The hosted MCP server includes read, write, and delete-capable operations. Cortex enforces the authenticated principal's Account access and operation permissions. The agent host decides whether to request confirmation before invoking an allowed operation.

Inspect the discovered tool set and configure the host's approval policy before enabling Cortex for unattended workflows.

OAuth credentials

First-party plugins contain public OAuth client IDs. They do not contain client secrets. Each supported host completes Authorization Code with PKCE and stores its own grant.

The socra cortex setup installation does not copy or expose the CLI bearer token. Removing a plugin does not automatically revoke grants already stored by the host or authorization server.

Instruction precedence

Cortex output is tool context. It does not override system instructions, repository instruction files, organization policies, or the agent host's confirmation rules. Keep the instruction files your host normally discovers.