Threat model
What we protect, what could go wrong, what our controls do, and what risk is left. This is a working draft written in October 2026. It is a design review plus the few real-hardware checks we have, not a security assessment.
Three things to know first
The old typed confirm phrase can be typed by the model, so it is not a human gate. That mode still exists and labels itself so. The default for media and power is now an out-of-band approval step: the call returns "needs human approval", and a person must run an approve command in a real terminal and type a short code shown there. It is tested on a mock and on a subprocess only. We have not shown that any real client displays the request to a person, and nothing has run on real hardware. Typed keyboard input is not covered by approval; only the tier gates it.
The Comet, the KVM we use, had four published vulnerabilities in March 2026 (see the Comet row below). We read the vendor advisory and did not test the fixes.
Our unit's firmware signing check is untested. We do not know whether our firmware verifies signatures.
Assets, threats and controls
Evidence status uses four labels only. Design means written down, not run. Mock only means tests against a simulated device. Real hardware read tier means run on the real Comet in read-only mode. Vendor advisory only means we read the maker's notice and did nothing else. No row has any other status. For a view of what has run, see usage and safety.
| Asset | Threat | Our control | Residual risk | Evidence status |
|---|---|---|---|---|
| Target OS login and data | An agent or attacker uses a network credential or agent on the target. | No network path or credential on the target. KVM only. | The agent can still type into a console that is already logged in. | Design; real hardware read tier |
| Agent decisions | Prompt injection through screen text, a BIOS string or a login banner. | An untrusted-text field, digit re-entry, a stale-frame gate and capability tiers. | The model may comply. Published attacks exist against computer-use agents. | Mock only. Effect against a real model not measured. |
| Power and media actions | An injected or mistaken reboot, mount or upload. | An out-of-band approval step by default. The call waits until a person runs an approve command in a real terminal and types a short code. Approval is single use, expires, and is bound to the exact arguments and target. Rate limits, a kill switch and dry run also apply. The older typed phrase mode remains and is labelled not a human gate. | An agent that has a shell can open a pseudo-terminal and approve its own call. A compromised host user, anyone with the state files, or a person who approves without reading defeats it. No real client is shown to display the prompt to a person. Nothing has run on real hardware. | Mock only |
| KVM device (the Comet) | Firmware tampering, root over the serial port, brute force, or a cloud provisioning attack. The maker published CVE-2026-32290, CVE-2026-32291, CVE-2026-32292 and CVE-2026-32293 in March 2026. | A certificate pin before credentials. Our unit runs firmware V1.10.1, newer than the vendor fix, V1.8.2. | We have not tested whether our unit verifies firmware by signature. Physical access to the serial port is not covered. | Vendor advisory only |
| KVM password and MCP host | A compromised host gains control of the KVM. | The secret is read from the environment and never placed in arguments or results. | Other processes of the same user can read the environment. | Mock only |
| Boot media | A malicious or wrong image is mounted. | A media directory only, image verification in an emulator, and a separate phrase for read-write. | Image content runs with full privilege. | Mock only |
| Keyboard input | Arbitrary commands at an open prompt. | A tier gate, refusal of control characters, a cap on input length, and power chords classed as power. Typed input is not gated by approval today; the tier alone gates it. | Typing text is command execution by design. | Mock only |
| Audit log | Edit or delete after the fact. | A hash chain, owner-only permissions, and a keyed hash of typed text. | The writer can recompute the chain. No off-host anchor yet. | Mock only. Tests catch edits. |
| Tool manifest | A tool description is changed after review (a rug pull). | The session reports a manifest hash. | Clients do not enforce it. Releases are not signed yet. | Real hardware read tier |
| Screen digits | A misread digit leads to a wrong action. | A digit-risk flag and a re-entry rule. | A speed bump only. Misreads have been seen on real frames. | Design |
| Supply chain of the tool | A malicious dependency or release. | Version bounds on the MCP library. Nothing more. | No bill of materials and no signing. | Design |
| Air-gap claim | The KVM or the tool calls out to the internet. | The server has no cloud dependency. | The Comet cloud behaviour is untested by us. | Design |
Sources for the Comet row: the Eclypsium write-up and the GL.iNet advisory. Those two sources disagree about which versions are fixed, so check the national vulnerability database before quoting a version.
What we do not claim yet
Each claim below is held back until its gate passes. If you see one of these words about Bootscry anywhere, it is a mistake on our part.
| Claim we hold back | What releases it |
|---|---|
| "Isolated", "hardware-isolated", "air-gapped", "zero trust" | A published threat model, a reference design that isolates the KVM on its own network, the firmware-signing test, and an air-gap run with the Comet cloud features disabled and observed. |
| "Human approval" | An out-of-band approval step exists and is tested on a mock. The claim stays held until a real client run shows a person saw the prompt, with the refusal log. Elicitation is not built. |
| "Tamper-proof" audit log | An off-host anchor of the audit head, in place and verified. |
| "Works offline" | A full session with no internet route, recorded in the usage ledger. |
| "Compliant with" or "aligned to" a framework | A written control mapping reviewed by someone outside the project. |
| Input, media or power "tested" | Real-hardware runs of those tiers, published with the firmware version. |
| "Supports" any vendor | The rung rules of the claim ladder. |
| "Prevents prompt injection" | Nothing we plan will release this. Screen text stays untrusted. |
| Any certification word | An independent assessment. Certifications apply to organisations, not to open-source code. |