Skip to content
DreamUI Connectors
Get started

Trust

Live

Security

How credentials are issued and stored, where code runs, and what the connector can change on the user’s behalf.

Security model

  • Users sign in through the browser

    Device login sends the user to dreamui.com to approve. Tokens are never typed into chat.

    Verified in source

  • Device codes expire

    Each code is valid for 600 seconds and can only be claimed once.

    Verified in source

  • Credentials stay on the host

    The adapter stores the user’s credential locally on the machine running the harness.

    Verified in source

  • The adapter is not network-facing

    It runs as a local child process over stdio. Nothing listens on a port.

    Verified in source

  • User and admin credentials are separate

    A user token cannot access the Spark admin MCP, and admin tokens are never issued publicly.

    Verified in source

Writes and credits

writeFiles controls whether generation writes to localDir on the host. Set it to true only when the user has asked for files to be written. Generation uses credits from the signed-in user’s DreamUI account.

Reporting an issue

Report security issues to the DreamUI team through dreamui.com.