End-to-end encrypted sessions
Terminal output, keystrokes and approvals are encrypted on the sending device and decrypted only on the receiving paired device, using modern authenticated encryption.
~/security
Your terminal is powerful. We treat it that way.
A remote terminal can run anything on your computer. That’s why CLI Setu is built so that only your own paired devices can ever see or send to it.
Security principles
Device keys, not passwords
Each computer and phone generates its own key pair. Private keys never leave the device they were created on and are kept in the OS secure storage where available.
Out-of-band pairing
Pairing uses a short-lived, single-use secret shown as a QR code on your own screen. You have to be physically present to pair.
Outbound-only networking
The companion never listens on a port. Nothing new is exposed to the internet, and your firewall stays exactly as it is.
Zero-knowledge relay
The relay routes sealed packets. It can’t read session content and doesn’t store it. It only keeps the minimal metadata needed to deliver packets and prevent abuse.
Instant revocation
Unpair a computer with cli-setu unpair, or remove a device from the app.
~/what-we-see
What we can and can’t see
Plain and simple, so you can decide with confidence.
| Data | Visible to CLI Setu? | Why |
|---|---|---|
| Terminal output and your code | No | Encrypted end to end; decrypted only on your devices. |
| Commands and keystrokes | No | Encrypted end to end. |
| AI agent prompts and approvals | No | Part of the encrypted session. |
| Your AI provider API keys | No | Stay in your AI tool’s config on your computer. |
| Device public keys and names | Yes | Needed to route packets to the right paired devices. |
| Connection metadata (time, IP, data volume) | Yes | Needed to run the relay, prevent abuse and fix problems. Kept for a limited time. |
| Account email and plan | Yes | Needed for sign-in, support and billing. |
Full details are in our privacy policy.
~/best-practices
Stay safe with AI agents
- Turn on app lock in Settings so only you can open a session.
- Read before you approve. Open the diff or command card before tapping Approve on destructive actions.
- Use session timeouts to auto-disconnect idle sessions.
- Revoke old devices you no longer use, and after losing a phone.
- Keep things updated: the app from your store, the companion with
npm update -g cli-setu.
~/responsible-disclosure
Found a vulnerability? Tell us.
We welcome reports from security researchers. If you think you’ve found a security issue in the CLI Setu app, companion CLI, relay or this website, email support@evyasys.com with the steps to reproduce it.
- We’ll acknowledge your report within 3 business days and keep you updated as we fix it.
- Please give us reasonable time to fix the issue before you disclose it publicly.
- Don’t access other users’ data, disrupt the service or use social engineering.
- We won’t take legal action against good-faith research that follows these guidelines.
A machine-readable contact is published at /.well-known/security.txt.
Secure remote access, without the setup.
No open ports, no VPN, no shared passwords. Just your devices, paired.
On your computer
$ npm install -g cli-setuNeed a hand? Read the manual or talk to support.