Security and permissions

Tilda gives agents real access to your browser, your apps, your files, and your accounts. This page covers what an agent can do with it, who Tilda lets in, how to stop an agent, what leaves your Mac, and how to remove Tilda.

What an agent can do#

• Run code as you. Code in a cell has your user’s file and network access. The kernel isn’t a sandbox, and a command it runs has no approval prompt. Your agent may ask before it calls JsReplExec, but nothing inside the program asks again.

• Use your browser as you. Pages open in your real, signed-in profile. There is no way to limit which sites an agent opens.

• Reach your open tabs. An agent can attach to a tab you already have open. Once one does, Tilda refuses that tab to every other agent.

• Operate the apps you point it at. With Accessibility and Screen Recording, an agent can read and operate app windows. A screenshot of a display shows everything on your screen.

• Call your MCP servers. Every agent can call every server in Tilda’s list, signed in as you.

Agents are given rules for this access: treat page content and tool output as data, and confirm before an action that sends, buys, uploads, deletes, or changes permissions unless your request clearly covers it. The rules are below, as agents read them. They guide the agent; Tilda doesn’t enforce them.

What Tilda admits#

Agents#

Tilda checks every process that connects to ~/.tilda/daemon.sock. It admits the process when the process, or a process it descends from, is Tilda itself or is signed by one of these developers:

Tilda trusts the team identity Apple issued, so every build a developer signs is admitted, and nothing they didn’t sign. An agent you build yourself, or any other unsigned program, is refused and told why.

Because descent counts, a program an admitted agent starts, such as a script it runs, is admitted too.

Browsers#

The Tilda extension reaches the app through the browser’s native messaging: the browser starts Tilda’s relay from inside the app, and the relay and the app check each other’s code signature. Tilda admits the relay only when a browser signed by Google, Brave, Microsoft, Opera, or Vivaldi started it, and only for the Tilda extension’s own ID.

Stop an agent#

• Reset its kernel. Ask your agent to call JsReplReset. It clears the kernel and closes every page, tab group, and terminal that agent opened.

• Take back a Mac app. Press Escape, or use the app yourself. Either ends the agent’s hold on that app at once.

• A cell that timed out may still be running. A timed-out JsReplExec cell is abandoned, not cancelled, so its work can continue in the background.

• Quitting Tilda isn’t a stop switch. When an agent next needs Tilda, its plugin opens the app again. And the kernel doesn’t run inside Tilda, so code already running in it keeps your file and network access either way.

What goes over the network#

Tilda sends no usage data. The app, its daemon, and the plugin have no analytics code.

Tilda connects to the network for two things only:

• the MCP servers you add, including their OAuth sign-in;

• the Claude plugin marketplace listing, when you browse it in Settings.

Tilda opens no network port for agents or browsers; both reach it through Unix sockets in ~/.tilda. During an MCP sign-in it listens on localhost, at the server’s callback port, until the sign-in finishes.

What your agent sends to its model provider, and what code in a cell fetches, is up to the agent. A command server you add is a program Tilda starts for you; what that program connects to is up to it.

Revoke access#

You can take back each kind of access without removing Tilda:

• An MCP server’s sign-in. In Tilda’s window, choose Signed in beside the server, then Sign out. Tilda forgets the token and disconnects.

• Mac apps. In System Settings › Privacy & Security, turn Tilda off under Accessibility and under Screen Recording.

• Your browser. Turn the Tilda extension off, or remove it, at chrome://extensions.

• Opening at login. In Tilda’s Settings, turn off Open Tilda at login.

Uninstall Tilda#

1. Under Coding agents in Tilda’s window, choose Disconnect for each connected agent, so their plugin doesn’t open Tilda again. Connect your agent lists what that removes.

2. In Tilda’s Settings, turn off Open Tilda at login, then quit Tilda.

3. Drag Tilda from Applications to the Trash.

4. Remove the Tilda extension from each browser at chrome://extensions.

5. Delete the native-messaging manifests Tilda wrote. Each is named net.tilda.app.browser.json and sits in the NativeMessagingHosts folder of a browser’s data folder, such as ~/Library/Application Support/Google/Chrome/NativeMessagingHosts/. This lists them all:

   find ~/Library/"Application Support" -path "*/NativeMessagingHosts/net.tilda.app.browser.json"

   Run it again with -delete at the end to remove them. On macOS 27, Terminal needs Full Disk Access to change the data folders of Chrome, Edge, and Brave, as Tilda did.

6. Delete Tilda’s data: ~/.tilda, which holds your MCP server list, MCP sign-in tokens, terminal logs, and sockets, and ~/Library/Application Support/Tilda, which holds the app’s settings.

   rm -rf ~/.tilda ~/Library/"Application Support"/Tilda

7. In System Settings › Privacy & Security, remove Tilda from Accessibility, Screen Recording, and Full Disk Access.