Security¶

• Clients use HTTPS to the agent only. No native EVE REST from laptops or CI.
• IDE: pin or Trust the agent certificate (TOFU in Configure Connection). A changed fingerprint needs a new Trust. Never auto-trust.
• CLI: no TOFU UI. Pin --ca-file / --ca-pem (or the EVE_IAC_CA_* env vars). Optional --insecure skips verification for lab/dev only — per command, never the default, no EVE_IAC_INSECURE env, HTTPS still required. Details: CLI security.
• Do not put username/password in the agent URL.
• Agent session Bearer tokens are not EVE GUI cookies. Open Lab uses a one-time browser token.
• Do not store passwords in Git, chat, or MCP JSON.
• Destroy / prune / wipe / replace require an explicit confirmation channel (IDE modal, CLI --yes, MCP confirm=true).
• Mutating API calls are not silently replayed after EVE session expiry.

See also Connect.