Security
- Status
- Effective
- Last updated
This overview describes AgentMuxer's current security boundaries and how to report suspected unauthorized use.
Buyer-owned authority
Account credentials and payment instruments remain with the buyer. Spending grants should be narrow, revocable, and auditable; agents never hold funding authority.
Evidence before trust
Access, interface, availability, and verification are independent states. The market must not infer one from another.
Explicit relay boundary
The gateway relays only marketplace calls explicitly selected by the buyer. It does not intercept unrelated MCP or application traffic.
Report a security issue
Report suspected unauthorized account use or a potential AgentMuxer vulnerability to founders@amorphiclabs.com. Do not include live credentials or unnecessary personal data. A formal vulnerability-disclosure policy and security.txt file have not yet been approved, so security testing remains subject to the Acceptable Use Policy.