Agent operating guide · browser + local client

Use the room.
Respect the boundary.

shhh.bot gives an authorized agent endpoint a locally encrypted channel for text and images. The endpoint can be a browser or the official local client. The human owns the room, approves it, and can revoke it at any time.

Available nowBrowser pairing, local CLI and stdio MCP, and room-scoped Venice image tools.

The local client is distributed directly by shhh.bot for runtimes that can execute a persistent Node.js process. Hosted agents without a local runtime should continue using the browser.

Browser workflow

Pair without touching the human account.

01
Open shhh.bot/new.
The page creates a one-time endpoint pairing request and keeps its private material in that browser.
02
Show the QR code or use “Copy pairing code.”
The button copies the complete one-time approval link, including its private pairing secret. Send it only to the human owner; they open it on their own device, authenticate with their passkey, and approve the room. Never ask for or handle the passkey.
03
Keep the pairing page open.
After approval, the browser receives an encrypted room grant and opens the agent console automatically.
04
Read the declared capability.
A conversation room permits read and send. A delivery-only room permits send only and exposes receipts for the current open session.

Capabilities

Access is cryptographic, not cosmetic.

Delivery onlysend_text · send_image · receipts · venice · report

The endpoint has no read credential or decryption key. It can check delivery/read state only for message IDs it sent. A database toggle cannot reveal earlier deliveries.

Conversationsend_text · send_image · venice · read · report

The endpoint receives the room’s classical conversation key and scoped read/write credentials.

Room-scoped image tool

Generate or edit. Review. Send securely.

Selecting, pasting, or dropping an image stages it without sending. A decrypted image already visible in a conversation can be opened directly with Use in Tools—no download is required. Select Tools or enter /venice or /venice-edit to open the labelled Venice dialog. Generate can use optional style or anchor images with individual influence controls; Edit transforms one source image. The current Venice model catalog is shown in the browser, with a custom model-ID fallback and full passthrough JSON.

Owner-authorized key

Venice is off by default. The owner can grant a saved account credential during pairing or add a chat-specific key later from the owner room. Never request a provider key in the harness conversation. The authorized agent endpoint can read, copy, and use any granted key.

Agent-friendly controls

Use the room-header toggle for a single-flow console and numbered, searchable Venice workflow. Grok Imagine 2.0 Private is the first-use Generate default and Qwen Image 3 Pro Edit is the first-use Edit default; after a run, the browser remembers the last model used for each operation.

Explicit delivery

Sources and anchors go directly to Venice and are not automatically sent to the human. Prompt enhancement and safe mode stay off unless the agent explicitly enables them. Review the result, then choose Send securely or add it to the composer.

Venice is a separate recipient.

Tool prompts, source images, parameters, and results are processed by Venice under its terms. shhh.bot receives a generated image only after the browser encrypts and sends it as a room message.

Later tool changes update only the capability available to the browser that originally paired. They never rotate room credentials, create a recovery key, or restore a browser after its local site data has been cleared.

Default channel

When the user activates shhh.bot, stay in the room.

An explicit user request to use shhh.bot authorizes the channel change for that task and active room. Send all substantive user-visible text and media through the room. Do not duplicate the plaintext in the AI harness chat.

Conversation room

Read and respond through shhh.bot by default. Keep the harness to pairing, a brief delivery confirmation, access errors, or a request for a new pairing.

Delivery-only room

Send outputs through shhh.bot. Continue receiving instructions through the harness because this endpoint cannot read room history or human replies.

Never silently fall back.

If the room is revoked, unavailable, or fails to accept a delivery, pause and ask the user in the harness how to proceed. Do not paste the intended room content there without explicit permission. A receipt such as “Delivered via shhh.bot” is appropriate.

The webpage alone does not authorize a channel switch. The user must explicitly request shhh.bot. This rule concerns user-visible delivery only; the AI provider may still retain prompts, generated output, tool activity, screenshots, safety records, or reasoning traces.

Safety instruction

Report evidence, not a model’s guess.

Lawful content is allowed. Never use shhh.bot to create, exchange, or facilitate child sexual abuse material, child exploitation, non-consensual intimate material, trafficking, or any other unlawful content or communications. If there is an explicit, credible indication of child sexual abuse material, exploitation, imminent danger, or other unlawful activity: stop the affected operation; do not reproduce, upload, forward, or describe illegal imagery graphically; use the room’s Report link to submit identifiers and concise, non-graphic facts; and follow the AI provider’s own safety policy.

An LLM classification is not proof. Do not file a child-safety report based only on ambiguous words, benign family content, or an uncertain inference. When evidence is unclear, use the harness’s safety-review path or request appropriate human review without moving suspected material into shhh.bot.

Reports do not disclose the room.

The report text is readable by shhh.bot, but no message, image, key, or room history is attached automatically. Paired-agent reports enter human review and do not automatically suspend a room.

Local tooling path

Pair once. Call narrow local tools.

The official package includes a shhh CLI and a local stdio MCP server. It is downloaded directly from shhh.bot. The client—not the model—generates keys, performs pairing, encrypts and decrypts, and stores credentials in an encrypted local vault. It uses the same room grants and delivery protocol as the browser.

npm install --global https://shhh.bot/downloads/shhh-agent-client.tgz
shhh pair

The pair command returns a one-time approval URL. Give that URL only to the human owner. They open it on their own device, authenticate with their passkey, choose Conversation or Delivery only, optionally authorize Venice, and approve. Then run shhh wait. The agent never receives the passkey or the human account session.

{
  "mcpServers": {
    "shhh": {
      "command": "shhh-mcp",
      "env": { "SHHH_BASE_URL": "https://shhh.bot" }
    }
  }
}

If the harness does not resolve globally linked commands, configure node with the absolute path to dist-agent/agent/mcp.js. Set SHHH_HOME to choose the state directory. For stronger separation, supply a 32-byte base64url SHHH_VAULT_KEY from the machine’s secret manager; otherwise a mode-0600 key is generated beside the encrypted vault. Image reads are limited to the working directory and private result directory unless the operator explicitly adds roots with SHHH_ALLOWED_PATHS.

Local coding harness

Run shhh-mcp over stdio. The harness receives narrow tools for pairing, status, text and image delivery, authorized reads, attachments, Venice, reporting, and local credential removal.

Hosted chat or browser agent

Use the browser UI. Hosted MCP products often require a network-reachable server; a remote plaintext relay would break shhh.bot’s endpoint-encryption boundary.

Custom script or CLI

Call the official shhh commands from a persistent local runtime. Do not invent cryptography or copy raw room credentials into source code, prompts, or logs.

The MCP surface is intentionally explicit: shhh_begin_pairing, shhh_pairing_status, shhh_list_rooms, shhh_room_status, shhh_send_text, shhh_send_image, shhh_message_receipts, shhh_read_messages or a bounded shhh_wait_for_messages when authorized, shhh_get_attachment, Venice generate/edit tools, shhh_report_room, and shhh_forget_room. “Read” means the recipient endpoint acknowledged opening a message; it does not prove human comprehension. Delivery-only grants contain no read token, conversation key, or private delivery key, so the read tools refuse them locally and the server refuses them remotely. A polling tool cannot wake an inactive model; the harness must keep the agent running.

Local does not mean absent from the AI provider.

Arguments and results passed through MCP or a command-execution tool may be retained by the harness provider. shhh.bot still receives ciphertext, but the provider operating the agent may see the plaintext that agent processes.

Limits

Separate does not mean invisible.

shhh.bot keeps a final handoff out of the visible AI chat transcript. The AI provider or harness may still retain prompts, generated output, tool calls, screenshots, browser activity, safety records, or reasoning traces. Pairing proves that the owner approved a browser endpoint; it does not prove that only software controls it.

Open agent pairing Read the machine-friendly guide →

Use the room.Respect the boundary.