> For the complete documentation index, see [llms.txt](https://wayfinder-1.gitbook.io/wayfinder/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wayfinder-1.gitbook.io/wayfinder/sdk-concepts/safety.md).

# Safety & Permissions

> **Applies to both the Wayfinder app and the SDK.** The app enforces permissions through wallet-level controls you set at provisioning. The SDK adds its own safety layers described below.

The MCP server can move real money. This page explains the safety layers -- read-only tools, tool confirmations, review hooks, and key handling -- that keep you in control.

## 1) Prefer read-only tools first

Read tools are safe for exploration:

* `core_get_adapters_and_strategies`
* `core_get_wallets`
* `onchain_resolve_token`
* `hyperliquid_get_state`
* `polymarket_get_state`

Start by inspecting state, then move to write tools only when you're ready to execute.

## 2) Write tools can move funds

These tools execute real actions (swaps, transfers, orders, strategy actions):

* `onchain_swap` / `onchain_send`
* `hyperliquid_place_market_order` and the other `hyperliquid_*` write tools
* `polymarket_place_market_order` and the other `polymarket_*` write tools
* `core_run_strategy`
* `core_run_script`

## 3) Agent confirmations + review hooks

Each coding agent has its own permission model. For example, the SDK ships with `.claude/settings.json` (Claude Code-specific) to:

* automatically allow safe reads
* require confirmation for fund-moving tools
* run pre-tool review hooks that show a human-readable preview (recipient, chain, amounts, script excerpt)

Other agents (Codex, Opencode) enforce similar safety boundaries through their own configuration. If you remove these protections, you are responsible for reviewing every call.

Additional safety defaults:

* **Secret guard:** blocks writing common private key / seed phrase formats into files
* **Runs write guard:** keeps `.wayfinder_runs/` clean by steering ad-hoc scripts into scratch and long-lived scripts into the library

## 4) Private key handling

How transactions get signed depends on where you run:

* **Wayfinder app (remote signing):** wallets are remote, Privy-managed server wallets. The agent requests a signature for each transaction and never sees the private key — it stays with the signing service and is signed server-side within the wallet's policy. Because no key lives in the runtime, unattended automation like [scheduled jobs](/wayfinder/shells/scheduled-jobs.md) has nothing to leak or misuse. Both legs of a wallet are covered: the Solana address is custodied and signed the same way as the EVM one, never client-side.
* **Wayfinder app (imported wallet):** if you [bring your own wallet](/wayfinder/shells/getting-started.md) at provisioning, the private key is encrypted in your browser and only the ciphertext reaches Wayfinder. The signing service decrypts it and imports it into the same remote signer, so your existing address gets the same treatment as a generated one — the agent still never holds the raw key.
* **SDK (local signing):** wallets are loaded from `config.json` (`wallets[]`), and fund-moving tools sign locally with each wallet's `private_key_hex` (see [Configuration](/wayfinder/sdk-setup/configuration.md)). Key custody is yours.

In both models, private keys are never returned by MCP tools and never sent to Wayfinder services.

### Signing sessions expire

Remote signing runs against a trading session with a time limit. When it lapses, the signing service stops authorizing transactions — including gas-sponsored ones, which take a different path than a normal signature request.

On every transaction path, the agent says the session expired and needs renewing instead of returning a raw HTTP error. Renew it in the Wayfinder app ([wayfinder.ai/app/shells](https://wayfinder.ai/app/shells)), confirm it's active, and retry. Nothing was broadcast in the meantime, so there's no half-finished transaction to clean up.

## 5) Best practices

* Use dedicated wallets per strategy (labels match strategy directories)
* Start with small amounts
* Always verify `recipient`, `chain_id`, and token selection before executing
* Use `onchain_quote_swap` before `onchain_swap` for swaps
* Keep `config.json` out of version control
* Never paste secrets into agent prompts — edit `config.json` directly