Security

API keys

Provider credentials are stored in the operating system’s credential store: macOS Keychain and Windows Credential Manager. They are not stored in localStorage and are not written into project files.

Linux

Myko uses the Secret Service (GNOME Keyring or KWallet over D-Bus) when one is reachable, and moves keys it previously kept in a file into it the first time they are read.

Fallback is not encrypted. If no Secret Service is available (headless sessions, minimal window managers, a missing or locked daemon), Myko falls back to a JSON file in the app’s local data directory, readable only by your user (mode 0600). Treat it like an SSH private key: anyone who can read your home directory as your user can read it.

AI permissions

AI tools can be configured with specific capabilities. Potentially destructive operations such as shell commands can require approval depending on configuration. Database writes require explicit confirmation, and database connections are read-only by default.

Accounts and telemetry

Myko does not require an application account and includes no application telemetry. AI requests go to the provider or local endpoint you configure.

Unsigned Windows builds

Current Windows builds are unsigned, so SmartScreen may warn. Only download Myko from this website’s download page.