TaskTime Pro

TaskTime Pro local agent bridge

TaskTime Pro Agent Security Model

How TaskTime Pro protects local-first task, time, expense, invoice, export, sync, and account data when an AI agent uses the local MCP bridge.

Local-Only Access

The TaskTime Pro local agent bridge binds to loopback hosts such as 127.0.0.1, localhost, and ::1. It is not a public API, not a cloud relay, and not a remote device control surface. Agent hosts should not tunnel it or expose it on public interfaces.

Browser App As Mutation Owner

The bridge forwards commands to the paired TaskTime Pro browser app. It does not open IndexedDB, does not parse Yjs documents, and does not write raw storage patches. This preserves the same validation, persistence, sync, invoice, and deletion rules used by the normal UI.

Pairing And Revocation

  • Pairing requires a bridge endpoint, pairing ID, and pairing code shown by the local bridge.
  • The pairing code is time-limited, single-use, and should be treated as a local secret.
  • Managed bridges should provide a stable agent identity, such as tasktime.agent.openclaw, so trust is not tied to a random localhost port.
  • App sessions default to normal work-session length; pairing codes remain short so copied setup URLs are not useful long-term.
  • The bearer token is stored only in bridge memory and the current tab's sessionStorage; it never enters durable browser, Yjs, or cloud-provider storage.
  • Same-profile reopen uses a dedicated IndexedDB store containing a non-exportable sign-only P-256 key and non-secret metadata. The live bridge retains only the public authorization in memory.
  • Reconnect challenges are short-lived, single-use, origin-bound, bridge-instance-bound, and consumed before verification to prevent replay.
  • Trusted chat approvals default to until revoked for stable same-device agents, with shorter choices available for users who prefer them.
  • Trusted chat approval duration is separate from bridge connection lifetime.
  • Account > Agent Access shows paired status, scopes, current activity, and local activity history.
  • The user can disconnect or revoke local agent access without clearing TaskTime Pro data.

Scopes

The default bridge scopes are read, write, and navigation. Optional scopes include billing, export, and email. Tools are listed only when their required scopes are granted, and command execution still checks permissions in the app session.

Scope Typical access
read List records, inspect summaries, preview work, and read status.
write Create and update non-billing app data such as tasks, projects, clients, timers, and expenses.
navigation Open app views in the paired browser session for user review.
billing Finalize invoices, cancel eligible unpaid invoices, mark payment status, undo invoices, and run billing-sensitive workflows.
export Start browser downloads for invoice PDFs, reports, accountant packs, and backup JSON.
email Send invoice and project quote email through the existing browser and Worker flow.

Approval-Gated Actions

Destructive, billing, restore, email, export-adjacent, sync, and account-data commands can require explicit confirmation plus TaskTime Pro approval. A trusted local approval token can satisfy that gate only when a trusted local grant exists, the token matches the exact command input hash, and the browser app verifies it. Stable same-device grants can remain trusted until revoked; users can revoke grants from Account > Agent Access. Otherwise, TaskTime Pro shows the visible browser approval prompt.

Without a valid approval token, the app falls back to the normal visible approval prompt and fails closed if approval is denied, interrupted, stale, replayed, under-scoped, or revoked.

Data Returned Through The Bridge

Tool responses return structured status and result data. Browser-only exports and downloads return metadata such as filename, section, counts, and completion state rather than raw PDF, ZIP, CSV, or backup contents through the bridge.