Monorch
Security
Library in your process. No Monorch cloud.
We do not host your prompts, tools, or customer data. MIT license. Private disclosure for vulnerabilities.
License
MIT.
Use, modify, and distribute under the LICENSE in the repository.
- No Monorch cloud
- There is no hosted control plane. Model HTTP, checkpointers, and memory stay in your infrastructure.
- Secrets stay yours
- API keys and DB URLs are your env. Providers read keys you pass; the engine does not phone home.
- Native + MCP + Postgres
- Trust npm provenance for .node binaries. mcpStdio spawns your command; mcpHttp trusts your URL/headers. Postgres adapters use parameterized SQL and safe table-name checks.
- Dependencies
- Review @monorch/ai, @monorch/runtime, and optional pg / MCP SDK peers like any other Node library.
Reporting
Prefer private channels for security issues.
Prefer private vulnerability reporting on GitHub. See SECURITY.md for scope, threat model (native load, MCP spawn/HTTP, Postgres), and response expectations. Use Discussions for non-sensitive questions.
Related: Platforms · Error codes · Upgrade guide · RC checklist