Loading
This covers the hosted site you are reading, at useagentfox.com, and nothing else. AgentFox is also software you can run yourself, and a copy you run is covered by the section at the bottom, which is the shortest one here.
Last updated 24 September 2026.
The playground needs no account. It asks for no email address, no name and no payment details, and it has nowhere to put them. When you open it, the server creates a sandbox and hands you its id: 128 bits from a cryptographic random source. That id is the sandbox’s tenant key and it is the only credential in the playground. It identifies no person.
src/nometria/gateway/playground_sessions.py:23-26, 84-89
The messages you type and the “retrieved document” you are invited to edit are sent to the server and written into your sandbox, verbatim, as conversation turns alongside the traces, decisions and findings your attacks produce. If you paste something into the playground, it is stored. Paste accordingly.
src/nometria/gateway/routes/playground.py:87-143; src/nometria/escalation.py:204-247
Every one of those rows is written under an org_id that is your sandbox id, so the same session-level tenant filter that separates two paying customers is what separates your sandbox from everyone else’s. There is no playground-specific filter that somebody has to remember.
src/nometria/gateway/playground_sessions.py:8-13; src/nometria/tenancy.py:15-24
Thirty minutes of idle time. The clock is extended on every action, so it is thirty minutes since your last request, not since you arrived. When it runs out, every row belonging to that sandbox is deleted from every table, audit entries included, which are append-only everywhere else in the product. A sandbox is also dropped early, oldest idle one first, if more than 200 are live across the whole deployment at once.
src/nometria/gateway/playground_sessions.py:57-66, 137-166, 282-286, 322-327
Two things follow from the id being the only credential. Anyone you send your sandbox link to can read that sandbox. And the id cannot be revoked before it expires.
src/nometria/gateway/playground_sessions.py:23-26
Used once, as the key for the per-address limit on how many sandboxes can be created in an hour, and held in the process’s memory for that purpose only. It is not written to the database. The request address appears exactly once in the whole server codebase, on that line.
src/nometria/gateway/routes/playground.py:49-50, 62-67
The playground is pinned to the offline provider, which is deterministic, keyless and network-free. Your prompt is never forwarded to OpenAI, Anthropic or anyone else, because nothing in a sandbox reaches the outside at all: the seeded payments.transfer and email.send tools you are encouraged to attack have no backend behind them.
src/nometria/gateway/routes/playground.py:5-8, 127; src/nometria/providers/echo.py:1-6
Signing in creates a real account and a real organisation. A GitHub identity that has not been seen before becomes a brand new organisation with you as its owner, because there is no invite flow yet, so a new person and a new tenant are the same event.
src/nometria/gateway/routes/integrations.py:116-163
Four: your GitHub numeric user id, your GitHub login, your name as GitHub reports it, and an email address. If your GitHub email is private, the primary address from GitHub’s email endpoint is used; if that is not available either, the account is created against your GitHub users.noreply.github.com address instead. That is the whole user record. There is no profile, no phone number and no billing row.
dashboard/app/api/auth/github/callback/route.ts:62-91; src/nometria/models.py:397-406
Sign-in doubles as the grant that lets AgentFox list and scan your repositories, so the GitHub access token itself is stored, encrypted with Fernet under a key held in the deployment’s environment rather than in the database. If that key is not configured, the request fails with a 503 rather than storing the token in the clear. The raw token never reaches your browser: only the org-scoped id of the connection record does.
dashboard/app/api/auth/github/callback/route.ts:97-103; src/nometria/gateway/routes/integrations.py:69-82, 181-214; src/nometria/models.py:421-434
A repository scan is static. Nothing in the scanner imports or executes the code it reads.
src/nometria/gateway/routes/integrations.py:1-9
Two, both strictly functional, both set by this site and nobody else.
nometria_session
The API token minted for you at sign-in, which is what the control plane checks on every request. httpOnly, secure, sameSite: lax, path /, and a max age of 365 days. Because it is httpOnly, no script on the page can read it.
gh_oauth_state
The one-shot value that ties your sign-in redirect back to the request that started it, so a forged callback is rejected. Deleted the moment the sign-in completes.
dashboard/app/api/auth/github/callback/route.ts:19, 34-36, 106-113; dashboard/lib/api.ts:26, 38-43
There is no consent banner because there is nothing to consent to. Your theme choice is kept in your own browser’s local storage and is never sent anywhere.
dashboard/app/layout.tsx:20-21
There are none. No product analytics, no tag manager, no session recorder, no heat maps, no error reporting service, no advertising or conversion pixel. The site’s entire runtime dependency list is Next.js, React and one font package.
Two inline scripts run, both first-party and both inspectable in page source: one line that applies your stored theme before the first paint so the page does not flash the wrong colours, and a block of application/ld+json structured data on the homepage that describes the product to search engines. The typeface is fetched at build time and served from this domain, so loading a page here sends no request to Google Fonts or to any other font host.
dashboard/package.json:12-17; dashboard/app/layout.tsx:2-6, 20-21, 226-230; dashboard/app/page.tsx:105-112
Three companies, and only these three. Each one is named because it is in the deployment, not because a template suggested it.
Vercel
Hosts both halves of this site: the dashboard you are reading and the control-plane API behind it. Everything described on this page passes through their infrastructure.
api/vercel.json; deploy/README-dashboard.md:3, 11-12
Neon
The Postgres database. Playground sandboxes, accounts, traces, findings and the audit chain all live here.
deploy/README-dashboard.md:3, 58-80
GitHub
Only if you sign in. The sign-in exchange and the profile lookup go to github.com and api.github.com, and later repository listings and scans do too. A visitor who never signs in never causes a request to GitHub.
dashboard/app/api/auth/github/callback/route.ts:46, 64-68; src/nometria/gateway/routes/integrations.py:57
The software can be configured to reach other destinations, for example a model provider, an outbound findings webhook, or an observability vendor such as LangSmith or Langfuse. Every one of those is off unless an operator turns it on, and all of them sit behind a single switch that ships in the off position. This deployment is a demonstration running on the offline provider, so none of those destinations is in use for anything described above.
src/nometria/config.py:117-119, 173-181, 360-398; nometria.toml:13-14; src/nometria/webhooks.py:97
This one deserves saying out loud, because the obvious implementation is a bad one. AgentFox detects secrets and personal data in agent traffic. If it stored what it found, the audit log would become exactly the honeypot customers are afraid of: a single table containing every card number and national insurance number that ever passed through.
So it does not. When a detector matches, what is written is the entity type, a confidence score, the start and end offsets of the match, and a sample that keeps the first four characters and masks the rest, capped at 80 characters. Four characters is enough for a human reviewing a finding to recognise what kind of thing matched. It is not enough to be the value.
src/nometria/guardrails/base.py:204-218; src/nometria/guardrails/detectors/pii.py:133; src/nometria/models.py:486-502
Separately, before anything reaches the audit chain, values under keys that look sensitive (password, secret, token, api_key, authorization, credential, private key, access key, ssn) are replaced with <redacted>, and long strings are truncated. The chain stores structure and decisions, not content.
src/nometria/audit/chain.py:67-107
The cost of that design, stated rather than hidden: there is no update or delete path for an audit entry anywhere in the codebase. That is what makes the chain worth verifying, and it is also why erasing an account is a manual operation rather than a button. See below.
src/nometria/audit/chain.py:12-19
A playground sandbox
Do nothing. Close the tab and it deletes itself thirty minutes later, rows and all. If you want it gone sooner, write to the address below with the sandbox id.
An account
Write to support@nometria.com from the address on the account, or open an issue from the GitHub account you signed in with. There is no self-service delete endpoint in the code today, so this is a person doing it by hand, which also means it is not instant. You will get a reply saying what was removed.
Just the GitHub connection
Revoking the authorisation in your GitHub settings invalidates the stored token immediately, at GitHub’s end, without waiting for us.
Questions about any of this go to the same address: support@nometria.com. It is read by the maintainer, who is one person.
Nothing on this page applies to a self-hosted install. There is no licence check, no activation call, no usage ping, no crash reporter and no telemetry of any kind, because none of that code exists to be turned off. Your agents’ traffic, your policies, your findings and your audit chain stay in your database, and we never see that they exist.
Outbound network access is one setting and it ships off. With it off, a configured webhook URL sends nothing and a configured model provider is not called. The default provider is the offline one, which is why the whole system is demonstrable with a single docker compose up and no account anywhere.
src/nometria/config.py:117-119, 360-363; nometria.toml:13-14; src/nometria/webhooks.py:97; src/nometria/providers/echo.py:1-6
This is unusual enough to be worth checking rather than believing. The source is public, the setting is one grep, and the licence permits you to fork it if you ever disagree with what it does.