# Privacy And Security (/docs/privacy-security)



RadioCLI does not require secrets or accounts.

## Local Agent Control [#local-agent-control]

Agent control is opt-in. Its MCP transport is stdio, and active playback uses a
short-lived authenticated HTTP endpoint bound only to `127.0.0.1`. The random
bearer token and port are stored in a user-private runtime file. Requests are
serialized, stale discovery records are removed, and a single-owner lock keeps
two local agents from starting competing players. The endpoint is not exposed
to the LAN or internet.

MCP and `radiocli agent` can play only stations saved by RadioCLI or opaque IDs
returned by its search and browse operations. The agent interface does not
accept arbitrary stream URLs. Alarm controls use a separate authenticated
session namespace and are never called by ordinary agent playback tools.

Agent-started playback opens a separate RadioCLI terminal TUI by default on
macOS, Windows, and Linux. On macOS, this can make the agent host request Apple's
one-time Automation permission for Terminal; RadioCLI cannot grant another app's
OS permission. Headless playback is an explicit opt-out for users who do not want
external terminal windows or app-control prompts.

## Privacy Notes [#privacy-notes]

* Nearby location is enabled by default for new libraries, but no location
  request is made until you open Nearby.
* Location lookup uses approximate IP-based location from `ipapi.co`. Disable it
  with `l`, Settings, or `:location off`.
* Explore uses only the cursor coordinate you move in the terminal.
* Recents, favorites, settings, imports, listening activity, alarm definitions,
  and provider cache data are stored locally on your machine.
* RadioCLI does not proxy audio. It resolves public stream URLs and hands playback
  to `mpv`, `ffplay`, or the experimental macOS AirPlay worker.
* AirPlay discovery uses Bonjour on your local network. AirPlay streaming runs
  through a local worker and the bundled sender bridge.
* Favoriting a Radio Browser station sends a best-effort vote to that public
  directory by default. Disable **Share favorite votes with Radio Browser** in
  Settings to keep favorites local-only.

## Alarm Data And Local Control [#alarm-data-and-local-control]

Alarm scheduling does not use a RadioCLI account, hosted scheduler, push service,
or cloud relay. Definitions, station choices, reliability settings, snooze
override, and the latest run result live in the JSON library and are included in
a full RadioCLI JSON backup.

The following state is deliberately machine-local and excluded from backups:

* launchd, systemd, or Windows Task Scheduler registration artifacts
* scheduler and power-inhibitor health records
* Alarm Guard process/lease state and occurrence locks
* active-alarm discovery files and their random bearer tokens

After restoring a backup on another machine, run `radiocli alarm sync` to create
that machine's native jobs. Alarm playback resolves the configured public station
and connects to its stream just like normal playback; RadioCLI does not upload
the alarm or proxy its audio.

While an alarm is playing, the detached runner opens an HTTP control endpoint on
`127.0.0.1` only. Discovery files and 32-byte random bearer tokens use private
machine-local storage permissions where the OS supports POSIX modes. Dismiss,
snooze, keep-playing, and Guard ownership requests must authenticate; there is no
network-facing control server. The detached runner may open the locally saved
terminal emulator to expose those controls. It does not pass the bearer token on
the command line; the TUI discovers it through the private machine-local file.

## Location Lookup [#location-lookup]

Nearby stations are useful, but IP-based location lookup is privacy-sensitive.
For new libraries the feature is on, and opening Nearby requests an approximate
location from `ipapi.co`. RadioCLI uses the returned city, region, country,
latitude, and longitude to sort the local geotagged station atlas. Turn it off
before opening Nearby with Settings or `:location off` if you do not want that
request; the choice is stored locally.

## Reporting Security Issues [#reporting-security-issues]

Open a private security advisory on GitHub:

```text
https://github.com/Ciphore/RadioCLI/security/advisories
```

Please avoid filing public issues for vulnerabilities that could expose local
files, private network information, or unexpected command execution.

If private reporting is unavailable, open a minimal public issue asking for a
private disclosure path, but do not include exploit details.

## Supported Versions [#supported-versions]

Until a tagged release cadence is established, security fixes target the active
development branch and the latest public npm release.

Related reading: [Reliability](./reliability.mdx) and
[Contributing](./contributing.mdx).