rendezvousEXPLICIT TRUST BOUNDARIES
What you are trusting.
Rendezvous is a working Linux preview. Automated tests and a static scan are evidence about specific behavior, not an independent security audit.
Two access gates
The host creates a temporary Tor onion service with X25519 client authorization. Knowing its onion address alone does not grant access to the SSH listener. Inside that transport, SSH authenticates the client with a random 256-bit invitation secret and verifies the host against an Ed25519 fingerprint carried in the invitation. The SSH listener binds only to loopback.
Single use, enforced on the host
The first successful SSH authentication consumes the invitation on one event loop, without an asynchronous gap between checking and claiming it. Every later authentication attempt fails, including connections opened before the winning claim. The TCP listener closes after the claim. The winning connection gets one shell or exec channel.
The Tor authorization credential is not itself a one-use credential. It can remain valid until teardown, but SSH independently refuses replay. Disconnect never reactivates the invitation. New host invocations generate new service identities and credentials.
Theft before redemption
An unused invitation is a bearer credential. Whoever redeems it first wins, whether they are your intended guest or a thief. There is no independent identity check or local approval prompt in this release. Send the invitation over a trusted channel. Once consumed, a copy found in logs cannot establish another SSH connection.
Where traffic goes
| Component | Role and trust |
|---|---|
| Cloudflare website | Serves the installer and source releases. It does not receive invitations or broker shell sessions through an application API. |
| Tor network | Carries encrypted onion-service connections. No exit node is used. Operators can observe metadata; this is not a promise of immunity to traffic analysis. |
| Host and guest machines | Trusted endpoints. Local root and the same OS user can inspect credentials, memory, files, and terminal data. |
| Agent/model provider | Commands and output an agent sends to a hosted model reach that provider. Tor does not change the agent's own data handling. |
Installation and supply chain
The shell bootstrap downloads a self-contained bundle over HTTPS and verifies its complete SHA-256 before extraction or execution. The bundle contains a pinned standalone Python runtime, hash-locked Python dependencies, Tor, and Tor's own loader and libraries. Your machine does not run a package manager or download Python packages during installation.
This does not protect against a compromised server delivering a malicious installer with a different checksum. The initial installer is a trust anchor. You also trust the bundled upstream components and our packaging. Build provenance and dependency metadata are included in the bundle, and packaging source is downloadable. The preview is not publisher-signed.
Permissions and teardown
The guest gets the launching user's full shell privileges and environment. Rendezvous is not a sandbox. Installation and operation need no root access, sudo, or system service. Files stay under the invoking user's home directory.
Normal shutdown removes temporary Tor state and kills the shell's process group. Abrupt termination can leave private temporary files. Tor is configured to exit if its owning helper disappears. File changes and deliberately detached processes are not undone by ending the session.
Verification
- Real SSH test: eight simultaneous redemptions, exactly one winner.
- Wrong host-key pin and wrong secret rejected; replay after disconnect rejected.
- Additional shell channels and TCP forwarding rejected.
- Disconnect terminates the shell process in the cleanup test.
- Real Tor integration: independent host/client Tor processes execute a command through the authorized onion service.
- Semgrep Python scan: 151 rules, zero findings in the initial runtime verification.
Both endpoints of the initial Tor test ran on one Linux machine, using the real Tor network. This is not a claim that every OS, terminal emulator, or network topology has been tested.
Website privacy
No advertising, third-party analytics scripts, remote fonts, or tracking cookies are included. Cloudflare still processes ordinary HTTP requests and may retain operational/security data under its policies. Do not put invitations in URLs. No request body endpoint exists for accepting credentials.
Application and packaging source · Bundled Tor source · libseccomp source · Third-party build information · Installation documentation