Security and execution
Assume the model can be wrong or adversarially steered. Oracle keeps proposal separate from authorization and verifies the boundaries in code.
- Hosted and keyless Oracle prepares unsigned artifacts.
- Self-hosting does not automatically enable signing.
- Empty allowlists refuse rather than widening access.
Three planes
The public import boundary is checked by tests. Hosted and keyless Oracle prepares unsigned artifacts. Self-hosting does not automatically enable signing.
Grants and confirmation
A grant is authorization. A prompt is not. Live grants bind chain, surface, action, destination, value, expiry, and other action-specific limits. Empty allowlists refuse rather than widening access.
- One exact action cannot be silently reused for another destination or calldata
- Policy is rechecked near sign and broadcast time
- Slippage input is a maximum, not permission to widen automatically
- Disarm and revoke remain dominant
Optional self-hosted local signer
The optional self-hosted local signer uses an encrypted vault, sealed policy, loopback-only service, and one-use confirmation. It stays inert until the owner initializes it.
oracle sign init
oracle sign import --key-file /protected/key --passphrase-file /protected/passphrase
oracle sign policy --policy-file /protected/policy.json
oracle sign doctor
oracle signer --credential-service oracle-local-signer --session-seconds 120
oracle sign lockUse hidden terminal entry or owner-only files. Do not place a key, passphrase, signer token, bot token, or provider credential in chat or argv.
Autonomous trading
Unattended trading is a separate opt-in for trusted self-hosted code. It requires ORACLE_AUTONOMOUS_TRADING=1, compatible policy mode, and a verified trigger attestation. The environment flag alone does not bypass local policy or grant bounds.
Receipt proof
Broadcast acceptance is not success. Oracle reports success only when a transaction hash and a successful receipt are coherent with the prepared artifact and observed chain state. Missing finality or balance evidence stays unknown.
Secret handling
- Hosted surfaces do not accept wallet keys
- Local vault material stays on the self-hosted machine
- Provider status commands do not print credentials
- Secret-shaped fields are rejected or redacted from model context and logs
- Public HTTP services bind to loopback by default and need a controlled admission layer before hosted exposure
Server credentials in 0.36.0
Public and hosted requests spend no server keys by default. The operator can opt in named providers with ORACLE_PUBLIC_ALLOW_SERVER_KEY_PROVIDERS, a comma-separated, whitespace-trimmed, case-sensitive list of canonical IDs. Empty is the default; there is no wildcard grant.
The legacy MAD_PUBLIC_ALLOW_SERVER_KEY_PROVIDERS is read only when the Oracle variable is unset or exactly empty. Any other Oracle value takes precedence, even whitespace or commas only, which then grants nothing. Source: credential sink rules (packages/oracle/src/data/http.mjs, revision 12f21dd5).
| Request alias | Canonical opt-in ID |
|---|---|
| 0x | zerox |
| 1inch | oneinch |
| opensea | opensea-nft |
| magiceden | magiceden-sol |
Aliases still normalize on requests, but alias entries in the operator list are refused with the canonical replacement; independent valid entries remain effective.
Voice uses openai or elevenlabs; watched portfolio RPC overrides use evm-rpc. An aggregator grant does not cover its dependencies. Sources: credential sink rules (packages/oracle/src/data/http.mjs, revision 12f21dd5), CHANGELOG (CHANGELOG.md, this source tree).
oracle public serve and the public MCP handler always apply the public allowlist policy, regardless of public-mode environment flags. Setting ORACLE_PUBLIC_ALLOW_SERVER_KEY_PROVIDERS therefore means unauthenticated callers of those surfaces can spend the listed providers' server keys; that is the operator's opt-in.
Verified local CLI/stdio owner entry points and authenticated local HTTP/app requests retain credential access. On local owner surfaces (CLI, desk, app and charts) outside public/hosted mode, an anonymous local request needs owner authentication to spend server credentials; the allowlist does not grant it there.
Missing request scope is anonymous, and HTTP listeners discard launcher authority. Public/hosted mode requires operator opt-in even with owner tokens. Existing authentication, origin checks, caps and operation restrictions still apply.
Sources: credential sink rules (packages/oracle/src/data/http.mjs, revision 12f21dd5), app authority (apps/oracle-app/lib/oracle/swap-server-keys.ts, revision 12f21dd5), public HTTP authority (packages/oracle/src/public-api/http.mjs, revision 12f21dd5), public MCP handler (packages/oracle/bin/oracle-data-mcp.mjs, revision 12f21dd5).
A configured endpoint may contain credentials in its host, path or query. Without authority, Oracle uses a reviewed built-in public default or refuses before upstream work.
Even a keyless private/loopback endpoint can fall back to a third party, exposing requested addresses there. Authenticate as local owner to retain the configured endpoint. Source: credential sink rules (packages/oracle/src/data/http.mjs, revision 12f21dd5), CHANGELOG (CHANGELOG.md, this source tree).