What a grant covers
Development reference · View source
Grants cover unsaved content and possibly sensitive terminal output. They belong to the canonical project root and the MCP identity, so a clone, a nested workspace, or another identity needs its own grant.
Where grants are stored: outside the project, in the account’s Runyte cache.
| Platform | Location |
|---|---|
| Linux | ~/.cache/runyte/context |
| macOS | ~/Library/Caches/runyte/context |
| Windows | runyte\context below the account’s LocalAppData known folder, resolved by the operating system rather than the inherited %LOCALAPPDATA% |
RUNYTE_CONTEXT_HOMEcan select an absolute, owner-private directory outside the workspace. On Windows its parent must exist and the storage must be local NTFS; Runyte applies an owner-only ACL and refuses reparse or hardlink traversal. On Unix it can also shorten a path to fit the local socket limit.- No credentials or terminal content are written into tracked project context.
- This is permission for Runyte’s API, not an operating-system sandbox against other processes already running as you.