Security

What lnk-claude installs and runs, beyond what Link's sandbox guarantees every harness (Agents Security).

What it installs

Node from nodejs.org, checked against the SHA-256 in its source, and @agentclientprotocol/claude-agent-acp from npm at its pinned version. npm resolves that package's own dependencies, Claude Code's among them, when it installs: they aren't pinned by Link.

What it runs

lnk-claude serve, and behind it one claude-agent-acp on that Node, in Link's sandbox. Claude Code there runs any command its model asks for, without asking: the sandbox bounds what that reaches.

Its keys

The model's key and the endpoint's are in .lnk/claude/link.env, mode 600, and the model's reaches Claude Code in its environment, never on a command line. With the key held by Link's proxy, the file holds a placeholder.

What it sends Anthropic

The model's requests, to the address Link gives it. Its updates and its other traffic to Anthropic, telemetry and error reports among it, are off in its settings.