PromptZero

What it is

PromptZero is a natural-language operator for the Flipper Zero (plus optional ESP32 Marauder), installed on Linux/macOS via a piped installer and driven by an Anthropic API key. Beyond the summary's capability list, the README documents its actual security posture — the exact thresholds and environment variables that gate (and un-gate) dangerous tools — which is what matters if you're deciding whether to run or allow it.

How it works

Three surfaces, each with its own safety boundary:

• CLI/REPL — --read-only refuses any tool that writes, transmits, or executes; concretely, anything risk-Medium or above is refused at the boundary, while reads/scans/queries still dispatch.
• Web UI on http://localhost:8080 — chat, live Flipper viewport, file browser, audit log. Auth is a shared token; the browser reads #token=… from the URL fragment on first load and caches it in sessionStorage.
• MCP server (--mcp, stdio) for Claude Desktop/Code — Risk-High and Risk-Critical tools are refused by default.

Preconditions / Affected

Requires modded Flipper firmware (Momentum / Unleashed / RogueMaster), an Anthropic API key, and USB (or BLE). The web server speaks plain HTTP only — TLS must be terminated at a reverse proxy (Caddy/Traefik/nginx) or a Tailscale/Cloudflare tunnel. Health endpoints GET /healthz and GET /readyz are unauthenticated by design for headless/k8s deployment.

What to do

If you deploy this, note the escape hatches that disable the safety rails — they exist and are one env var each:

PROMPTZERO_MCP_ALLOW_HIGH=1       # re-enables Risk-High tools over MCP
PROMPTZERO_MCP_ALLOW_CRITICAL=1   # re-enables Risk-Critical tools over MCP

For blue-team/forensics/training use, run the safe mode:

promptzero --read-only

Set an auth token for the web UI before exposing it beyond loopback (an empty token on a non-loopback bind only prints a red warning — it does not block):

export PROMPTZERO_WEB_TOKEN=...   # or web.token in config

Install is pinned to immutable per-tag release artifacts; container images at ghcr.io/xunholy/promptzero are distroless, signed, and ship SBOM + provenance if you prefer that over the piped installer.

Caveats

The project states it is under active development — "APIs and tools change between minor versions" — and the tool count grows release-over-release, so the risk-tier mapping any given tool falls under is not stable. The maintainer explicitly warns to review generated payloads before deployment; the whole thing is built end-to-end with Claude, so payload correctness is not independently vetted.