Security and privacy
ASTra is built to handle documents you did not write, on behalf of tools you do not fully control. This page says what it restricts, what it can remove from a document, and what data goes where.
What leaves your machine
- The engine, command-line tool and MCP server run locally and send nothing anywhere. They contain no analytics or telemetry.
- Your AI assistant is a separate party. When an assistant such as Claude Desktop or Cursor calls an ASTra tool, the result (for example the document outline or text) goes to whichever AI model that assistant uses, under that provider's terms. Connect only the folders and documents you are comfortable sharing with that assistant.
Folder boundary
The MCP server reads and writes only inside the folders you give it with --allowed-dir (it can be repeated). Paths are resolved to their real location before use, so ../ tricks and symbolic links that point outside the allowed folders are refused with E_SANDBOX. Creating a document never overwrites an existing file unless you say so.
Hostile documents
A .docx file can be crafted to attack the program that opens it. ASTra defends against the common cases:
- Archive tricks. Documents are processed in memory and never unpacked to disk, so a file with malicious paths cannot write elsewhere. Entry paths that try to escape are rejected.
- Zip bombs. By default a document is refused if it expands by more than 100 times or beyond 200 MB. Both limits can be changed with
--max-ratioand--max-uncompressed-bytes. - XML attacks. Parts that declare external entities or document types are rejected before parsing.
- Active content in images. Scripts and event handlers are stripped from embedded SVG images.
- Links. External links are limited to
http,https,mailtoandftp;file:links are blocked.
These are protections for a trusted tool handling untrusted files. They are not a substitute for running ASTra with limited operating-system permissions (for example in a container) when you process files from strangers at scale.
Removing identifying information
astra sanitize (and the sanitize_document tool) removes information that can reveal who wrote a document and how:
- Author and last-modified-by names in the properties, comments and revisions.
- The hidden editing-session identifiers Word stores on text.
- Comments, and optionally tracked changes (accepted).
- Camera and location metadata in embedded PNG and JPEG images.
- With
--client-safeor--redact-pii: telephone numbers, email addresses, US social security numbers and credit card numbers in the text. Other personal data, such as names and street addresses, is not detected.
Sanitizing lowers what a document reveals; it does not replace reading the final file before you send it.
Reporting a vulnerability
Please do not open a public issue. Follow the instructions in SECURITY.md.