Creel enforces per-tool isolation — each executor runs in its own container with only the credentials it needs. The LLM never sees secrets. A compromised tool can't reach other tools' data.
| Component | Has access to | Does NOT have |
|---|---|---|
| Each executor | Only its own credential (one OAuth scope, one API key) | LLM, other tools' credentials |
| Bridge executors | Scoped HTTP token for one macOS app | LLM, other bridge endpoints |
| LLM Runner | Anthropic API key only | Any tool credentials |
| Orchestrator | All secrets, LLM output | Untrusted external input |
Input from users
Scheduler, agent loop, prompt builder, output router
4-layer safety gate — every tool call passes through here
Isolated containers
macOS native access
Claude — has Anthropic API key only, no tool credentials
Routed back through channels to you
DeBERTa/ONNX model provides instant risk scoring on every input. Catches obvious prompt injection attempts in milliseconds.
Claude Haiku performs a deeper contextual safety review. Catches subtle attacks that bypass pattern matching.
YAML-defined rules enforce your explicit constraints. Allow, review, or deny tools by pattern. Block dangerous shell commands.
Validates that the requested action matches the user's original intent. Detects drift between what was asked and what's being executed.
Each executor is a self-contained package with its own Dockerfile. In production, every one runs in an isolated container with --read-only, --cap-drop=ALL, memory/CPU limits, and a 60-second timeout.
Read and write calendar events via OAuth
Read, send, and manage email with scoped access
Read and write files in Drive
Full Google Workspace document access
Send and receive via BlueBubbles or bridge
Search, read, and create notes
Apple Reminders and Things 3 task management
Read and write macOS clipboard via bridge
Web search via Brave Search API
Playwright-based web automation
Weather forecasts with no credentials
Retrieve and parse web page content
Read and write Notion pages and databases
Issues, PRs, repos via GitHub CLI
Sandboxed command execution on mounted paths
Long-lived containerized dev environments
Run commands on the host via bridge
ElevenLabs, OpenAI, or local TTS backends