KLOUDY / security
Your control, everywhere.
Kloudy is designed around scoped sessions, explicit action approval and secrets kept out of page content. The connected local browser can show an exact Blackbox action before approval, request cancellation, and stop new submissions. Stop waits for an engine acknowledgement; it does not promise that every external action can be reversed. Quantum-Vault is the separate encrypted, grant-gated store. The production direction uses operating-system randomness for keys and independent rotation. Optional quantum entropy is research and defense in depth, not a browser dependency or a deployed security guarantee. For IDEs and bots: one CLI, one MCP, tools appear when needed.
Product overview. Public-page reading and KLDY preparation are available here. The connector, account actions and native apps described below are not connected to this site.
Less setup. More useful work.
For IDEs and bots: one CLI, one MCP, tools appear when needed.
Find with SEO/GEO, read FHIR for medical data or KLDY for other information, then select one scoped Toolbox tool when action is needed.
Passive local reads use no model calls. Narrowing 100 candidate definitions to 10 would mean 90% fewer definition fetches in that example; this is an illustration, not measured token savings.
What is available here
The local browser keeps its engine credential in the trusted backend. It displays exact approvals and reports completed, failed and cancelled requests from Blackbox. The public reader has no connected vault, account login or key-export service.
Research is not a production guarantee
The shared QVault evaluation reports approximately 0.017% behavioral false positives in simulation, not validation on real traffic. Its main scanner flagged 45–49% of clean cases, so calibration remains a release requirement. A stolen final key is usable regardless of its entropy source. No quantum processor is used by this browser.
Approval follows the action
A spoken yes may confirm a pending public page read. It never approves a high-risk engine action. Connecting an MCP, sending content, spending money or changing account settings requires a separate screen confirmation of the exact action. The browser’s autonomous public-read setting cannot change Blackbox permissions.