How it works & safety

Understand where commands actually run, why your AI's credential must be kept safe, and what the built-in safety gate blocks.

Before you lean on it, it’s worth two minutes to understand where your AI is and how it acts on your accounts. Once that clicks, you’ll know exactly what to keep safe.

Commands run on your own computer

PublishPort has three parts:

• Desktop app (your computer): where publishing actually happens, using your machine’s browser and logged-in accounts.
• Official server: handles auth and routing — it carries your AI’s instructions to your app, and never touches your platform passwords.
• The AI (Claude Code, Codex, OpenClaw, Cursor, Manus, WorkBuddy, and others): sends the “what to post” instructions through the official CLI or MCP, using the credential you authorized.

So content always goes out from your computer, with your accounts. Your data stays on your machine, and we never touch your platform passwords.

The credential is the key

Your AI can drive your computer because it holds a credential: the one you authorized in the browser, or an MCP address you generated. That credential’s authentication is the only gate: whoever has it can act through your machine. So:

• Only authorize requests you asked your AI to make, and check the confirmation code matches.
• Don’t paste an address or credential into public chats, screenshots, or repositories.
• If you suspect a leak, revoke it under AI access on your account page — it stops working immediately. MCP addresses can also be regenerated in the app.

The built-in safety gate

Before a cloud AI runs anything on your machine, it passes a safety gate. Two protections are on by default:

• Platform allowlist: by default your AI may only use officially supported platforms; anything off the list is refused. The “Allow platforms outside the list” toggle is off by default — turning it on carries risk, so leave it off unless you know what you’re doing.
• Cleaner environment: in Settings you can further disable background telemetry, update prompts, and sign-in nudges to keep the runtime tidy.

About account risk

Everything happens on your own computer and accounts, so it behaves like your normal activity. But platform policies keep changing, and no tool can promise you’ll never be rate-limited or restricted. Run it at a human pace: don’t fire off high-frequency bulk posts or duplicate content, and follow each platform’s rules.

Ready to go? Head back to Connect your AI. Still have questions? See the FAQ.