marimo

marimo's assistant acts with the full authority of the person who started marimo. Code the agent writes or runs executes in the notebook kernel, a child process of the server running as the same OS user that also receives the unmasked marimo configuration (including AI provider keys), and MCP servers are started with a copy of the whole environment. There is no dedicated identity, no scoped credential and no per-tool authorization layer; the only check is the server's login token, which identifies the human user, not what the agent may do. A hijacked session therefore has every file, credential and network path the user has.

There is no approval step for any assistant action. In Agent mode the model's edits are applied to cells and its run_stale_cells tool then executes those edited cells immediately; in Code Mode the execute_code tool runs arbitrary Python in the kernel; MCP tools are invoked directly by the server. Tool calls are executed as soon as the model emits them and the chat automatically sends the result back for the next step. Edited and deleted cells are kept as 'staged' changes with the previous code so the user can reject them afterwards, but by then the code has already run.

The agent's main tools are general-purpose: Code Mode's execute_code takes any Python string, and Agent mode can write any cell and then run it. The read-only backend tools have typed arguments that are parsed before use, but that does not constrain the code-execution paths, and MCP tool arguments are only checked by the MCP server itself. The shipped default chat mode is Manual with no tools, but the 'Fix with AI' button silently switches the chat to Code Mode and saves that choice, and a project's pyproject.toml can set the mode too.

Model-generated code runs directly in the notebook's Python kernel, which is a normal child process on the host running as the user. There is no container, OS sandbox or restricted interpreter for AI-driven execution; the 30-second timeout and interrupt only bound how long the server waits. The kernel has the user's home directory, environment credentials, the marimo config with API keys, and unrestricted network. MCP stdio servers are likewise host processes.

Nothing limits what a prompt-injected assistant can do. The notebook's code (which may come from a shared or downloaded notebook) is placed in the system prompt, cell outputs from whatever data the notebook loads, MCP tool results and, when web search is turned on, fetched web pages all reach the model with the same standing as the user. The same session can then run arbitrary code with network access and the user's credentials, so an attacker can both steal data and take irreversible actions without any human step.

marimo has no agent memory store, but its configuration travels with projects. The nearest pyproject.toml's [tool.marimo] section overrides the user's own settings with only signing and cache-verification keys removed, so a cloned repository can add MCP servers whose commands marimo launches at startup, point the AI provider at its own base URL, set the chat mode or inject custom rules into every prompt, with no trust prompt. A .marimo.toml found by walking up from the working directory is loaded as the user's config. marimo does block AI and MCP settings in a notebook's own inline script header, which shows the maintainers recognise the risk.

marimo can launch MCP servers as local commands or connect to remote ones, with no pinning, hashes or change detection, and project config can add them silently. In Code Mode the model can install packages from the package index with a single call and no confirmation, and package installs run third-party install code. MCP stdio servers run as separate processes but receive a full copy of the user's environment.

AI provider keys live in the user's marimo TOML config (or are read from environment variables) and are masked before the config is sent to the browser. But the kernel, where agent-written code runs, is handed the configuration with secrets unmasked, and it inherits the full environment; Code Mode additionally places the marimo server's auth token into the kernel request. There is no redaction of tool results before they go to the model. marimo ships no third-party telemetry and AI tracing is off unless MARIMO_TRACING is set.

The only record of what the assistant did is the chat transcript, which the browser saves to its local storage with every tool call's arguments and results once a response finishes. The server does not log successful tool calls or executed code, and OpenTelemetry tracing is opt-in. The transcript lives in the user's browser profile, can be deleted from the UI, and is written only when a turn completes, so a crash mid-run can lose it; code that agent-run cells spawn is not recorded at all.

marimo sets no step, time or cost budget for the assistant. Each code-mode execution is waited on for 30 seconds and then interrupted, and MCP calls time out after 30 seconds by default, but in Agent mode the chat automatically sends a new request after every tool result with no cap, and max_tokens is unset unless configured. Stopping the chat ends the stream, and in Code Mode cancels and interrupts the kernel, but processes or threads started by that code keep running, and cells started by run_stale_cells continue.