127.0.0.1:7842 by default, so only processes running on the same machine can reach it. Within that boundary, NSP enforces three additional security layers — API key authentication, per-key rate limiting, and a tiered action safety gate — giving you fine-grained control over what agent code can read or change.
The Three Security Layers
Transport
The daemon binds to
127.0.0.1 by default. No remote process can reach port 7842. CORS controls restrict which web origins may call the API.Authentication
Every request must carry a valid
X-Substrate-Key header. Keys are stored as BLAKE3 hashes — the plaintext never touches disk.Action Safety
Every action passes through a reversibility gate.
irreversible_write actions require a verify_expression. Heuristically dangerous action names are blocked when no schema is available.Threat Model
NSP is designed for local agent use — the daemon and your agent code run on the same host. The table below maps each threat to the control that mitigates it.What NSP Does Not Protect Against
- Root or admin processes — a process with elevated privileges on the same host could read the API key from memory. Run the daemon as a low-privilege service account.
- Remote network exposure — never bind the daemon to
0.0.0.0or expose port 7842 via a firewall rule or reverse proxy without additional authentication in front of it. - Supply chain attacks — only install
axon-daemonfrom the signed Nelieo platform binaries. Verify the SHA-256 checksum published in the release notes.
Production Hardening Checklist
1
Enable API key authentication
Open
axon.toml and confirm authentication is required, then generate your first key.2
Confirm localhost-only binding
Check that
host is set to the loopback address. Change it only if you are deploying behind a hardened reverse proxy.3
Restrict CORS to known origins
Disable the wildcard CORS setting and list only the origins your dashboard or dev tooling requires.
4
Set appropriate rate limits
Tune action throughput to what your agent actually needs. Lower limits reduce blast radius if agent code misbehaves.
5
Use a persistent schema registry
Storing the registry on disk avoids a cold re-discovery on every daemon restart and gives you an audit trail of registered action schemas.
6
Rotate API keys on a schedule
Generate replacement keys before retiring old ones to avoid downtime.Then disable the old key in
axon_keys.json by setting "enabled": false. The daemon picks up the change within 5 seconds — no restart needed.Key Security Principles at a Glance
Always enable auth before connecting agent code
Always enable auth before connecting agent code
The daemon prints a loud warning every 60 seconds when
require_key = false. Treat that warning as a blocker before any production deployment. Pass the key via the NSP_API_KEY environment variable rather than hardcoding it.Use reversibility tiers as a safety contract
Use reversibility tiers as a safety contract
Every action schema declares a reversibility tier:
read, reversible_write, or irreversible_write. Treat this classification as a binding safety contract. Read-only actions carry no confidence gate; irreversible actions require both a high confidence score (≥ 0.95) and a verify_expression.Write meaningful verify_expression strings
Write meaningful verify_expression strings
A
verify_expression is your post-action assertion. Specific expressions — for example "inbox.sent_count == 15" — give you stronger guarantees than vague ones like "inbox.sent_count > 0". Always tailor the expression to the exact state change you expect.Never commit API keys to source control
Never commit API keys to source control
Store keys in environment variables, a secrets manager, or a
.env file excluded by .gitignore. The Python SDK reads NSP_API_KEY automatically if you do not pass api_key explicitly.Explore the Security Subsections
API Keys
Generate keys with
axon-daemon.exe keygen, set the X-Substrate-Key header, rotate keys, and handle 401 errors.Rate Limiting
Default limits by endpoint, the 429 response format, exponential backoff, and axon.toml configuration.
Action Safety
The three reversibility tiers, confidence gating, verify expressions, and SDK enforcement.
Daemon Authentication
Low-level daemon auth configuration, disabling auth for local dev, and environment variable overrides.