5ire

Least-privilege permissions

• Restrict credential storage: Only provide 5ire with API keys and passwords it absolutely needs for its job. Use separate, read-only credentials for each service—never share admin passwords.
• Isolate local knowledge bases: Store sensitive files (customer data, financial records, proprietary plans) in a dedicated folder with limited access, separate from general documents.
• Review MCP server permissions regularly: Before connecting a new MCP server (an external tool or service), check what data and system access it requests—disable features you don't use.
• Use role-based access: If your team shares 5ire instances, create separate user accounts with different permission levels rather than one shared admin account.

Network isolation

• Run on private networks only: Keep 5ire machines on your internal company network, not exposed to the public internet or unsecured Wi-Fi.
• Disable cloud sync for sensitive projects: Turn off automatic backup or sync to cloud services if 5ire offers it; store sensitive knowledge bases locally only.
• Audit MCP server sources: Only connect to MCP servers from trusted vendors you recognize. Verify the source before installing—avoid random or unverified third-party servers.
• Use a VPN or firewall: Ensure outgoing data from 5ire goes through your company's security controls (VPN, firewall) to prevent direct communication with unknown external services.

Monitoring

• Log all data access: Enable logging on 5ire to record which files, credentials, and services are being used, and when. Review logs weekly for unusual activity.
• Track credential usage: Monitor which API keys and passwords 5ire accesses. Alert if old or disabled credentials suddenly get used.
• Watch for data exfiltration: Monitor network traffic from 5ire machines to detect unexpected outbound connections to unfamiliar IP addresses or services.
• Set up alerts for updates: Since 5ire has low adoption, security patches may come slowly. Subscribe to security notifications and test updates promptly in a test environment first.

Red flags to watch for

• Unexpected prompts or behavior changes: If 5ire suddenly asks for credentials it didn't before, or behaves differently, it may have been compromised via a malicious MCP server or knowledge base entry.
• Slow performance or unusual network activity: Slowdowns, high disk use, or unexpected network connections could indicate data theft or a compromised process running in the background.
• Missing or altered files in knowledge bases: Tampering with local documents (especially without your action) suggests an attacker has write access to your system.
• Credentials appearing in logs or chat history: If passwords, API keys, or sensitive data show up in readable logs, output, or chat transcripts, treat as a data breach and rotate those credentials immediately.