01Loopback only
The server binds 127.0.0.1. Nothing on your network can reach it, and there is no setting to change that. Don't put a proxy or a tunnel in front of it.
02A token on every request
48 hex characters from the system's random source, stored in a file only your user can read. The login link trades it for an HttpOnly, SameSite=Strict cookie, and the server compares it in constant time.
03Host and Origin checks
Every request must name 127.0.0.1:7777 or localhost:7777 as its Host. Writes and WebSocket upgrades must also carry a matching Origin. A page in another tab, or a DNS-rebinding trick, gets a 403.
04The desktop app adds no surface
It loads only the local page, opens other links in your default browser, and runs the page sandboxed with context isolation and no Node. It sets the login cookie from the token file, so the token never goes in a URL.
05Agents run unattended
That's the point of the tool, and it's also why you should treat every prompt you send as something that will be acted on. Each tool starts like this:
| Tool | Started as |
|---|---|
| Claude Code | claude --permission-mode auto --remote-control |
| Codex | codex --approve-for-me, in its workspace sandbox with network on and your work root writable |
| agy | agy --mode auto --remote-control |
06Where its files live
The token file, the login link, settings and uploads sit in one config folder in your home directory, created readable by you only. Never commit or paste anything from it. Overvibe never deletes a session or a transcript: Stop keeps the conversation and Hide only takes a row off the list.
07What it sends out
Overvibe has no server of its own and nothing to sign up for. The agents talk to their own providers exactly as they do in Terminal.
Questions
Can I open it from my phone or another machine?
No. It listens on 127.0.0.1 and checks Host on every request. Claude Code's Remote Control is the way to follow a Claude session from your phone.
What happens to my sessions if the server restarts?
Nothing. They live on Overvibe's own tmux server, which outlives the web server. Reload the page and they are all there.
Does it work on Linux or Windows?
It is built and used on macOS only. Dropped files are found with Spotlight, the desktop build makes a Mac app, and the tmux path defaults to Homebrew's.