Know what you share. Control what runs.

Two kinds of access

Your Baltor key or OAuth connection reaches the library. Your model access stays in your own tools.

Files wait for your agent

A downloaded file is material to read. Your harness decides what runs, with the permissions you choose.

Exact bytes, every time

Each download names the SHA-256 of the exact bytes, and the service checks the body against it.

Effects need authority

A file that writes, runs commands or reaches the network says so before download, and the step declares the same effects.

Who holds it

You: one Baltor key for each tool or device, or an OAuth connection you approve in your browser.

What it reaches

Search, downloads, your usage record and billing sessions, within the scopes you allow.

Where it lives

BALTOR_SERVICE_TOKEN in your environment. The configuration names the variable.

Who holds it

You: a provider key, Ollama Cloud (https://ollama.com/v1) or an OpenAI-compatible cloud endpoint.

What it reaches

The models your harness calls for each step.

Where it lives

Your environment or an approved credential manager. A remote model receives whatever your tools send it.

Your agent decides what runs.

With the permissions you choose. A file arrives as material to read.

Search returns metadata your account may read. Fetching a body rechecks your access and the item's exact identity. A digest confirms the bytes match the reference you selected; whether they are safe, correct and useful for your task is for you and your harness to judge.

• Inspect unfamiliar code and plugins before a step uses them.

• Run them in a confined workspace with explicit file, command and network permissions.

• Give separate work separate containers. Processes in a shared container can reach one another.

Each step states what it may do with Baltor-Step-Effects. Reading files is the default; a file that declares more effects downloads once the step declares them too.

reads_fswrites_fsreads_secretnetworkspawns_process

How review works

Every item reaches your agents with a record of who approved it, against which criteria, and which checks ran.

The library serves two tiers, Verified and Community. Searches include both by default and can keep to verified items.

Library tiers

• Every admitted item has an approval record tied to its exact bytes. The record names each reviewer, its decision and its reasons.
• Reviewers judge items written by others. One written rejection keeps an item out, and the reason is recorded.
• Full review of one item takes approval from at least two reviewers from at least two model families, each from a family other than the one that wrote the item.
• An initial screen uses one calibrated, independent reviewer and written criteria: the practice is sound, claims about the cited source are true, the licence is settled and every effect on your computer is declared.
• Since October 5, 2026, a generated item is published once it passes the automated checks. Sampled review by a different model family continues after publication and withdraws what it rejects, and deliberately defective examples test the reviewer.
• Automated checks look at the licence, which must be accepted and match the item; completeness; safe instructions, where piping a download into a shell or reading a credential file fails; declared effects against the steps; credential-shaped values; and copies of other items. Material from outside sources carries a provenance record.
• Each item's evidence records which checks ran and whether independent review is complete or ongoing.
• The first 43 items were approved on September 21, 2026, before the model-family rule. Three reviewers judged 49 items, approved those 43 and rejected six; one of them shared a model family with the model that wrote the items.
• A digest proves the downloaded bytes are the approved bytes. Approval covers those bytes; installing, running and judging fit for your task stay with you.

What reaches this service

What you search for, what you request and what you choose to send.

Read the privacy notice

When you use the workspace

Your search text, the references you request and your sign-in. The service records access and usage metadata.

What you choose to send

Feedback, reports and files, through submission and upload features. Send content you have permission to provide, check its audience and retention, and leave out credentials and unrelated personal data.

What stays on your machine

Project files, model keys and execution traces. The website sends what you choose to send.

Embeddings and derived features

They can still identify their source, so treat them like the data they came from.

Current operational limits

Plan sensitive work around these facts, read from the service on October 25, 2026.

Every limit in the record

Where it runs

The capabilities record reports the runtime cloudflare-workers-d1-r2.

Availability

The service can change or be interrupted, as section 2 of the terms of service says.

Checks

The checks on this page are Baltor's own.

Sign-in and keys

Email address and password. Keys are created and revoked on your account page; keys search and download, and your account, billing and keys are managed in your account.

Before sensitive or consequential work

• Read the privacy notice for what the service stores. Privacy notice

• Set each task's permissions in your own harness.

• Keep provider credentials out of prompts and retrieved files.

• Reconcile an uncertain outcome before repeating an external action.

Checked files, your controls.

Pro: Agent Feeds + Skills and agent files, $29 a month. Cancel any time from your account page.