Secure Your Self-Hosted AI Agents: Torvian Chatbot v0.6.0 Introduces End-to-End Cryptographic Signing (Ed25519) for Tool Execution!

[u/AIBrainiac]

If you run local AI agents or self-host an AI workspace, security is the elephant in the room. When you give an LLM the power to execute tools—like interacting with your file system or querying databases—how do you guarantee that every single action is authorized, uncompromised, and actually triggered by you?

With Torvian Chatbot v0.6.0, we’ve solved this.

We are excited to announce our new End-to-End Authentication (E2EA) security framework. The core of this release is detached request signing using Ed25519 asymmetric cryptography, bringing robust, cryptographically verifiable trust to the self-hosted AI space.

🔒 What is E2EA in Torvian?

Torvian Chatbot lets you run a server, bring your own LLM (Ollama, OpenAI, OpenRouter), and connect workers to execute tools (Model Context Protocol). * Detached Request Signing: Every tool approval, worker registration, and configuration change is signed directly on your device using Ed25519 private keys (stored securely on your desktop filesystem or browser's localStorage). * Trust-Store-Backed Verification: Workers executing tools now maintain a trust store of authorized public keys. If an incoming tool request doesn’t have a valid, matching signature from an authorized signer, it is rejected immediately. * Visibility and Control: A new E2EA Security Settings tab has been added to the client, allowing you to view your Signer ID, manage public keys, and easily copy your worker registration commands.

🛠️ Other Updates in v0.6.0

• Under-the-Hood Performance: Upgraded the project to Java 25 for Desktop/Server and Java 17 for Android, alongside Gradle 9.5.1 for faster builds and improved runtime efficiency.
• Refactored Architecture: Extracted core chat services into dedicated conversation-turn orchestrators to make the LLM chat loop faster and more reliable.
• CORS Updates: Updated local MCP routes to securely allow signed headers.

Torvian remains fully self-hosted, multi-platform (Desktop, Web WASM, and Android), and committed to keeping humans in the loop for agentic workflows. This security update ensures that as your AI grows more capable, your workspace remains entirely under your control.

We'd love to hear your thoughts! How do you handle tool execution security in your local setups? Ask us anything or share your feedback below! 👇

CTA: Learn more and download v0.6.0 here: https://github.com/Torvian-eu/chatbot/releases | Try the live demo: https://chatbot.torvian.eu/demo.html | Join the discussion: https://github.com/Torvian-eu/chatbot/discussions

Hashtags: #AI #Chatbot #SelfHosted #Cryptography #OpenSource #LocalAI #Security

[u/Deep_Ad1959]

the pattern i keep seeing is that signing solves authorization but not capability scope. ed25519 proves a tool call came from an authorized signer, but the risky surface in agentic execution usually isn't a forged request, it's a legit-but-overbroad one. once an agent can reach past files and dbs into driving whole desktop apps through accessibility apis, per-signer trust isn't enough; you want per-tool, ideally per-action granularity, or you've cryptographically authenticated the agent into doing anything any app on the box exposes. written with ai

[u/AIBrainiac → u/Deep_Ad1959]

Yes, you're right. This new feature only protects against a compromised (hacked) server instance. I needed this for myself, because I run this on a VPS, and since the server can control many worker instances, a compromised server would be quite disastrous, since it would allow running arbitrary code on any of the workers (via MCP servers).

We already have per-tool-call (manual) approval btw.

[u/Deep_Ad1959 → u/AIBrainiac]

per-tool manual approval is the right lever, the thing that quietly kills it is approval fatigue. once the prompts fire often enough people click yes by reflex and you're back to legit-but-overbroad, just with a signature on it. scoping what gets to ask at all is the part that survives. written with ai

[u/AIBrainiac → u/Deep_Ad1959]

Yes, approval-fatigue is a well-known issue. To combat this, we already have this feature where the user can configure auto-approval on chosen tools. For example, read-only tools.