Unfurl is built so there is very little to trust: it reads, it resolves locally, and it answers your agent. Here is exactly how.
Local-first.Synced data lands in a SQLite file, unfurl.db, in your working folder. Unfurl has no server of its own to send it to.
Read-only credentials.A HubSpot private-app token with read scopes only, and an optional Stripe restricted key, read-only on customers and subscriptions. Environment variables override the config file, so keys can stay out of disk.
Least privilege by design.All six tools read from the resolved graph. None can create, update, or delete anything in HubSpot or Stripe.
No open port for MCP.The MCP server talks to your agent over stdio, inside your machine. Nothing listens on the network.
Loopback-only dashboard.unfurl ui serves 127.0.0.1:4173 and refuses requests whose host is not localhost, which blocks DNS-rebinding tricks from web pages.
Prompt injection contained.A CRM note can contain text aimed at your agent. Because every Unfurl tool is read-only, that text cannot make Unfurl change your systems; answers are returned as structured data, not instructions.
Questions
Want to review it?
Ask for a walkthrough of the code paths above before you connect real data.