This release closes several security issues in the Agent TARS CLI server (@agent-tars/cli, @tarko/agent-server). It changes how the server can be reached, so please read Upgrading from 0.3.0 before you update.
Upgrading from 0.3.0
If you run the CLI on your own machine and open it at http://localhost, nothing changes.
Otherwise:
- The server only listens on
127.0.0.1by default. It used to listen on all network interfaces. To reach it from another machine or from outside a container, pass--host, e.g.--host 0.0.0.0. - A non-loopback
--hostrequires an access token. Set one with--auth-tokenorTARKO_AUTH_TOKEN(at least 16 characters). If you set none, a random token is generated on every start and printed with a ready-to-open?token=link, so old links stop working after a restart. Set a fixed token if you need stable links. - Domains, reverse proxies and port forwarding need
TARKO_ALLOWED_HOSTS. Requests whoseHostheader is not a loopback name, an IP address or the configured--hostare rejected with403 Invalid Host header. Add your hostname, comma-separated:TARKO_ALLOWED_HOSTS=agent.example.com. - A Web UI served from a non-localhost origin needs
TARKO_ALLOWED_ORIGINS. Otherwise creating a session fails with403 Origin not allowed. Use the full origin:TARKO_ALLOWED_ORIGINS=https://agent.example.com. agentOptionsfrom requests and URLs only acceptsagentMode. This applies to/creating?agentOptions=..., welcome cards andPOST /api/v1/sessions/create. Any other key (mcpServers,model,aioSandbox, ...) is rejected with400. Configure those on the server instead.- Direct API calls need a CSRF token. Fetch one from
GET /api/v1/csrf-tokenand send it as thex-csrf-tokenheader onPOSTrequests. When the server requires an access token, also sendAuthorization: Bearer <token>.
Example for a remote server behind a domain:
TARKO_AUTH_TOKEN=<a long random string> \
TARKO_ALLOWED_HOSTS=agent.example.com \
TARKO_ALLOWED_ORIGINS=https://agent.example.com \
agent-tars --host 0.0.0.0 --port 8888
See the CLI docs for details.
Security
- Block request-body injection into agent constructor options; the server now binds to
127.0.0.1by default (#1939) - Require an access token once the server leaves loopback (#2026)
- Validate the
Hostheader to prevent DNS rebinding (#1975) - Add CSRF protection, a CORS allowlist and security headers (#1853)
- Stop HTML previews from escaping their iframe sandbox (#1938)
Bug Fixes
- Answer a disallowed origin with 403 instead of 500 (#2044)
- Repair unterminated strings in truncated tool call JSON (#1836)
- Handle unknown model providers by defaulting to OpenAI-compatible (#1823)
- Support streaming usage on LLM responses (#1737)
Features
- Add embed-frame support for nav items (#1761)
- Optimize the session status action design (#1766)
- Set the remote browser viewport to the default viewport (#1748)
- Add
@gui-agent/cli, a CLI for GUI Agent automation (#1741)
Documentation
- Document remote access settings for the agent server (#2043)
Full Changelog: https://github.com/bytedance/UI-TARS-desktop/compare/v0.3.0...v0.3.1
