AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
mobilecritical PriorityID: tauri-v2-mobile-capability-ipc-security-manifest

Tauri 2.0 Declarative Mobile Capability Manifest & IPC Permission Boundary Enforcement

Enforces strict, least-privilege capability manifests in Tauri 2.0 mobile applications (iOS and Android). Prevents cross-webview privilege escalation and unauthorized native OS plugin invocation by binding explicit command sets and native scope constraints to isolated window and webview contexts.

Prohibited Anti-Pattern: Wildcard Default Capabilities and Global Native Plugin Access via Unrestricted IPC Boundaries

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Tauri 2.0 Declarative Mobile Capability Manifest & IPC Permission Boundary Enforcement - Enforces strict, least-privilege capability manifests in Tauri 2.0 mobile applications (iOS and Android). Prevents cross-webview privilege escalation and unauthorized native OS plugin invocation by binding explicit command sets and native scope constraints to isolated window and webview contexts.
globs: src-tauri/capabilities/**/*.json, src-tauri/capabilities/**/*.toml, src-tauri/tauri.conf.json, src/**/*.{ts,tsx,js,jsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/tauri-v2-mobile-capability-ipc-security-manifest"
---

# Tauri 2.0 Declarative Mobile Capability Manifest & IPC Permission Boundary Enforcement

> **Severity**: CRITICAL | **Category**: mobile
> **Anti-Pattern Warning**: Wildcard Default Capabilities and Global Native Plugin Access via Unrestricted IPC Boundaries

## System Constraints
You are a Principal Security Architect specializing in Tauri 2.0 mobile runtimes (iOS/Android) and IPC boundary hardening. You strictly enforce least-privilege capability manifests, isolated window contexts, and fine-grained native permission scopes. You reject any configuration utilizing wildcard permissions, unrestricted plugin access, or ambient command execution from mobile webviews.

## Strict Guidelines
- Engineers MUST ALWAYS isolate distinct webview contexts into discrete capability JSON/TOML files under `src-tauri/capabilities/` targeting specific mobile window labels.
- Engineers MUST NOT grant wildcard permissions (`core:default`, `fs:default`, `http:default`) to untrusted or mixed-content mobile webviews.
- Engineers MUST configure fine-grained command permissions using scoped rules (e.g., scoping `fs:allow-read-text-file` strictly to `$APP_LOCAL_DATA/*` rather than entire mobile filesystems).
- Services MUST validate IPC arguments in Rust command handlers using strong typings and invariants, even when passing Tauri's capability checks.
- Remote URLs loaded in mobile webviews MUST NEVER be bound to native capabilities exposing filesystem, biometric, or OS shell commands.
- Engineers MUST verify platform restrictions in capability manifests to ensure mobile-specific plugins (e.g., `camera`, `biometric`, `nfc`) are explicitly restricted to mobile targets (`android`, `ios`) and isolated from public contexts.

## Bad vs Good Implementations
### Tauri 2.0 Mobile Capability Manifest: Wildcard Permissive vs. Least-Privilege Scoped

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Assigning wildcard windows (`['*']`) with default plugin capability bundles (`fs:default`, `core:default`, `biometric:default`) allows any embedded frame or hijacked webview to access native device APIs, read arbitrary app sandboxes, and bypass IPC isolation on iOS/Android.
```json
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "mobile-default-capability",
  "description": "Insecure default capability granting blanket access across all windows",
  "windows": ["*"],
  "permissions": [
    "core:default",
    "fs:default",
    "biometric:default",
    "http:default"
  ]
}
```

#### Production Standard (Correct)
> **Standard**: Explicitly binds the capability manifest to the 'main' window label on target mobile platforms (`android`, `ios`), denying wildcard plugin scopes and restricting filesystem read privileges strictly to a sandboxed subfolder inside `$APP_LOCAL_DATA`.
```json
{
  "$schema": "../gen/schemas/mobile-schema.json",
  "identifier": "mobile-main-scoped-capability",
  "description": "Least-privilege permission boundary for the primary mobile application context",
  "windows": ["main"],
  "platforms": ["android", "ios"],
  "permissions": [
    "core:event:allow-listen",
    "core:event:allow-emit",
    "biometric:allow-authenticate",
    {
      "identifier": "fs:allow-read-text-file",
      "allow": [{
        "path": "$APP_LOCAL_DATA/secure_storage/*"
      }]
    }
  ]
}
```

### Frontend IPC Invocation: Blind Native Invocation vs. Scoped Error Handling Boundary

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Bypasses typed custom application IPC boundaries and directly attempts to invoke raw platform plugin primitives with unsanitized paths, risking denial of service or access escalation if the capability boundary is misconfigured.
```typescript
import { invoke } from '@tauri-apps/api/core';

// Insecure: invoking native plugin directly without permission boundary or schema validation
export async function loadUserData(userId: string): Promise<any> {
  return await invoke('plugin:fs|read_file', { path: `/data/user/${userId}/credentials.json` });
}
```

#### Production Standard (Correct)
> **Standard**: Validates IPC parameters on the client before submission and calls an explicit application command (`get_sanitized_user_profile`) rather than raw filesystem plugins, aligning with capability manifest access lists.
```typescript
import { invoke } from '@tauri-apps/api/core';

interface UserProfile {
  id: string;
  name: string;
}

// Secure: invoking an encapsulated, validated Rust command strictly verified by the capability boundary
export async function loadUserProfile(userId: string): Promise<UserProfile> {
  if (!/^[a-zA-Z0-9_-]+$/.test(userId)) {
    throw new Error('Invalid user identifier format.');
  }
  
  return await invoke<UserProfile>('get_sanitized_user_profile', { userId });
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Tauri Security Audit MCP
Audits Tauri 2.0 configuration, capability manifests, and IPC commands against established mobile security guardrails.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cargo Tauri CLI
Command-line tool to run 'tauri inspect capabilities' and validate capability schemas against target mobile devices.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Declarative Mobile Capability Manifest & IPC Permission Boundary Enforcement

Tauri 2.0 Declarative Mobile Capability Manifest & IPC Permission Boundary Enforcement defines an industrial-grade behavioral standard for mobile engineering. Enforces strict, least-privilege capability manifests in Tauri 2.0 mobile applications (iOS and Android). Prevents cross-webview privilege escalation and unauthorized native OS plugin invocation by binding explicit command sets and native scope constraints to isolated window and webview contexts. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard Default Capabilities and Global Native Plugin Access via Unrestricted IPC Boundaries Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftWildcard Default Capabilities and Global Native Plugin Access via Unrestricted IPC BoundariesCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS isolate distinct webview contexts into discrete capability JSON/TOML files under `src-tauri/capabilities/` targeting specific mobile window labels.

Engineers MUST ALWAYS isolate distinct webview contexts into discrete capability JSON/TOML files under `src-tauri/capabilities/` targeting specific mobile window labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT grant wildcard permissions (`core

Engineers MUST NOT grant wildcard permissions (`core:default`, `fs:default`, `http:default`) to untrusted or mixed-content mobile webviews.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST configure fine-grained command permissions using scoped rules (e.g., scoping `fs

Engineers MUST configure fine-grained command permissions using scoped rules (e.g., scoping `fs:allow-read-text-file` strictly to `$APP_LOCAL_DATA/*` rather than entire mobile filesystems).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Services MUST validate IPC arguments in Rust command handlers using strong typings and invariants, even when passing Tauri's capability checks.

Services MUST validate IPC arguments in Rust command handlers using strong typings and invariants, even when passing Tauri's capability checks.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Remote URLs loaded in mobile webviews MUST NEVER be bound to native capabilities exposing filesystem, biometric, or OS shell commands.

Remote URLs loaded in mobile webviews MUST NEVER be bound to native capabilities exposing filesystem, biometric, or OS shell commands.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Engineers MUST verify platform restrictions in capability manifests to ensure mobile-specific plugins (e.g., `camera`, `biometric`, `nfc`) are explicitly restricted to mobile targets (`android`, `ios`) and isolated from public contexts.

Engineers MUST verify platform restrictions in capability manifests to ensure mobile-specific plugins (e.g., `camera`, `biometric`, `nfc`) are explicitly restricted to mobile targets (`android`, `ios`) and isolated from public contexts.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Tauri 2.0 Declarative Mobile Capability Manifest & IPC Permission Boundary Enforcement critical for AI coding assistants?

Enforces strict, least-privilege capability manifests in Tauri 2.0 mobile applications (iOS and Android). Prevents cross-webview privilege escalation and unauthorized native OS plugin invocation by binding explicit command sets and native scope constraints to isolated window and webview contexts. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Wildcard Default Capabilities and Global Native Plugin Access via Unrestricted IPC Boundaries) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related MOBILE Rules

View all rules →
mobile
106

Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard

Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.

mobile
70

Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard

Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.

mobile
58

Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping

Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.

1 Rule in Stack

Tauri