Tauri 2.0 Mobile Capability Isolation and IPC Scoping | AgentRules.org

Rules Stacks Clients Auditor Pruner Self-Heal RFCs Benchmark CLI CI/CD Authors Submit

This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →

mobilecritical PriorityID: tauri2-ipc-capability-isolation-guardrail

Tauri 2.0 Mobile Capability Isolation and IPC Scoping

Enforces strict compile-time capability isolation and per-window Access Control Lists (ACLs) in Tauri 2.0 mobile applications. Disallows wildcard permissions, restricts plugin access to explicitly bound webview labels, and prevents compromised web contexts from escalating privileges to native platform APIs.

Prohibited Anti-Pattern: Exposing Wildcard IPC Capabilities and Unscoped Native Commands to Mobile Webviews

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Tauri 2.0 Mobile Capability Isolation and IPC Scoping - Enforces strict compile-time capability isolation and per-window Access Control Lists (ACLs) in Tauri 2.0 mobile applications. Disallows wildcard permissions, restricts plugin access to explicitly bound webview labels, and prevents compromised web contexts from escalating privileges to native platform APIs.
globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/tauri2-ipc-capability-isolation-guardrail"
---

# Tauri 2.0 Mobile Capability Isolation and IPC Scoping

> **Severity**: CRITICAL | **Category**: mobile
> **Anti-Pattern Warning**: Exposing Wildcard IPC Capabilities and Unscoped Native Commands to Mobile Webviews

## System Constraints
You are a Principal Security Architect enforcing Tauri 2.0 dynamic plugin capability isolation and IPC scoping guardrails. Tauri 2.0 deprecates global allowlists in favor of granular ACL capability manifests bound strictly to window and webview identifiers. You must enforce principle-of-least-privilege capability manifests, reject any use of wildcard windows or wildcard permissions, mandate argument-scoped command rules, and ensure client-side IPC invokers enforce cryptographic or strict domain boundaries.

## Strict Guidelines
- Engineers MUST ALWAYS isolate permissions in dedicated capability files under `src-tauri/capabilities/` and explicitly bind them to distinct `windows` and `webviews` identifiers.
- Engineers MUST NOT use wildcard syntax `"*"` in capability `windows`, `webviews`, `permissions`, or filesystem scopes.
- Engineers MUST specify parameter-level scope constraints (e.g., path restrictions using `$APPDATA/*` instead of system roots) for all native plugins like `fs`, `http`, and `shell`.
- Code SHOULD validate and sanitize all IPC payloads using runtime schema validation (e.g., Zod) on the client before invocation and type-safe deserialization with Rust serde on the native host.
- Services MUST NEVER invoke native commands via dynamic string interpolation or expose raw Tauri internal globals (`window.__TAURI_INTERNALS__`) directly to global scope.
- Components NEVER load external untrusted remote URLs inside a webview that has native capability sets bound to it.

## Bad vs Good Implementations
### Per-Window Capability Scoping vs Wildcard ACL

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Directly delegating unrestricted native commands through the client without enforcing typed command contracts or scoped path constraints allows an injected script (XSS) in the mobile webview to read arbitrary OS files.
```typescript
// BAD: Invoking native commands via raw unvalidated invoke with wide plugin exposure
import { invoke } from '@tauri-apps/api/core';

export async function readDeviceFile(userSuppliedPath: string): Promise<string> {
  // Anti-pattern: Untrusted path passed directly to un-scoped native command
  // When paired with 'fs:default' or '*' permissions, this grants arbitrary file read access
  return await invoke<string>('plugin:fs|read_text_file', {
    path: userSuppliedPath
  });
}
```

#### Production Standard (Correct)
> **Standard**: The good pattern enforces runtime argument validation prior to dispatch, targets a domain-specific command rather than exposing raw raw plugin primitives, and relies on compile-time ACL capability files that constrain filesystem access to the app data sandbox.
```typescript
// GOOD: Strongly typed IPC bridge with validated client-side schema and scoped command wrapper
import { invoke } from '@tauri-apps/api/core';
import { z } from 'zod';

const SafeFileNameSchema = z.string().regex(/^[a-zA-Z0-9_-]+\.json$/);

export async function readScopedAppData(fileName: string): Promise<Record<string, unknown>> {
  const validatedFileName = SafeFileNameSchema.parse(fileName);
  
  // Command maps to a tightly scoped capability bound only to this window
  // Capability JSON enforces: allow-read-text-file scoped to: "$APPDATA/user_data/*"
  const content = await invoke<string>('read_app_document', {
    fileName: validatedFileName
  });

  return JSON.parse(content) as Record<string, unknown>;
}
```

Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Tauri Security Analyzer MCP

Static analysis MCP server for Tauri 2.0 capability definitions, permission audits, and attack surface detection.

Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Tauri CLI Capability Validator

Validates Tauri 2.0 capabilities, ACL schema compliance, and mobile security configs using `cargo tauri capability` and `cargo tauri info`.

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Mobile Capability Isolation and IPC Scoping

Tauri 2.0 Mobile Capability Isolation and IPC Scoping defines an industrial-grade behavioral standard for mobile engineering. Enforces strict compile-time capability isolation and per-window Access Control Lists (ACLs) in Tauri 2.0 mobile applications. Disallows wildcard permissions, restricts plugin access to explicitly bound webview labels, and prevents compromised web contexts from escalating privileges to native platform APIs. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Exposing Wildcard IPC Capabilities and Unscoped Native Commands to Mobile Webviews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Exposing Wildcard IPC Capabilities and Unscoped Native Commands to Mobile Webviews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS isolate permissions in dedicated capability files under `src-tauri/capabilities/` and explicitly bind them to distinct `windows` and `webviews` identifiers.

Engineers MUST ALWAYS isolate permissions in dedicated capability files under `src-tauri/capabilities/` and explicitly bind them to distinct `windows` and `webviews` identifiers.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

2

Engineers MUST NOT use wildcard syntax `"*"` in capability `windows`, `webviews`, `permissions`, or filesystem scopes.

Engineers MUST NOT use wildcard syntax `"*"` in capability `windows`, `webviews`, `permissions`, or filesystem scopes.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

3

Engineers MUST specify parameter-level scope constraints (e.g., path restrictions using `$APPDATA/*` instead of system roots) for all native plugins like `fs`, `http`, and `shell`.

Engineers MUST specify parameter-level scope constraints (e.g., path restrictions using `$APPDATA/*` instead of system roots) for all native plugins like `fs`, `http`, and `shell`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

4

Code SHOULD validate and sanitize all IPC payloads using runtime schema validation (e.g., Zod) on the client before invocation and type-safe deserialization with Rust serde on the native host.

Code SHOULD validate and sanitize all IPC payloads using runtime schema validation (e.g., Zod) on the client before invocation and type-safe deserialization with Rust serde on the native host.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

5

Services MUST NEVER invoke native commands via dynamic string interpolation or expose raw Tauri internal globals (`window.__TAURI_INTERNALS__`) directly to global scope.

Services MUST NEVER invoke native commands via dynamic string interpolation or expose raw Tauri internal globals (`window.__TAURI_INTERNALS__`) directly to global scope.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

6

Components NEVER load external untrusted remote URLs inside a webview that has native capability sets bound to it.

Components NEVER load external untrusted remote URLs inside a webview that has native capability sets bound to it.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Tauri 2.0 Mobile Capability Isolation and IPC Scoping critical for AI coding assistants?

Enforces strict compile-time capability isolation and per-window Access Control Lists (ACLs) in Tauri 2.0 mobile applications. Disallows wildcard permissions, restricts plugin access to explicitly bound webview labels, and prevents compromised web contexts from escalating privileges to native platform APIs. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Exposing Wildcard IPC Capabilities and Unscoped Native Commands to Mobile Webviews) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related MOBILE Rules

View all rules →

Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard

Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.

Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard

Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.

Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping

Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.

1 Rule in Stack

Tauri