Read this file, and DISCLAIMER.md, before you install AgentDrive. An AI agent must show both documents in full and then wait. Installation starts only after you confirm them in a later message. A vague reply does not count.
AgentDrive is unofficial. It is not affiliated with, endorsed by, or supported by Tesla.
Use this toolkit on a vehicle you own, or one you are explicitly allowed to control, with your own developer application, your own domain, and your own key pair. Do not point it at someone else’s vehicle, do not collect other people’s tokens or keys, and do not run it as a service for other people.
Turn on multi-factor authentication for the vehicle account, the code host that publishes your public key, and the AI agent account. Review third-party access and the keys enrolled on the vehicle, and remove anything you do not recognise.
Never commit or paste a private key, client secret, access token, refresh token, authorization code, VIN, license plate, or live location. Each owner generates a new key pair and registers a new application. Whoever holds the private key and a valid token can act on the vehicle within the approved scopes.
agentdrive where is the one command that sends a location onward, and only after rounding. It sends latitude and longitude rounded to two decimal places (about 1 km) to OpenStreetMap Nominatim, and it prints a suburb or locality, a state or region, and a country. It does not print or log the precise or the rounded coordinates. The read needs the vehicle_location scope. status and check do not request location.
Local secret files should be readable only by your user. The doctor command checks that the private-key file is present and, on macOS and Linux, not group- or world-readable. On Windows, limit the file ACL to your user. Unix mode bits are not how Windows records that restriction. The token store writes the replacement refresh token with an atomic rename before the previous value is dropped from memory.
Vehicle history is an encrypted file in the same config home (history.db). The key is history.key, created on first save, mode 600 on macOS and Linux. Encryption is AES-256-GCM from the Python cryptography package. Keep that key in the config home. Do not commit it and do not paste it into chat.
A private key that is already paired with another agent you trust can be the key AgentDrive uses. That is one signing key for every program that can read the file. A second copy is a second secret. The token file rotates: keep one file and one writer, because a refresh replaces the refresh token and two writers can invalidate each other.
AgentDrive refuses a state-changing command unless the vehicle reports shift state Park and speed 0. It then reads the vehicle again. If that read does not match the command you asked for, the result is a failure, and the command is not sent a second time.
These actions are sensitive: unlock, remote start, opening the front trunk, opening or closing the rear trunk, sentry mode off, and any charging change. Each one needs an explicit confirmation for that action. A previous “yes” does not carry over. A schedule cannot confirm them, cannot skip the check, and cannot run remote start, the rear trunk, the front trunk, or sentry mode off. Turning sentry mode on, seat heat, steering-wheel heat, defrost, and preconditioning the cabin now are parked commands. They are not on this sensitive list.
Remote commands that can unlock a vehicle create a real theft risk if the credentials leak. Do not leave valuables in the vehicle. After an unlock, confirm that the vehicle is locked again. Prefer leaving sentry mode on when the vehicle is parked somewhere unfamiliar.
Stop sending commands. Revoke the application’s access on the vehicle account, delete the enrolled key on the vehicle, rotate the developer credentials, and delete the local secret files. Treat an unlock, key, or application you do not recognise as a reason to check the vehicle before you use AgentDrive again.
Reported violations and other problems are reviewed and fixed promptly.
Do not send credentials to GitHub Issues, private vulnerability reporting, or email.
The AI agent presents DISCLAIMER.md and this file, then stops. In a later turn you confirm with this sentence:
I have read, understood, and accept the AgentDrive disclaimer and security reminder
Only after that separate confirmation may the AI agent record acceptance and run setup/install.sh. The installer checks the acceptance stamp and will not create it for you.