Capabilities & trust
A plugin declares in its manifest whether it needs your GPU, your files, the network or saved state, and the project's trust level decides whether it loads.
Plugins run inside the same app as your work. Each one declares up front which extra powers ('capabilities') it needs, and that declaration is checked against the project you have open.
The five capabilities
A plugin can request any combination of these.
GPU. Use the graphics card directly, for example to run its own custom effect.
Saved state. Remember something between cooks, as per-node memory.
Files. Read and write files on your computer.
Network. Open connections to the internet or your local network.
Load plugins. Load other plugins of its own.
A plugin that asks for none of these is the safe default and loads in any project. It can still make nodes that crunch numbers, shapes and signals.
The list is a disclosure, not a fence. Nothing at runtime mediates what a loaded plugin touches: there is no extension registry behind the flags and no path restriction anywhere, so a plugin's own code reaches the disk and the network whatever its manifest said. A Python plugin runs in the app's ordinary interpreter and can import os. Read the manifest before installing something, and install only from a source you trust.
Trust travels with the project
Whether a capability-requesting plugin loads at all depends on whether the current project is trusted.
Every project opens restricted, including one you saved yourself, until you trust its file path. A restricted project refuses to load any native or Rust plugin that declares a capability: the plugin is held back rather than loaded and then blocked. It also refuses to start the Python interpreter at all, so Python plugins do not run.
Capability-bearing built-in nodes are held back the same way. They show a small lock badge, and a yellow bar reads ⚠ This project is Restricted. Capability-bearing nodes are disabled. with Trust this project and Review nodes buttons.
A node that refuses to cook and shows a lock has hit the trust gate, not a bug. Click Trust this project to review what the project wants and allow it.
What the prompt shows
Accepting shows the exact list of capabilities the project needs, each with a plain-English line such as File I/O — reads and writes files on your computer. The full set covers file I/O, scripting, web fetch, plugin hosting, network cameras, NDI, OSC, WebSocket and serial.
GPU, audio, physics and simulation work never appears in that list. None of it reaches your files, your network or the rest of your machine, so it keeps cooking in a restricted project.
There is no separate prompt for installing a plugin. The bundle format carries a capability list and a signature for one, but nothing in the app opens a bundle. See Installing plugins.
Trust is granted per path, so trusting one project does not trust every file you ever open, and a Save As to a new location is restricted again. Revoke it later in Preferences > Security & Trust, which lists every trusted path with a Revoke button.