Guacamole is clientless and doesn't require an agent to be installed on the resources being accessed.

The server side of the web application is written in Java and runs beneath a servlet container like Apache Tomcat or Jetty.

guacd services requests to connect to remote desktops from the web application.

guacd and all client plugins use a shared library, libguac, to abstract away the Guacamole protocol and communication with the web application.

The project follows responsible disclosure practices and provides a private list for reporting and addressing issues with security implications.