Data and privacy

Kraft has no telemetry. It sends no usage data, crash reports or analytics anywhere. The outbound calls it makes are listed below, and each one serves a feature you can see.

Model providers

Kraft never calls a model API itself. It runs the agent CLI you installed, such as Claude Code, and that CLI sends your code, prompts and tool output to its provider under your account and that provider's terms. What the provider keeps and for how long is set by your account with it, not by Kraft.

Under a sandbox with a network: policy, the agent's traffic leaves through Kraft's own egress proxy, and only to the hosts the policy and the harness allow.

Outbound calls

Each row is a call Kraft or your browser makes, and what turns it off.

The forge CLI and git calls use your own logins for those tools. More on four of the rows:

• Update check. The result is cached in run/update-check.json. KRAFT_NO_UPDATE_CHECK=1 stops the automatic checks. The About page's Check now and kraft admin update still look when you ask.
• Notifications. For each event you chose, Kraft posts the work item's id and title, the event type, the gate when the event is about one, and a link to the item on your board. A title can name a private project, so check what notify.yaml points at before you turn notifications on. Get notified when an item needs you sets them up.
• API docs pages. /docs loads swagger-ui-bundle.js and swagger-ui.css from swagger-ui-dist@5.32.15. /redoc loads redoc.standalone.js from redoc@2.5.4. Each is one pinned release, checked against a hash Kraft ships.
• Embedding model. It is cached in $XDG_CACHE_HOME/kraft/fastembed (~/.cache/kraft/fastembed when that is unset), or in $KRAFT_EMBED_CACHE if you set it.

Secrets and state

Everything lives under $KRAFT_HOME (default ~/.kraft). Kraft writes its config files through a temporary file created with mode 0600, so a file Kraft has written is readable only by you. The defaults Kraft copies into a new home on its first start are 0600 too, in 0700 directories. A file you created or edited by hand keeps its own mode.

Config files that hold secrets

The rest of config/ is described in Configuration.

The run directory

run/ is 0700, and Kraft sets that on every start. Because of that, other users on the machine cannot reach anything inside it, whatever mode a file has. Every path in the two tables below is under it. A row with no mode is one Kraft sets none on.

Agent logs hold whole sessions: prompts, the code the agent read and wrote, and command output. A database created by an older Kraft keeps its mode. Treat run/ like the repositories it works on.

Sandbox working files

Repo environment values

A repo's env: values go into each worker's process environment, not onto its command line. Your own user and root can read them there, for example with ps eww on macOS or from /proc/<pid>/environ on Linux. Every agent running for that repo can read them too.

Related

• Security: the default posture and the threat model.
• The bearer token: what it grants.
• Rotate the token: how to replace the bearer token or the trigger token.
• Architecture: how the stores fit together.