CodeMCPGet started
Back to product

LEGAL & PRIVACY

LOCAL-FIRST

Your code stays
on your machine.

CodeMCP is architected from day zero with a zero-knowledge, local-first mandate. We do not operate remote code indexing clusters, cloud vector databases, or silent telemetry collectors.

Last updated: September 14, 2026 • Version 1.0

Zero Cloud Indexing

We never mirror, parse, or upload your source code to external servers or vector databases.

Local Filesystem Isolation

All tools run locally on your hardware via direct stdio pipes or localhost loopback interfaces.

No Secret Logging

Files matching protected patterns (.env, *.key) are blocked and never printed to server logs.

1. Fundamental Principle

CodeMCP is an open-source Model Context Protocol (MCP) server distributed via npm. When executed with npx codemcp, the server executes entirely in your local Node.js runtime. The software does not establish outbound telemetry connections or stream file contents to CodeMCP maintainers.

2. Data Handled Locally

When connected to an AI assistant, CodeMCP processes the following data exclusively on your machine:

  • Directory Trees: Processed in memory to respond to list_files requests.
  • File Contents: Read upon assistant demand through read_file within authorized boundaries.
  • Search Indices: In-memory pattern matching using local ripgrep search without persistent caching.
  • Interactive Diffs: Rendered in your local terminal standard output for explicit human approval.

3. Website Analytics Disclosures

Our documentation website (https://code-mcp.vercel.app) uses Vercel Web Analytics to measure aggregate page visits, referrers, and browser types. Vercel Web Analytics is privacy-friendly:

  • No personal data (PII) or IP addresses are stored.
  • No tracking cookies are placed in your browser.
  • No cross-site tracking or advertising profiling is conducted.

4. Remote Tunnels & Web Clients

If you explicitly launch CodeMCP with the --tunnel flag, CodeMCP establishes an ephemeral end-to-end encrypted TLS bridge (via Cloudflare or ngrok). In this mode, incoming JSON-RPC calls traverse the encrypted tunnel directly to your machine. We do not inspect, log, or store tunnel payload traffic.

5. Third-Party AI Services

When using CodeMCP with third-party AI assistants (such as Anthropic Claude, OpenAI ChatGPT, or Cursor), the prompts and tool responses generated by the assistant are subject to the respective privacy policies of those AI providers. Please review your provider's data retention settings.

6. Open Source Verification

Because CodeMCP is 100% open source under the MIT license, you can inspect and audit every line of code directly in our public repository at github.com/mahesh2-lab/CodeMCP.