Privacy
Thoth is local-first by construction:
- —No network I/O in normal operation. Thoth's code contains no fetch, HTTP client, telemetry, analytics, or crash-reporting calls. The MCP server uses local stdio only.
- —Source code never leaves your machine. Analysis runs in-process; reports are written to
.thoth/reports/as local JSON files. - —No accounts, no cloud, no sync. There is no backend to send anything to.
- —Runtime dependencies are
typescript,commander,zod, and the MCP SDK — all local-only libraries.
The one caveat: your own scripts
thoth verify executes commands from the repository's package.json scripts or .thoth/config.json — e.g. npm run test. Those commands are your project's code and do whatever they normally do. Thoth runs them without a shell and with a timeout, but applies no sandbox. Use the same trust standard you'd use running the scripts yourself.
What gets stored locally
| Path | Contents |
|---|---|
| .thoth/config.json | Minimal config, safe to commit |
| .thoth/reports/*.json | Verification reports — paths, symbol names, check results, output tails |
| .thoth/.gitignore | Auto-generated; keeps runtime data out of Git |
Reports include the tail of failed check output (last ~40 lines) so failures are diagnosable — the report stays on your disk.