xcb runs on your machine. Your accounts, credentials, and task history stay there, and model requests go from each provider’s own CLI to that provider.
What stays on your machine
- State: accounts, credentials, conversations, tasks, and settings live in
~/.local/share/xcb(orXCB_STATE), readable only by you. - Credentials: xcb stores a sign-in only when you run
xcb setup,xcb accounts login, or an explicitimportcommand. It never reads your existing provider logins on its own, and import copies the one file you name, leaving it in place. - Usage: token and usage measurement stays local. Uploading usage to AI Charts is unavailable.
- Learning: the reflexes store numeric features and your labels, never prompt or response text.
What goes to providers
The provider CLI sends your prompt, and any file contents the model reads through xcb’s tools, to its own service under your account. Each provider’s terms and data policies apply.
While a task runs, the provider process is sandboxed: Seatbelt on macOS, bwrap on Linux. It runs a private copy of the provider executable xcb checked, uses a configuration folder xcb created for that account, reaches the network on port 443 only, and reaches your project only through xcb’s file tools, which stay inside the task’s folder. Credentials never enter a project folder. The command runner gives commands a copy of the project with no credentials and no network.
The optional judge
The judge is off by default. When you enable it, xcb sends questions to TypeSafe’s System One service (api.typesafe.ai) to help classify tasks, decide whether a turn stopped short, and choose which old tool output to keep. Each request carries at most 128 KiB:
- routing: up to 8 KiB of the task text;
- continuation: up to 8 KiB each of the original task and the last response;
- context management: up to 88 KiB of recent messages, plus the names and sizes of old tool results, never their contents.
The judge can only order routes that already passed every check. It cannot add a provider or skip a safety check. Its key is stored in the state folder with mode 0600, or read from XCB_JEV_API_KEY. See customize xcb to turn it on.
Other network requests
- Supported builds: about once an hour, xcb reads the list of reviewed provider builds from this repository’s
qualified-builds.jsonon GitHub. - Offers: the background supervisor reads the public Devin pricing page when it starts and every six hours.
- Updates:
xcb update check,xcb upgrade, and the optional daily check read release data from GitHub. - Remote devices: only after
xcb link. Task content crosses the relay end-to-end encrypted.
None of these send prompts, files, or account details.
Extensions that run code
Hooks run programs you choose at session and turn events. They are off by default and need their own xcb plugins enable hooks. Panes change only what the terminal shows; they cannot run code or grant a provider new tools.
Report a vulnerability
Report security issues privately as described in the security policy.