What leaves your machine, when, and how to turn it off. Every answer here comes from the project's SECURITY.md and CONFIGURATION.md, which go into more detail.
jCodeMunch runs on your own machines as a local process your agent starts over stdio. There's no remote endpoint and no hosted service. It reads your code locally, keeps its index in ~/.code-index/ on that machine, and never runs the code it indexes. There's no account to create. An optional HTTP mode exists for self-hosting on your own network; it's off by default, and you have to start it yourself. Your source code is never sent to us, and in a default install it doesn't leave the machine.
This is the complete list. Beyond these, the base package makes no network calls.
| What | When | What's sent, and where | How to turn it off |
|---|---|---|---|
| Savings counter | On by default | A random anonymous ID, a token-count increase and a lifetime total, to j.gravelle.us. No code, paths, repo names or queries. | share_savings: false in config.jsonc, or JCODEMUNCH_SHARE_SAVINGS=0 |
| AI summaries from a cloud provider | Only if you name a cloud provider, or set allow_paid_summaries. A stray API key in the environment never selects one on its own. | Symbol signatures and docstrings, to the provider you chose. Source goes only if you also set summarizer_body_chars above 0 and allow_remote_summarizer: true, after pattern-based secret redaction. | Don't configure a provider, or set JCODEMUNCH_SUMMARIZER_PROVIDER=none |
| License check | Only when you run license, org-rollup or install-pack --license | Your license key, in the request body or a header (never the URL), to j.gravelle.us. It gates only the team org-rollup feature; the tools themselves never call it. | Don't run those commands |
| Starter packs | Only when you run install-pack | Downloads the pack from jcodemunch.com, then sends one event naming the pack, its version and your platform | The event is skipped when the savings counter is off |
| Token-counting file | On first use of get_context_bundle or audit_agent_config on a machine | A one-time download of a public token-counting file (about 1.7 MB) from openaipublic.blob.core.windows.net, made by the tiktoken library. Nothing about you or your code is sent. A release that removes this fetch is on the way. | Download only; it can't be switched off yet |
| Local embedding model | Only when you run download-model, or on the first semantic search with the [local-embed] extra | A one-time download of about 90 MB from huggingface.co, checked against its SHA-256. Nothing is uploaded. | Don't install the extra |
| Team savings report | Only when you run org-report (team licenses) | Six fields (org, seat, tokens, dollars, calls, date) to a host you choose on your own network, never to us. With no host set, it writes a local file. The seat defaults to the machine's hostname; set JCODEMUNCH_CLIENT_ID to send something else. | Don't run it |
The index, a local journal of the files and searches an agent touched (paths and query strings, no file contents), and per-tool call counts all live under ~/.code-index/. Delete that directory and every trace is gone. A local performance log is off unless you turn it on.
A default install listens for nothing. The four routes that can accept data from another machine are off by default, need the HTTP transport running, and refuse any request without your bearer token.
It reads files as text and parses them; it never imports, evaluates or runs them. Credential files (.env, keys, certificates and the like) are skipped by name, without being opened. Secrets are redacted from most tool answers, except the three tools that return source as written. It respects .gitignore and skips symlinks by default.
GitHub release files are signed with Sigstore, and SECURITY.md shows how to verify them. Report a vulnerability privately through the repository's Security tab: you'll get an acknowledgement within 3 days and a verdict within 14. Every past advisory is listed in SECURITY.md with the version that fixed it.
| Is our code used to train models? | We never receive your code, so we can't train on it. If you turn on AI summaries, the provider you pick applies its own terms. |
| What do you keep, and for how long? | The savings counter keeps an anonymous ID and a running token total. Your code and indexes stay on your machines for as long as you keep them. |
| Data region | Wherever you run it. The code and index don't leave the machine, unless you turn on AI summaries that include source (off by default). |
| Offline or air-gapped use | Works with the savings counter off. One exception for now: the first time get_context_bundle or audit_agent_config counts tokens, it downloads a public 1.7 MB token-counting file (nothing about you or your code is sent). A release that removes this fetch is on the way. |
| SSO / SAML | Not offered. There's no hosted service or account to sign in to. |
| Audit logs | Not offered as a feature. |
| SOC 2 or ISO 27001 report | Not offered. |
| Indemnity or warranty | Not offered. The software is provided as is, as the license states. |
| SLA or custom terms | Not standard. Write to j@gravelle.us. |
jCodeMunch is under the jCodeMunch-MCP Dual-Use License from jMunch, LLC. Non-commercial use is free. Use at a company takes a commercial license, paid once, and it includes every 1.x update with no time limit; here are the terms and prices on one page.
Pay by card and Stripe emails the receipt. For an invoice or a purchase order on 30-day terms, write to j@gravelle.us. There's no separate license certificate: the receipt and the license terms are the record. If your procurement team needs a written confirmation, ask at the same address.