/* security posture · product boundary updated 2026-07-26 */

Local by default. Remote providers only when you configure one. MIT.

Sverklo's default embedding provider is the bundled ONNX model: code is chunked, embedded, and indexed on your machine. If you explicitly configure a remote embedding provider, code chunks may be sent to that provider. Telemetry is off by default and only starts after an explicit opt-in. Audit the source — it's MIT and reproducible from clone.

sverklo prove --markdown follows the same boundary: it prints a local receipt from your repo, then you decide whether to share it. No public proof receipt is uploaded automatically.

Why local-first matters now

Between April and May 2026, multiple high-profile MCP supply-chain disclosures landed: command-injection vectors in popular MCP servers, registry poisoning probes succeeding against 9 of 11 registries tested, and ~200K vulnerable MCP instances identified across the ecosystem. Industry guidance shifted to "stick to vendor-maintained or AAIF reference servers."

Sverklo's stdio MCP server does not expose a listening network service. Its default embedding path is local; choosing a remote embedding provider deliberately extends the data boundary to that provider. The threat model is shaped by those explicit boundaries:

local
bundled ONNX provider selected when you set nothing
0
API keys required for the default bundled provider
MIT
licensed source — audit, fork, vendor as you please

The disclosure cycle has kept compounding through May 2026:

Sverklo's attack surface against this cycle: the MCP server runs over stdio inside the user's client process and does not expose a listening service. Outbound traffic is limited to the boundaries documented below, including any embedding provider the user explicitly selects. CVE-2026-33032-class exposed-listener issues do not apply to Sverklo's stdio transport.

The network boundaries, in full

EndpointWhen · what's sent
onnx model
(one URL)
Once, on first run. Downloads the 86 MB ONNX embedding model from a fixed sverklo CDN URL to ~/.sverklo/models/model.onnx. Subsequent runs use the cached file. No telemetry attached to this fetch. SHA-256 verified at install time.
remote embedding provider
(explicit only)
Only if the user explicitly selects a remote embedding provider. Text batches containing code chunks are sent to that provider's embedding endpoint and the returned vectors are stored in the local index. The bundled ONNX provider remains the default when no provider is configured.
t.sverklo.com
(opt-in only)
Only if the user runs sverklo telemetry enable. Sends the 9 fields documented in TELEMETRY.md: install_id (UUID), version, os, node_major, event type, tool name (or null), outcome (ok/error/timeout), duration_ms. No queries, code, file paths, symbol names, IP addresses, hostnames, usernames, project names, git SHAs, branches, repo URLs, error messages, or stack traces. Mirrored to ~/.sverklo/telemetry.log before the network call so you can audit exactly what left.
api.github.com
(explicit only)
Only when the user runs sverklo --check-update or equivalent. Fetches the latest release tag for version comparison. No data sent beyond the standard HTTP request.

The SQLite index, memory journal, returned embeddings, chunk store, and symbol graph remain on your machine. With the default bundled ONNX provider, embedding also stays local after the model download. Configuring a remote embedding provider changes that boundary for the text sent to that provider.

Reporting a vulnerability

Do not file public GitHub issues for security vulnerabilities. Email security@sverklo.com with a description, reproduction steps, the affected version (sverklo --version), and your impact assessment. We aim to acknowledge within 3 business days and ship a fix or mitigation within 14 days for confirmed high-severity issues. PGP available on request.

In-scope

Out of scope

Full policy + coordinated disclosure timeline: SECURITY.md.

What you can audit, today

The honest version of "no telemetry by default": sverklo prints a one-line prompt asking once whether you'd like to opt in. If you skip or say no, nothing happens — no network call, no buffered events, no later retries. The opt-in is a sentinel file at ~/.sverklo/telemetry.enabled; the override is a sentinel file at ~/.sverklo/telemetry.disabled. The disabled file always wins.