Sverklo's default embedding provider is the bundled ONNX model: code is chunked, embedded, and indexed on your machine. If you explicitly configure a remote embedding provider, code chunks may be sent to that provider. Telemetry is off by default and only starts after an explicit opt-in. Audit the source — it's MIT and reproducible from clone.
sverklo prove --markdown follows the same boundary: it prints a local receipt from your repo, then you decide whether to share it. No public proof receipt is uploaded automatically.
Between April and May 2026, multiple high-profile MCP supply-chain disclosures landed: command-injection vectors in popular MCP servers, registry poisoning probes succeeding against 9 of 11 registries tested, and ~200K vulnerable MCP instances identified across the ecosystem. Industry guidance shifted to "stick to vendor-maintained or AAIF reference servers."
Sverklo's stdio MCP server does not expose a listening network service. Its default embedding path is local; choosing a remote embedding provider deliberately extends the data boundary to that provider. The threat model is shaped by those explicit boundaries:
The disclosure cycle has kept compounding through May 2026:
Sverklo's attack surface against this cycle: the MCP server runs over stdio inside the user's client process and does not expose a listening service. Outbound traffic is limited to the boundaries documented below, including any embedding provider the user explicitly selects. CVE-2026-33032-class exposed-listener issues do not apply to Sverklo's stdio transport.
| Endpoint | When · what's sent |
|---|---|
| onnx model (one URL) |
Once, on first run. Downloads the 86 MB ONNX embedding model from a fixed sverklo CDN URL to ~/.sverklo/models/model.onnx. Subsequent runs use the cached file. No telemetry attached to this fetch. SHA-256 verified at install time. |
| remote embedding provider (explicit only) |
Only if the user explicitly selects a remote embedding provider. Text batches containing code chunks are sent to that provider's embedding endpoint and the returned vectors are stored in the local index. The bundled ONNX provider remains the default when no provider is configured. |
| t.sverklo.com (opt-in only) |
Only if the user runs sverklo telemetry enable. Sends the 9 fields documented in TELEMETRY.md: install_id (UUID), version, os, node_major, event type, tool name (or null), outcome (ok/error/timeout), duration_ms. No queries, code, file paths, symbol names, IP addresses, hostnames, usernames, project names, git SHAs, branches, repo URLs, error messages, or stack traces. Mirrored to ~/.sverklo/telemetry.log before the network call so you can audit exactly what left. |
| api.github.com (explicit only) |
Only when the user runs sverklo --check-update or equivalent. Fetches the latest release tag for version comparison. No data sent beyond the standard HTTP request. |
The SQLite index, memory journal, returned embeddings, chunk store, and symbol graph remain on your machine. With the default bundled ONNX provider, embedding also stays local after the model download. Configuring a remote embedding provider changes that boundary for the text sent to that provider.
Do not file public GitHub issues for security vulnerabilities. Email security@sverklo.com with a description, reproduction steps, the affected version (sverklo --version), and your impact assessment. We aim to acknowledge within 3 business days and ship a fix or mitigation within 14 days for confirmed high-severity issues. PGP available on request.
src/, bin/, dist/)telemetry-endpoint/) — designed to collect almost nothing; report if it collects more than documented@modelcontextprotocol/sdk, better-sqlite3, onnxruntime-node, chokidar) — please report those upstreamFull policy + coordinated disclosure timeline: SECURITY.md.
The honest version of "no telemetry by default": sverklo prints a one-line prompt asking once whether you'd like to opt in. If you skip or say no, nothing happens — no network call, no buffered events, no later retries. The opt-in is a sentinel file at ~/.sverklo/telemetry.enabled; the override is a sentinel file at ~/.sverklo/telemetry.disabled. The disabled file always wins.