Trust · privacy · licence

What leaves your machine. By default, nothing.

ClarifyDoc reads your files and writes its map beside them. It has no account, no telemetry and no model in the pipeline. Below is every network request the extension, the CLI and the MCP server can make, what starts it and what it sends. The list comes from reading the source, and you can check it the same way.

Every network request Check it yourself

# network requests with default settings
VS Code extension     none
MCP server            none
report.html           none  # open it offline
CLI analyze           none  # unless Docker runs:
                            # see “Language servers”
telemetry             none, in every part

EVERY NETWORK REQUEST

What can reach the network, and what starts it

Nothing on this list happens on its own in VS Code. Each row is a setting you turn on, a flag you pass or a link you click.

What	Started by	Goes to	What is sent
Vulnerability lookup	`clarifydoc analyze --osv`. Never from the extension or the MCP server.	`api.osv.dev`	Name, ecosystem and version of each third-party package pinned to an exact version. Your project’s own workspace packages are skipped. Private package names, such as `@yourcompany/x`, are sent. No source code.
Language servers in Docker	CLI `analyze` when Docker is running (turn it off with `--no-lsp`). In VS Code only when you turn on `clarifydoc.enableLsp`. In the MCP server only with `mcp --lsp`.	Docker Hub, `mcr.microsoft.com` and the servers’ package registries, the first time each image is built. Later, the registries your project uses.	Image builds send nothing from your code. The containers run the language servers on your files with network access, and some fetch your project’s dependencies: the C#/VB image runs `dotnet restore`, which asks NuGet (or the feeds in your `nuget.config`) for your package ids and versions.
Report Issue in VS Code	You run the command, read the text, then click “Open on GitHub”.	`github.com`, in your browser	The text you saw: extension and analyzer versions, editor, OS, a few settings, and counts per folder, including the frameworks found. No file, folder or route names.
Open in Mermaid Live	You click it on a diagram.	`mermaid.live`, in your browser	The diagram travels in the URL fragment, which browsers do not send to the server. But the page decodes it in your browser, and the diagram holds file, function and route names.
CWE links on security findings	You click one.	`cwe.mitre.org`	The CWE number.

Checked against the source of the CLI and the extension on 2026-11-06. The extension uses the language servers already in your editor without Docker; that path makes no requests of its own.

THE LIMITS

Where these guarantees stop

Your agent sees the answers

The MCP server sends nothing, but it answers your coding agent. File paths, names and source snippets in those answers go wherever your agent sends its context, usually to its model provider. Hooks, if you turn them on, add the same kind of text before searches and after edits.

A report holds your code’s names

report.html embeds paths, names and short snippets from the analyzed code. It makes no requests, but anyone you send it to can read them. Treat it like the source it came from.

Your git may fetch

ClarifyDoc runs git only to read history and diffs, never clone, fetch or push. In a partial clone, git itself can download missing objects when they are read.

What it writes

The analysis goes to .clarifydoc/ in the project. Agent configs, skills, hooks and an AGENTS.md section are written only when you run setup, after showing you what changes. How to remove all of it.

CHECK IT YOURSELF

You don’t have to take our word for it

Open any example report, turn the network off and reload it. It works the same, because it is one file with no external scripts, fonts or images.
In the browser’s network panel, a report makes zero requests after it loads.
In VS Code, the report runs under a content security policy that allows no network at all: default-src 'none', images only from data:.
The CLI’s source has one place that makes an HTTP request, the OSV lookup. Read it on GitHub.
The extension declares no runtime dependencies and has no telemetry library.
The same commit gives the same map, so a result you doubt can be produced again and compared.

WHAT STAYS FREE

All of it, under the MIT licence

Other tools sell security findings, SARIF, dead code, duplication and git mining as a paid tier, and cross-file data flow as an enterprise feature. ClarifyDoc has no paid tier and no feature held back. That is a decision, not a launch offer.

Security findings, cross-file taint from request input, and SARIF for code scanning
Dead code, duplicates, complexity, coupling and layer violations
Git history: hotspots, ownership and files that change together
Exports: ARCHITECTURE.md, Mermaid, OpenAPI, CSV and a CycloneDX SBOM
The MCP server with every tool, workflow and hook
The CI gate for pull requests

The licence: MIT, for the CLI and the MCP server and for the VS Code extension.

REPORTING A VULNERABILITY

Tell us privately

ClarifyDoc reads code it did not write, so the analyzer itself is attack surface: a repository that makes it read or write outside itself, run code, escape the report or the MCP output, or hang.

Use GitHub’s private vulnerability reporting, or email support@clarifydoc.com with “security” in the subject.
Please don’t open a public issue for a vulnerability.
The full policy is in SECURITY.md.

Install for VS Code Open VSX Open a live report