Local token capture

Centrail is local-first. The CLI does all reading and matching on your machine.

What leaves your machine

Per usage event, exactly these fields:

• Token counts (input, output, cache read, cache creation)
• The model name
• The timestamp
• An opaque event id (the agent's own request id, used to dedupe)
• The session id your agent gave the conversation
• The branch name
• The repository the event belongs to: its canonical remote (for example github.com/acme/api, never a path or a credential; for a repository with no remote, its first commit's sha), its first commit's sha, and its folder name. A folder that is not a git repository is sent as its folder name and a keyed hash of its path, never the path.
• How the CLI chose that repository: the session's folder is inside it, the files the turn touched are in it, or the session's previous turn was there. The touched paths themselves stay on your machine.
• A random install id, generated once by the CLI in place of your machine's name
• Fast mode and the number of web searches, when your agent logs them

Per sync: which agent the events came from (Claude Code, Codex, Copilot CLI) and the CLI version.

If you enable attribution, per commit: the repository (as above) and folder name, the commit sha, the branch name, the commit time, lines added and deleted, files changed, whether the commit shipped to the default branch, the squash commit it shipped as when it was squash-merged, and whether you authored it (yes or no; your git email stays on your machine). Per repository: its size (line and file counts), and whether the list of its recent commits is complete.

Two settings in ~/.config/centrail/config.json send less: hideRepoNames replaces the repository with a hash and keeps its folder name and first commit on your machine; hideBranchNames keeps the branch.

That is the whole list. The CLI keeps the network shape as an explicit allowlist, so a field cannot start leaving because a parser learned to read it. The server enforces the same allowlist on arrival and drops anything else, whatever the client version.

What never leaves

• Source code
• Prompts or completions
• Git diffs or commit messages
• File contents
• Working-directory paths, or the paths of files your agent touched
• Hostnames or your operating system
• Your agent's account details (email, organization ids) or its version
• Your git email
• Copilot's encryptedContent and reasoningOpaque blobs
• Any prompt or completion text from any agent

CLI releases before 0.5.1 also sent the session's working-directory path and the machine hostname. Since 0.5.1 (2026-09-28) they do not, the server refuses them from older clients, and stored values were cleared. The operating system and the agent's version and entrypoint, which older releases also sent, were stored until 2026-10-01; the server no longer accepts them, and stored values were cleared.

You can exclude any repository from attribution with centrail exclude <repo>, and revoke any machine's token from your Profile, which immediately stops that machine from syncing.