Home / Docs / Reference

What leaves your machine

Exactly what DepWall sends, where, and what each service can learn from it — including the case where your own code does leave.

Every claim on this page is checkable against the source. Where the honest answer is complicated, it is written out rather than rounded off.

The short version#

DepWall's own servers never receive your code. Not a file, not a diff, not a path, not a repository name. The only thing they see is a public package coordinate — an ecosystem, a name and a version — which is the same thing you are about to ask a public registry for anyway.

There is one way your code leaves this machine, and you switch it on yourself: the LLM judge. See below, because it is the part a privacy page usually omits.

Every outbound request, by name#

Goes to	Carries	When
`api.depwall.com` our cache	Ecosystem, package name, version. Nothing else — no account, no API key, no repo, no path.	Only if `DEPWALL_CLOUD_URL` is set. Unset, DepWall never contacts us at all.
Public registries npm, PyPI, crates.io, Go proxy, Homebrew, RubyGems, Packagist, Maven Central, NuGet	The package name being checked, in a normal metadata request.	Every check. Your package manager is about to ask the same registry for the same package.
`api.github.com`	The URL of a repository you asked to scan, or a source repo named in a package's own metadata.	Only `depwall scan <url>`, and README fetches for Go and Rust packages.
`api.anthropic.com` your key, your account	Content. See below.	Only with `ANTHROPIC_API_KEY` set, and only for a package the deterministic signals could not resolve.
Your policy host if your org runs one	Your organisation id and its token.	Only if all of `DEPWALL_POLICY_URL`, `DEPWALL_ORG`, `DEPWALL_ORG_TOKEN` and `DEPWALL_POLICY_PUBKEY` are set.

The judge is the exception, and it is a real one#

DepWall resolves most packages with deterministic signals that run entirely on your machine. What they cannot resolve goes to a language model — and the model has to see the thing it is judging.

For a package, that content is public: the name, version, description, README, manifest fields and install-script bodies, all of which were about to be downloaded from a public registry and run on your machine.

For depwall scan over a local path, that content is your files — the skill, agent config or document being vetted. If you have a key set, the text of those files is sent to Anthropic.

Two things make that a different bargain than it sounds:

It goes to Anthropic under your own API key and your own account, directly. There is no DepWall proxy in the path, and we never see it. Your agreement with your model provider is the one that governs it, not ours.
No key, no judge, no content leaves. Without ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN, DepWall runs signals only and says so on stderr rather than failing quietly. The gray zone stays at ASK — the gate gets noisier, never more permissive.

What our cache can learn#

Someone, somewhere, asked about a public package. That is the whole of it.

The endpoint is unauthenticated and read-only, so there is no account to tie a request to. On a failure it writes one structured log line carrying the ecosystem, the package name and the error — never the caller's IP and never a request header, and a test asserts that rather than a comment promising it.

Verdict counters exist for the cache-hit rate and for what the gate is stopping. Each records the ecosystem, the tier and the signal that fired. The package name is deliberately not among them. It is already in the request URL, so recording it would leak nothing extra about one request — but a metrics dataset is a queryable history, and "someone asked about package X" is a claim we accept per request rather than one we want to accumulate into a record of what a population installs.

What never leaves, under any configuration#

Source files, diffs, file paths, directory listings and repository names.
Your lockfiles. They are parsed locally; only the resolved public names and versions are ever looked up.
Your private registry hostnames and credentials. .npmrc, .cargo/config.toml and friends are read to detect registry redirection and are never transmitted.
Environment variables, tokens and secrets. DepWall reads its own configuration and nothing else.
Anything at all, if you never set DEPWALL_CLOUD_URL. The offline path is a complete product: signals, the lockfile walk, and a malicious-hash list baked into the release rather than fetched.

If you want none of it#

unset DEPWALL_CLOUD_URL      # no shared cache — every check is local
unset ANTHROPIC_API_KEY      # no judge — no content leaves, gray zone stays ASK

DepWall still gates every install. It loses the shared verdict cache and the judge's reading of the gray zone; it keeps every deterministic signal, the full lockfile walk, registry-redirect detection and the exact-tarball denylist. Public registries are still contacted, because a package cannot be checked without its metadata — and your package manager was going to contact them regardless.