Your code stays between you and your agent.
Tencil has no server and no account. Your dev site, a small daemon and your agent all run on your machine, and the software sends nothing to us. It is open source, so you can read exactly what it does.
npx tencilRuns on your machine.
There is no Tencil server and no account: your dev site, a small daemon and your agent are all on your laptop. It's open source, so you can read exactly what it does.
Your dev site
Only in development.
Tencil appears on your dev site while you work. Production builds leave it out, so the integration is safe to commit.
Tencil daemon
Locked to localhost.
A small daemon on your laptop carries feedback to your agent. It answers only your own dev sites and turns others away.
Your agent
Your agent, your login.
Tencil hands your prompt to Claude Code or T3 Code on your laptop, signed in as you. It talks to its provider as it always does.
Locked down by default.
The daemon can make an agent edit your code, so it only answers your own dev sites.
Locked to localhost
The daemon listens on
127.0.0.1and only accepts connections from loopback origins:localhost,*.localhost,127.0.0.1and[::1]. A request for any other host name is refused, which blocks DNS rebinding, and a tool that sends no origin is only trusted from your own machine.Only in development
The overlay is a script your dev site loads from the daemon. Production builds leave it out, and for anyone without the daemon running it does not load, so the integration is safe to commit to a shared repository.
Credentials stay put
Credentials live in
~/.config/tencil/credentials.json, readable only by you, and never reach the page. The T3 Code pairing token only carriesorchestration:readandorchestration:operate.Pins outside your repository
Pins are stored per project in
~/.config/tencil/projects/, and the pages you matched to a project in~/.config/tencil/origins.json. Nothing ends up in your code or your commits.Replies stay text
The overlay renders what your agent writes as text, never as HTML, so a reply cannot run script on your page.
You decide what the agent may run
Nobody is at a terminal to approve tool calls, so
--runtime-modedecides up front:full-accessby default, orapproval-required,auto-accept-editsorauto, where tools that need approval are refused.
What leaves your machine.
Everything Tencil talks to, and what it sends.
| To | What |
|---|---|
| Your agent, on your machine | Your prompt, the element you picked and any screenshot you attach. The agent sends them to its model provider, as it does without Tencil. |
| T3 Code, when you pair | The pairing link you copied from T3 Code, exchanged for a token with the T3 Code environment it points to. |
| The npm registry | Where you install Tencil from. The command line also asks it for the latest version, to tell you about updates. |
| Tencil | Nothing. No telemetry, no analytics, no crash reports, no account. |
Found a vulnerability? Report it privately through GitHub. What tencil.dev itself processes is in the privacy policy.
Questions about privacy and security
What stays on your machine, and what does not.
Tencil itself has no server and no account: the daemon runs on localhost and only talks to your agent on the same machine. That agent talks to its model provider, exactly like it does without Tencil.
No. The overlay is loaded from the daemon on your machine, only in development. Production builds don't include it, and for anyone without the daemon running, the script doesn't load and nothing appears.
No. The daemon listens on 127.0.0.1 and only accepts connections from loopback origins such as localhost, unless you pass --allow-origin. Requests for any other host name are refused, which blocks DNS rebinding.
Pins live per project in ~/.config/tencil/projects/, never inside your repository. Credentials live in ~/.config/tencil/credentials.json, readable only by you, and never reach the page.
No. The software sends nothing to us: no telemetry, no analytics, no crash reports. The source code is public, so you can check.
Privately, through the Security tab of the GitHub repository: Report a vulnerability. Please not in a public issue. SECURITY.md says what is in scope.