简体中文

On this page

Privacy And Data Handling

Sigil runs locally, but model providers, Web routes, MCP servers, and approved commands can receive data. Review those destinations before using a sensitive repository.

What Can Leave Your Machine

Depending on your configuration and approvals, outbound data can include prompts, selected conversation context, workspace instructions such as AGENTS.md or SIGIL.md, file excerpts, search matches, diagnostics, command output, Web queries, MCP inputs, and accepted elicitation responses. Enabled workspace instructions become part of model requests. Sigil does not publish a repository by itself, but an allowed provider, tool, or command can transmit what you give it.

Use the provider's policy for model requests and the selected Web or MCP service's policy for external tools. Disable an unnecessary route or deny the action when its destination is unclear.

What Stays Local

Per-user configuration, input history, session logs, change artifacts, cache files, the on-disk copies of workspace instruction files, and /feedback exports stay stored locally by default. Their contents can still leave through model context or another allowed action; workspace instructions are sent to the configured model provider when memory is enabled.

API Keys

Use the provider-specific environment variable listed in Providers, or save the secret through the protected credential store in Quick Setup or /config. This does not mean a secret is never persisted anywhere. The default file policy and non-interactive auto policy use only owner-only ~/.sigil/credentials.json; that dedicated file is protected plaintext, not encryption. Select strict keyring only when native system storage and its possible authentication UI are desired. Current configuration stores only an allowlisted environment-variable name or opaque stored-credential ID. Sigil never writes a newly entered key to sigil.toml, workspace data, model cache, session logs, snapshots, logs, or diagnostic output. Non-current configuration is rejected and is never opened by /config or migrated; replace it with a current template and rotate any key that may have appeared in an earlier plaintext file. sigil doctor reports only the credential source and readiness.

OAuth credentials for a configured remote MCP server are kept in the native system credential store rather than TOML. See MCP for sign-in, sign-out, and local-clear behavior.

Session Logs

Local session logs can contain prompts, assistant replies, tool summaries and previews, approval decisions, interrupted activity, task state, and context-management records. Treat them as sensitive even when the source repository is public. Review any export before sharing it.

MCP And Web Data

MCP servers are external tool providers. Keep secret access disabled unless the server needs it and you trust the destination. Web search sends the query to the selected provider-hosted, configured MCP, or bundled route; the network service can observe the query and connection metadata. Returned content remains external and untrusted. Route and opt-out controls are in Permissions and sandbox.

Doctor And Feedback Output

Doctor output is redacted but can still include paths, provider labels, and local-environment facts. /feedback previews its included categories, writes one local JSON report, and uploads nothing automatically. Review the exported JSON before attaching it to an issue.

Remove credentials, private paths, proprietary source, sensitive prompts or tool previews, internal endpoints, and identifiers tied to private usage. When in doubt, reproduce the problem in a non-sensitive workspace and share that output instead.

Next: Review the Safety guide.