WEAVATRIX 1.12.0

Privacy Policy

Effective: July 30, 2026

The short version

The local Weavatrix MCP is local-first, requires no account, and sends no repository data to us by default. Each response includes transient local execution/output/freshness metrics for the caller; Weavatrix does not persist, aggregate or transmit them as telemetry. No outbound request path is implemented by the native Core package. Online requests require the separately installedweavatrix-online product, a configured destination and an explicit tool call.

What the software processes

The Weavatrix MCP server analyzes source code repositories on your own computer. All analysis (graph building, audits, clone detection, coverage mapping) happens locally. Derived graph data is stored in ~/.weavatrix/graphs/<repository-storage-key>/, including the stable.repository-id, graph.json, graph.prev.json and, when used,precision.json. Advisory data is cached in ~/.weavatrix/advisories.json. By default, no repository data leaves your machine.

Separate search-evidence product (opt-in)

The MIT weavatrix-seo package is a read-only Search Evidence Graph. It does not write pages or apply patches. When you pass a --siteorigin or call an MCP tool that crawls, it fetches only the public HTTP destinations you named. MCP defaults to --public-only and refuses loopback and private addresses. Derived snapshots stay on the machine that ran the command. SEO does not send repository source to Weavatrix.

Separate local write product (opt-in)

The MIT Core does not edit application source. The separately installed MITweavatrix-refactor package can apply a reviewed local edit only after two explicit gates: WEAVATRIX_ALLOW_SOURCE_EDITS=1 and a single-use, plan-bound token. A profile only narrows the advertised tool catalog. The package stores rollback bundles and token state under the repository's .weavatrix/worktree control directory and performs no network request.

Refactor 1.x is native and does not start a language server or execute repository programs, scripts, installers or npx.

Separate network-capable product (opt-in)

The following tools belong to weavatrix-online, not to the MIT core:

  • refresh_advisories — when the tool is invoked, the names and versions of packages pinned in your lockfiles are sent to OSV.dev (a Google-run public vulnerability database) to fetch security advisories. No source code is transmitted.
  • pull_architecture_contract — disabled unless the Hosted workflow is configured. When invoked, it sends the active repository's opaque stable UUID with bearer authentication and receives a validated owner-approved architecture contract. It sends no source, symbol or path.
  • preview_sync / sync_graph — disabled unless you configure an endpoint via the WEAVATRIX_SYNC_URL environment variable. preview_sync constructs a bounded V3 allowlist locally and returns a no-network preview: destination, normalized repository name, opaque UUID, included sections, node/link/byte counts and a canonical payload hash. A request is sent only by a sync_graph invocation carrying both dry_run:false and the exact short-lived confirmation token for that cached payload. A token alone remains a no-network dry-run. The allowlist contains topology plus module/cycle/boundary/health/complexity/stack/package and duplicate-review evidence. Unknown fields are discarded; source bodies, snippets, absolute host paths, environment values, credentials and Git remotes are excluded. V2 remains available only as an explicit graph-only compatibility mode. The endpoint is oneyou chose: your own compatible server or the optional operator preview atapp.weavatrix.com. HTTPS is required except for loopback development endpoints; embedded URL credentials and fragments are rejected. Merely enabling the group or requesting a preview does not upload anything.

Installing or starting Online alone sends nothing. Network activity belongs to named Online tools and requires an explicitly configured destination; synchronization additionally requires the exact preview confirmation token.

Optional Weavatrix Hosted preview

If you explicitly configure app.weavatrix.com as the sync destination, inspect the preview, and confirm it with the returned token, the allowlisted graph metadata described above is stored in Cloudflare D1 and R2. Distinct normalized revisions are retained so the authenticated owner can compare dependency, cycle and architecture changes over time. Identical graph content is not stored as a new revision. Source bodies, snippets, environment-variable values, credentials and Git remotes are not part of the accepted contract.

The current hosted deployment is access-controlled and does not provide anonymous graph sharing. Owners can issue revocable invitations scoped to selected graphs; members can read only assigned evidence. Login sets one Secure, HttpOnly, SameSite=Strict session cookie; only its digest is stored. HMAC-pseudonymized IP and user-agent values are used for login throttling and session security. Owners can pin and export revisions, configure retention, apply cleanup, and delete eligible unpinned non-HEAD revisions. Lifecycle operations are recorded in the repository audit trail.

This website

weavatrix.com is a static page served by Cloudflare. The static site runs no analytics and sets no cookies. Cloudflare may process standard request logs (IP address, user agent) to serve and protect the site, per Cloudflare's privacy policy.

Contact

Questions: open an issue atgithub.com/Weavatrix/weavatrix. Report suspected vulnerabilities privately throughGitHub Security Advisories. See also the public security summary and license.