---
title: "What Cork sends · Cork"
description: "Exactly what Cork's hooks send from your machine and what the server keeps: your code's structure (names, signatures, docstrings, line hashes), never your source files; repo-relative paths; shortened commands; switches per workspace; what pull request checks read in each mode; and cork audit to see every request."
canonical: "https://corkcli.com/data"
last_updated: "2026-11-14"
---

# What Cork sends

Hooks v75 and later · Last updated: November 13, 2026

Cork's hooks run on your machine, beside your agents. This page lists what they send, what our server keeps and for how long, and how to check it yourself. It is written from the code; the hooks' source is [public](https://github.com/lithometric/cork) under the MIT license.

## The short version

- **Your source files never leave your machine.** Each file is parsed on your machine and only its structure is sent: names, signatures, docstrings, who calls what, a hash per line and line ranges. Hooks older than v75 send the file's text; the server parses it in memory and discards it. Either way, the server never stores your source files.
- **No absolute paths.** Paths are repo-relative and your home directory is written `~`, in everything sent: commands, notes, closing messages, titles, error text.
- **Commands are shortened** to the program and its repo-relative targets: no environment variables, secrets, inline scripts or heredoc bodies. A workspace can choose to send them whole, still with secrets redacted.
- **Pull request checks read code only if your workspace chooses.** Cork's GitHub App can read a PR's changed files from GitHub to check it, keeping only their structure. Until the owner chooses, it reads file names and changed line numbers only. [Exactly what](#pull-request-checks).
- **Every request is on your machine to read:** `cork audit`.
- **Never sold.** Your code, its structure, your prompts, commands and notes are never used to train models.
- **Cork, free and local, sends none of this to us:** its server runs on your machine.

## What is sent, and when

| When | Endpoint | What |
|---|---|---|
| An agent writes a file | `/report` | The repo-relative path and the file's structure: symbols with their kind, signature, docstring (or the comment just above), hash, span, parameters, and the calls they make with their argument text; imports; the module docstring; a short hash per line; which names appear on which lines. With it: session, agent, model, branch, worktree folder name, a hash for the checkout, a random machine id, the repo's git origin, the IDE and its workspace name, the session title. |
| An agent reads a source file | `/observe` | The same structure for that file. |
| A session starts | `/observe, /brief` | The structure of each tracked source file that changed since the last index; branch and worktree names. |
| A prompt is submitted | `/brief` | The identifiers it names and up to 2,000 characters of its text, used once to find the code it is about. The text is not stored; a numeric summary of its meaning is kept for about two hours, and the code names it mentions are kept with the session (12 hours) so the briefing can learn which files they lead to. |
| An agent runs a command | `/presence` | The shortened command (a search sends its pattern), and whether the repo's tests passed. |
| A turn ends | `/presence` | The agent's closing message, the session's token usage and its title. |
| A turn or a session ends | `/brief/outcome` | How the briefing was used: counts, and the repo-relative paths they are about (briefed files written, read or never opened; files written that no briefing showed). Never a file's text. |
| A check or test run finishes | `/verified, /verify, /attribute` | The shortened command, pass or fail, the paths it covered, and the paths and symbol names a failure named. |
| A test fails, then passes on unchanged code | `/flaky` | The test's name and two counts (runs and failures), never its output or any code. |
| Git trouble, weekly history | `/land` | Counts only: conflicts, rejected pushes, reverts, commits per week. |
| Agents message each other | `/message, /inbox` | The message text. |
| The real-time protocol | `WebSocket` | Your git email, the session and repo; then keys (path::symbol), operation kinds, versions and content hashes, and for a rename, signature change or move the new name, signature or path. Never a file's text. |
| An agent calls a Cork MCP tool | `/mcp` | The tool's arguments, as the agent wrote them. The report_edit tool takes a file's text: the server parses it in memory and discards it. With hooks installed, the hooks report edits instead. |

Reads outside the repo send only a `~`-relative path, and nothing at all for paths that look like keys or credentials. An agent that saves a recipe with `cork apply --save` sends the edit operations it saves. Signing a machine in sends its host name, operating system, a random id and its totals.

## How commands are shortened

A command is split the way a shell would split it. The first program keeps its flags and repo-relative targets (at most six); after a pipe only program names are kept. Navigation, variable assignments, redirects, heredoc bodies, the script of `python -c` or `node -e`, arguments with spaces, anything shaped like a credential, and credentials or query strings in URLs are dropped.

| The agent ran | Cork receives |
|---|---|
| `cd server && CORK_X=0 .venv/bin/python -m pytest -q tests/test_api.py 2>&1 \| tail -30` | `python -m pytest -q tests/test_api.py \| tail` |
| `STRIPE_KEY=sk_live_… npm run seed` | `npm run seed` |
| `python3 -c 'import os; print(os.environ["SECRET"])'` | `python3 -c …` |
| `git commit -m "fix the leak in billing"` | `git commit -m …` |
| `git clone https://kevin:hunter22@github.com/a/b` | `git clone https://github.com/a/b` |
| `grep -rn compute_tax src/` | `searching "compute_tax"` |

## Your workspace's switches

The workspace owner sets these in the dashboard, under Settings. Each machine's hooks apply them before anything is sent, and our server applies them again on arrival.

| Switch | Default | What changes |
|---|---|---|
| Closing messages as notes | On | Off: the closing message is sent empty. Teammates' agents won't get your agents' notes in briefings, and the dashboard won't show what each turn said. |
| Session titles | On | Off: no conversation title or subagent name is sent. Agents show as their model and session. |
| Full shell commands | Off | On: commands are sent whole, up to 300 characters, still with local paths stripped and secrets redacted. |

## What we keep, and for how long

**Code structure**, per file, and the graph of who calls what. File text is never stored, whichever version of the hooks or MCP tool sent it; the change view shows which lines changed, not their text. **Activity**: edits (paths, line counts, changed symbols), checks, intents, messages between agents and token usage, visible for 30 days on Free, 90 days on the paid plan, unlimited on Enterprise. **Notes** saved on purpose, and the first paragraph (up to 400 characters) of a turn's closing message, kept as the note on the code it changed. **Handoffs**: when a session ends with work left, the files and symbols it changed, its last test result and the sentences of its closing message that say what remains, for three days (the structure only, with closing messages off). **Briefing outcomes** per path, fading by half every two weeks. **Presence**: what an agent is doing now (three minutes), its last action and title (seven days). **Prompts** are not stored: only a numeric summary of their meaning, for about two hours, and the code names they mention. **Email bookkeeping**: your email settings; which emails went to whom, so each is sent once (a day to 30 days); a commit's author email, repo and hash when a teammate's hooks see a commit that reached the repo without Cork (seven days); each person's last agent activity per workspace.

## Pull request checks

Where Cork's GitHub App is installed, it posts a check named Cork on every pull request, and one comment when something overlaps it: another open PR, a teammate's agent, callers the PR leaves behind, a pinned note. Your machine sends nothing for this; the App reads from GitHub. Whether it reads code is the workspace owner's choice, asked right after install and kept under Settings, Integrations.

| Choice | What Cork reads | What Cork keeps |
|---|---|---|
| Keep code off (the default until the owner chooses) | The PR's file names and the line numbers of its changed hunks, from GitHub's pull request files API. The patch GitHub sends with them is dropped unread. | Per open PR: its file names, its changed line ranges, and the symbols those lines fall in on the map your agents' Cork already reported. |
| Read code | Each PR's changed files at its base and its head, through GitHub's Contents API; once, a tarball of the default branch to build the map; after each push to the default branch, the files it changed. At most 512 KB a file; vendored, generated and binary files are skipped. | The same structure the hooks send (names, signatures, docstrings, who calls what, line ranges), in the workspace's code map; per open PR, the symbols it changes and the names it calls. Files are parsed in memory; their text is never stored or logged. |

Either way, each open PR's number, title, author's GitHub login, branch names and head commit are kept while it is open and dropped when it closes or merges. Comments name teammates by GitHub login, never by email, and on a public repo a pinned note's text stays in Cork. Turning code reading off stops every read at once; the structure already in the map stays, as the hooks' does, until you clear the repo's map in Settings. Pull request checks are free on every plan and use no agent hours.

## What we email

Only something a person must act on that no agent can fix. A collision Cork already handled is never emailed. An email names people, repos, workspaces, paths and symbols and gives counts, as the dashboard shows them, with a link to the page that acts on it: never code, file text, commands, prompts, a decision's text or what anyone wrote in a message.

| Email | To | When |
|---|---|---|
| Someone is at the door | the owner | A join bounced off the seat limit; a viewer asked to buy their own seat (one-click approve); a teammate's agent has worked for an hour in a repo the workspace asks about first (one-click add). |
| Billing | the owner | The month's agent hours reach 80% or run out; a payment failed (at once); a workspace holds enough units to be priced as Enterprise; on a seat plan still held, its end date nears, its trial ends within three days, or every paid seat is taken while an invite is open. |
| A decision gone past | its author | An agent held by your standing decision wrote anyway: accept it or revert it. |
| Your machine went dark | you | At least two of your commits, six hours or more apart, reached a repo without Cork while none of your agents reported. The fix: cork login. |
| Tests your change broke | you | Your change failed tests in code that calls it, and no run has passed for an hour. |
| Messages waiting | you | Something addressed to you has sat unread for three hours. One email a day, senders and counts only. |
| The Monday summary | the owner | Their own report card (coordination type, streak, catches, agent hours, tokens saved, against the week before), money saved, collisions caught, who was active, what is still open. Skipped when there is nothing to say. |
| Back at work (off until you turn it on) | teammates who asked | Someone starts again after 1, 3 or 7 days away (you choose): where, and which paths and symbols first. At most one an hour. |

At most one email of each kind a day per person (an hour for back at work), except a failed payment. Every email has an unsubscribe link that works without signing in, and one-click unsubscribe in mail apps; every switch is also under the dashboard's gear, and the owner's on the Settings tab. Cork, free and local, sends no email.

## See it yourself: cork audit

Every request the program makes, HTTP and WebSocket alike, is written as it leaves to `~/.cork/audit`: the time, the endpoint, the body exactly as sent (credentials masked) and the size of each field. The log stays on your machine, for 7 days and at most 20 MB.

```
cork audit               the latest 20 requests
cork audit --since 1h    only the last hour
cork audit --full        with each body as it was sent
cork audit --json        the records as JSON lines
```

## Cork, free and local: nothing of yours leaves

The free version's server runs on your machine and listens on `127.0.0.1` only. Everything above goes to it and stays in `~/.cork/local`. The program contacts us only to check for a signed update of itself, and, if you sign the machine in, to record the machine.

How we handle account, billing and analytics data, and the coordination data we may learn from, is in the [privacy policy](https://corkcli.com/privacy).

This page in HTML: https://corkcli.com/data