What stays local. What reaches the model.
Hunch runs on your Mac, but the AI provider still needs task context to make decisions. This page documents that boundary, the controls around it, and the risks those controls cannot remove.
What crosses your Mac
A saved secret is filled, not revealed.
macOS permission is not the same as Hunch approval.
macOS permissions
- Accessibility
- Reads and controls native app interfaces.
- Automation
- Allows AppleScript access to each approved app.
- Screen Recording
- Optional; required only for screenshot-based vision.
Hunch approvals
- Foreground access
- Can ask before bringing an app forward.
- Shared input
- Can ask before using your cursor or keyboard.
- Risky operations
- Can gate destructive file actions and sensitive scripts.
No Hunch-hosted control plane.
Hunch’s SDK and MCP server run as local processes on your Mac. There is no remote Hunch daemon, Hunch account, or Hunch-hosted task-history service. Your selected provider—Claude or ChatGPT/Codex—still processes the context required to run the task under that provider’s terms and account settings.
Read the privacy notice →Controls reduce risk; they do not make an agent infallible.
- Prompt injection remains possible.Content in an email, page, or document can try to redirect the model.
- Models can make mistakes.Review consequential actions and use least-privilege credentials.
- A compromised host is outside Hunch’s boundary.Hunch cannot protect against a malicious or compromised MCP host that already has access to the local process.
- Vision can expose visible content.A screenshot used by the fallback can contain anything visible in the captured area.
- Auto-approval removes a checkpoint.Use it only for work you understand and actively monitor.
Keep approvals on.
Bind credentials to specific domains, keep shared-input and destructive actions gated, and use Hunch’s dedicated browser profile for agent work.
Tell the maintainer.
For sensitive security reports, email prithviseran0@gmail.com. For ordinary bugs, use GitHub Issues. Never include passwords, API keys, or tokens in a public report.