← Back to Hunch

What stays local. What reaches the model.

Hunch runs on your Mac, but the AI provider still needs task context to make decisions. This page documents that boundary, the controls around it, and the risks those controls cannot remove.

What crosses your Mac

InformationOn your MacSelected AI provider
Saved credentialsSecret values are stored in macOS Keychain.Value stays local The model receives only the service label and whether the fill succeeded, failed, or was refused.
Prompts and tool resultsHunch does not keep a server-side task-history copy.Sent as task context. Results can include text read from apps, files, websites, or terminal output.
ScreenshotsCapture requires macOS Screen Recording permission.Sent only when the task uses the vision fallback.
Settings and approval rulesStored as local configuration.Local control They determine which actions Hunch runs or refuses.

A saved secret is filled, not revealed.

Service labelThe agent requests a saved credential by name, not by value.
Domain checkHunch refuses a domain-bound credential on a different host.
Local readHunch reads the value from Keychain inside the local process.
Direct fillThe value is typed into the page; only the result returns to the agent.

macOS permission is not the same as Hunch approval.

macOS permissions

Accessibility
Reads and controls native app interfaces.
Automation
Allows AppleScript access to each approved app.
Screen Recording
Optional; required only for screenshot-based vision.

Hunch approvals

Foreground access
Can ask before bringing an app forward.
Shared input
Can ask before using your cursor or keyboard.
Risky operations
Can gate destructive file actions and sensitive scripts.

No Hunch-hosted control plane.

Hunch’s SDK and MCP server run as local processes on your Mac. There is no remote Hunch daemon, Hunch account, or Hunch-hosted task-history service. Your selected provider—Claude or ChatGPT/Codex—still processes the context required to run the task under that provider’s terms and account settings.

Read the privacy notice →

Controls reduce risk; they do not make an agent infallible.

  • Prompt injection remains possible.Content in an email, page, or document can try to redirect the model.
  • Models can make mistakes.Review consequential actions and use least-privilege credentials.
  • A compromised host is outside Hunch’s boundary.Hunch cannot protect against a malicious or compromised MCP host that already has access to the local process.
  • Vision can expose visible content.A screenshot used by the fallback can contain anything visible in the captured area.
  • Auto-approval removes a checkpoint.Use it only for work you understand and actively monitor.

Keep approvals on.

Bind credentials to specific domains, keep shared-input and destructive actions gated, and use Hunch’s dedicated browser profile for agent work.

Tell the maintainer.

For sensitive security reports, email prithviseran0@gmail.com. For ordinary bugs, use GitHub Issues. Never include passwords, API keys, or tokens in a public report.