What leaves your machine, and what does not

The engine runs locally and calls nothing. The only operation that crosses the network is the hosted verdict, and the question of exactly what it may carry is still open — so it is written here as open rather than answered smoothly.

Found something? Write to us. We would rather hear it from you than read it in a log.

Local by default

One process, one file, loopback: The server binds 127.0.0.1. The store is a single JSON file you can copy to back up and delete to forget. No model API is called by the engine at any point.
A page in your browser cannot reach it by accident: Any request carrying an Origin header is refused unless that origin is in MNEMOS_ALLOWED_ORIGINS, which is empty until you set it, and a POST without Content-Type: application/json is refused outright — which is the one shape a browser can send without asking permission first.
Bodies are capped before they are read: An oversized Content-Length is answered 413 without reading the body, so a large number in a header cannot consume memory.
Private by default in the graph itself: Nodes carry an audience. Anything exported to a public surface has to be marked public first; the default is not public, and a tool that exports asks for the audience explicitly.

The hosted verdict, and the open question in it

A verdict is produced by comparing an answer against nodes. Producing it on a server therefore means content from the graph reaching that server — which is in direct tension with why people run this locally in the first place. We are not going to pretend that tension is resolved.

Option	What it means	State
Send hashes and short extracts	The server sees enough to score coverage, not enough to reconstruct the node.	proposed
Keep grounding fully local in self-host	The hosted copy exists only for its calibrated thresholds and corpus; anyone who prefers locality keeps it and loses the calibration.	proposed
Fail loudly when the network is down	A local verdict with no server says “verdict unavailable” rather than quietly returning grounded.	decided

The free verdict endpoint on this site checks your text against a public corpus of facts about this product — twenty-two sentences that are printed on these pages. It never touches anybody’s private graph, and it could not: it does not have one.

Keys and rate limits

Key generation	Sixteen random bytes. Returned in full once, at creation.
Key storage	A sha-256 hash plus the visible prefix. The full value is never written down, so it cannot be read back — by us or by anyone who reaches the database.
Revocation	Immediate. The record stays so the count is not lost; the key stops working.
Visitors	The free endpoint counts 20 verdicts a day per address, and stores no address: a visitor is `sha256(salt ‖ day ‖ ip)` truncated to 16 characters. The salt lives in a separate file and never enters the database, so two days of the same person cannot be linked — by us either.
Analytics	Our own web log, counted on our own machine. No third-party tracker on any page, and no cookie set by this site.

What we got wrong

A security page that lists only good news is an advertisement. These are real, and two of them were ours.

An internal feed was served to the public: A route on the old site returned the team’s own agent chat — 549 messages — to anyone who asked, with no password. Found on 8 September 2026 during an inventory of our own infrastructure. The new hub reads your server, not ours, and has no equivalent route.
A payment address had a stale fallback: The checkout read the recipient address from a config file and, if that file were missing, fell back to a hard-coded older wallet. It never fired, because the file was always there — which is exactly why it went unnoticed. Found and replaced the same day.
The application port was reachable around the proxy: The site answered directly on its own port as well as through the proxy, so TLS, security headers and the rate limit could all be stepped past by using the other door.
A probe reported zero dead out of 1507: Not a breach, but the same class of mistake: an exception handler folded every failure into “unknown”, so the catalogue reported a clean bill of health it had never checked. Rewritten into four statuses, one of which is “could not check”.