Security & Privacy

Command Code is designed with security and privacy as core principles. Your code stays yours — we never train on it, and you control exactly what Command Code can access.

Your Data

What	Stored?	Where	Used for training?
Source code	Never stored	Your machine only	No
Taste profile	Local + optional cloud sync	`.commandcode/taste/` and `commandcode.ai`	No
Conversation history	Local only	`~/.commandcode/projects/`	No
Authentication tokens	Local only	`~/.commandcode/auth.json`	No
AGENTS.md	Local only	Project root	No

Privacy

Command Code does not train on your code. Taste learning runs locally and stores preferences as structured rules — not code snippets.

Permission Model

Command Code uses a permission system that puts you in control of every action. By default, any action that modifies your system requires explicit approval.

Permission Modes

Mode	File reads	File writes	Shell commands	When to use
Default	Allowed	Requires approval	Requires approval	Day-to-day work
Plan	Allowed	Blocked	Blocked	Exploring and designing
Auto-Accept	Allowed	Allowed	Allowed	Trusted iteration

Switch modes with shift+tab inside a session, or start with a specific mode:

cmd --plan                         # Start in plan mode
cmd --auto-accept                  # Start in auto-accept mode
cmd --permission-mode auto-accept  # Start in auto-accept mode (long form)

Project Trust

The first time you run cmd in a project, Command Code asks whether to trust that directory. This prevents accidental execution in untrusted locations.

cmd --trust  # Skip the trust prompt

Headless Mode Permissions

When running in headless mode (cmd -p), all write operations are blocked by default. This keeps CI/CD pipelines and scripts safe.

To enable writes in headless mode, you must explicitly pass:

cmd -p "fix lint errors" --yolo

--dangerously-skip-permissions is also accepted as an alias.

Warning

Only use --yolo in trusted environments like your own CI pipelines. It allows Command Code to modify files and run shell commands without confirmation.

Network Access

Command Code connects to the internet for:

API requests to the AI provider (Command Code or Anthropic)
Authentication via OAuth (during cmd login)
Taste sync when you push/pull taste profiles
MCP servers you explicitly configure

Command Code does not make any network requests for telemetry or tracking without your knowledge. See Telemetry for details on what optional telemetry is collected and how to opt out.