Skip to main content
Switch Trust CLI runs on your machine, but several features can call external LLM providers. This can be configured via GENERATOR_MODEL (located in ~/.switch-trust/.env, created by switch-trust init). You can set this to a:
  • Remote managed LLM: gemini, openai, or anthropic
  • Locally hosted LLM: litellm or ollama

​
Summary

How Switch Trust CLI handles your data depends on the features you use:
  • Stays on your machine: File discovery, static analysis tools, PII/secret/toxicity detection, and Garak detectors run on your machine. The one exception is the dependency check, which sends the package names and versions from your requirements files to the OSV vulnerability database (api.osv.dev) and resolves them against PyPI.
  • Sent to your configured LLM: AI-powered scan reasoning, triage, adversarial probe generation, and LLM-as-judge scoring send source code, prompts, and/or model responses to the provider you configure via GENERATOR_MODEL (gemini, openai, anthropic, litellm, or ollama).
  • Sent to the model you’re testing: Evaluation prompts (including adversarial content) are sent directly to the agent or model endpoint you specify in your eval config.
The tables below show exactly what Switch Trust CLI sends to the LLM in each command path.

​
switch-trust scan

The AI reasoning and triage layers are powered by the LLM configured via GENERATOR_MODEL. If no LLM provider is configured, these layers are skipped and the scan produces only static analysis results.

​
switch-trust eval

Evaluations that use LLM-based generation or judging (adversarial probes, topic guards, LLM-as-judge detectors, quality metrics) require a configured LLM provider. Message-collection evaluations with local-only detectors (PII, secrets, toxicity) work without one.

​
Usage analytics

Separately from the LLM traffic above, the CLI can share pseudonymous usage analytics so we can see which features get used and where the tool is slow or failing. It asks on first run, and nothing is sent unless you agree. Analytics never include your code, file paths, prompts, model responses, findings, or API keys. See SWITCH_TRUST_TELEMETRY_CONSENT for what’s shared and how to change your answer.

​
Third-party downloads

Separately from analytics, and whatever your consent setting, two libraries the CLI uses download public reference data. These requests carry no code, prompts, model outputs, or API keys.
  • Model pricing: on every command except --help and --version, LiteLLM fetches its model pricing table from raw.githubusercontent.com. Set LITELLM_LOCAL_MODEL_COST_MAP=True to use the copy bundled with LiteLLM instead.
  • Toxicity model: if an evaluation uses the toxicity metric (requires the [full] extra), Hugging Face Transformers downloads the s-nlp/roberta_toxicity_classifier model (about 500 MB) from huggingface.co into ~/.cache/huggingface on first use. On later runs it still sends metadata requests to Hugging Face, and a conversion request naming only that public model to safetensors-convert.hf.space. Set HF_HUB_OFFLINE=1 after the first download to stop both.

​
Configuration

Configure your LLM provider in ~/.switch-trust/.env or via environment variables. See Environment variables for details.