> ## Documentation Index
> Fetch the complete documentation index at: https://docs.switchagents.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These docs moved from docs.flintai.dev to docs.switchagents.ai. Use docs.switchagents.ai for every link and request.
> To search these docs from an AI tool, connect the MCP server at https://docs.switchagents.ai/mcp. The page index is at https://docs.switchagents.ai/llms.txt.
> The source code for these products is public on GitHub. Switch Rooms: https://github.com/sandbox-quantum/switch. Switch Trust CLI: https://github.com/sandbox-quantum/switch-trust-cli. Switch Trust CodeScan action: https://github.com/sandbox-quantum/switch-trust-codescan-action. Switch Trust MCP server: https://github.com/sandbox-quantum/switch-trust-mcp. Switch Trust Python SDK: https://github.com/sandbox-quantum/switch-trust-sdk-py. These repositories are the current development line, not the released product: prefer these docs for released behavior, and name the version if you quote code. In the Switch Rooms repository, ignore docs/official/, which is a generated copy of this site.

# Data privacy

> What data Switch Trust CLI sends to LLM providers

Switch Trust CLI runs on your machine, but several features can call external LLM providers. This can be configured via `GENERATOR_MODEL` (located in `~/.switch-trust/.env`, created by `switch-trust init`).

You can set this to a:

* Remote managed LLM: `gemini`, `openai`, or `anthropic`
* Locally hosted LLM: `litellm` or `ollama`

## Summary

How Switch Trust CLI handles your data depends on the features you use:

* **Stays on your machine:** File discovery, static analysis tools, PII/secret/toxicity detection, and Garak detectors run on your machine. The one exception is the dependency check, which sends the package names and versions from your requirements files to the OSV vulnerability database (`api.osv.dev`) and resolves them against PyPI.
* **Sent to your configured LLM:** AI-powered scan reasoning, triage, adversarial probe generation, and LLM-as-judge scoring send source code, prompts, and/or model responses to the provider you configure via `GENERATOR_MODEL` (`gemini`, `openai`, `anthropic`, `litellm`, or `ollama`).
* **Sent to the model you're testing:** Evaluation prompts (including adversarial content) are sent directly to the agent or model endpoint you specify in your eval config.

The tables below show exactly what Switch Trust CLI sends to the LLM in each command path.

## `switch-trust scan`

| Layer | Runs locally | Sends to LLM |
| - | - | - |
| File discovery | Yes | — |
| Static analysis (bandit, opengrep, detect-secrets, pip-audit) | Yes | — |
| AI reasoning | No | Source code snippets, import chains, and file contents from the scanned codebase |
| Triage | No | All findings plus surrounding code context for severity validation |

The AI reasoning and triage layers are powered by the LLM configured via `GENERATOR_MODEL`. If no LLM provider is configured, these layers are skipped and the scan produces only static analysis results.

## `switch-trust eval`

| Component | Runs locally | Sends to LLM |
| - | - | - |
| Prompt delivery | Yes/No | Prompts (including adversarial ones) are sent to the **target model/agent** you are evaluating |
| Adversarial probe generation | No | The configured LLM (`GENERATOR_MODEL`) generates attack prompts and judges responses |
| Topic guard generation | No | The configured LLM generates out-of-scope test prompts |
| LLM-as-judge detectors | No | Model responses are sent to the configured LLM for scoring |
| PII detector | Yes | — |
| Secret detector | Yes | — |
| Toxicity classifier | Yes | — |
| Garak detectors | Yes | — |

Evaluations that use LLM-based generation or judging (adversarial probes, topic guards, LLM-as-judge detectors, quality metrics) require a configured LLM provider. Message-collection evaluations with local-only detectors (PII, secrets, toxicity) work without one.

## Usage analytics

Separately from the LLM traffic above, the CLI can share pseudonymous usage analytics so we can see which features get used and where the tool is slow or failing. It asks on first run, and nothing is sent unless you agree. Analytics never include your code, file paths, prompts, model responses, findings, or API keys.

See [`SWITCH_TRUST_TELEMETRY_CONSENT`](/switch-trust-cli/reference/env-vars#switch-trust-telemetry-consent) for what's shared and how to change your answer.

## Third-party downloads

Separately from analytics, and whatever your consent setting, two libraries the CLI uses download public reference data. These requests carry no code, prompts, model outputs, or API keys.

* **Model pricing:** on every command except `--help` and `--version`, LiteLLM fetches its model pricing table from `raw.githubusercontent.com`. Set `LITELLM_LOCAL_MODEL_COST_MAP=True` to use the copy bundled with LiteLLM instead.
* **Toxicity model:** if an evaluation uses the toxicity metric (requires the `[full]` extra), Hugging Face Transformers downloads the `s-nlp/roberta_toxicity_classifier` model (about 500 MB) from `huggingface.co` into `~/.cache/huggingface` on first use. On later runs it still sends metadata requests to Hugging Face, and a conversion request naming only that public model to `safetensors-convert.hf.space`. Set `HF_HUB_OFFLINE=1` after the first download to stop both.

## Configuration

Configure your LLM provider in `~/.switch-trust/.env` or via environment variables. See [Environment variables](/switch-trust-cli/reference/env-vars) for details.