Trust & Privacy
Security-first by design
Whether you connect via Admin API keys, wrapped proxy keys, or MCP telemetry — your credentials are encrypted, we do not store prompt or code content, and you control what gets shared.
Connect local tools
One command authenticates your machine and installs the CostHawk MCP for Claude Code, Codex, Cursor, and Gemini CLI.
npm exec --yes costhawk@latest -- --login
CompatibleClaude CodeOpenAI Codex CLICursorGemini CLI
AES-256 key encryption
Admin API keys are encrypted at rest with AES-256-GCM. We never store or see your keys in plaintext.
Wrapped key isolation
Proxy your API calls through CostHawk. Your real provider keys never touch your codebase or client devices.
Local-first parsing
MCP telemetry is computed locally from supported developer-tool data directories before anything leaves your machine.
No prompt storage
We only persist usage metadata: token counts, models, timestamps, and hashed project IDs. Prompt and code content is never stored.
Preview before upload
Dry-run syncs show exactly what would be sent, with payload previews and optional file lists for full transparency.
Opt-in auto-sync
Automatic uploads are off by default. Enable with COSTHAWK_AUTO_SYNC=true and disable Codex sync anytime.