What anyray-connect can and cannot see

anyray-connect is a CLI you run plus a small per-user renewal service. This page states exactly what they read, write, and transmit — and what they have no ability to do.

The posture in two lines

• Content-shaped data stays between your machine and your org's self-hosted gateway — the same path your AI tool already uses. Connect adds no new destination for it.
• Everything that leaves that path is metadata: enums, counts, versions, and hashes.

What it is

Connect points your installed AI coding tools at your org's Anyray gateway. After that one run, two per-user services keep the seat signed in: the credential scheduler extends the same key with a fresh device proof about every 30 minutes. A loopback relay remains only for older gateways and zero-touch MDM bootstrap. Both are unprivileged, run as the signed-in user, and use ordinary OS units — a launchd LaunchAgent on macOS, a systemd --user unit on Linux, or a Task Scheduler task on Windows. There is no kernel extension, root helper, machine-wide proxy, DNS, or CA-certificate change.

What it reads

What	When	Why
Your AI tools' own config files (~/.claude/settings.json, ~/.codex/config.toml, …)	Setup and refresh runs	To point each tool at the gateway — the full list
Its own state under ~/.anyray	Every run	Profile, key expiry, logs
The tool event a coding tool hands its hooks (a tool output or pasted prompt), on stdin, in memory	During a session, on machines where the hook lane applies	To trim oversized tool output before it bloats the context window
Local credential stores that already hold a GitHub Copilot sign-in	Only during an explicit Copilot CLI apply	To route that seat through the gateway's Copilot lane

What it writes

Where	What
Each tool's own config	Base URLs, provider entries, hooks — every edit reversible with --revert
~/.anyray	Everything below — connect's whole footprint
~/Library/LaunchAgents/ (macOS), ~/.config/systemd/user/ (Linux)	The two services' unit files — full paths on the EDR allow-list

Inside ~/.anyray:

Path	Holds
connect.json	The profile: gateway origin, name, team, the seat's short-lived ark_… key and its expiry, enrollment-certificate metadata (identity binding plus the public key)
dev-key.pem	The enrollment private key — its own file, mode 600, never inlined into the profile
device-token.json	The device page's rotating access token (raw) — minted hourly by the daemon, mode 600; a full --revert revokes it at the gateway and deletes the file
bin/	The durable CLI binary (and, for npm installs, a versioned runtime copy)
logs/	Service logs — error class names only, never request content or keys
vscode-extension/	The bundled Anyray VS Code extension (.vsix)
hook-tee/	Your own raw tool output, teed locally before a trim so nothing is lost — mode 600 files, pruned after 24 hours, capped at 50 files, never transmitted; opt out with ANYRAY_HOOK_TEE=off
shell-env.sh, copilot-cli.sh, claude-desktop-native.json	Generated shell/tool wiring

What it transmits

Destination	When	Payload
Your org's gateway	Enrollment, key minting, and the scheduled credential heartbeat	Signed credential metadata; the heartbeat extends the existing key and carries no inference content
Your org's gateway	Your tools' own AI requests	Sent directly by current installs; the legacy compatibility daemon relays byte-for-byte and only fills the key header
Your org's gateway	A hook meets an oversized tool output	That output, for optimization — the same self-hosted gateway the tool's requests already transit, no new destination
Your org's gateway	After a trim; after doctor runs	A counts-only savings beacon (the trim source, the tool name, and character/token counts); content-free health events (closed enums and error class names)
Your org's gateway	Hourly while the daemon runs; once more during a full --revert	Device-page token registration (POST /connect/device-token) — a fresh random token the gateway stores only as a hash; the revert sends a DELETE instead, revoking the seat's token immediately
app.anyray.ai (Anyray's control plane)	Enrollment links / SSO, certificate renewal, and health events only when your gateway is unreachable	Signed, content-free events — HTTPS enforced; a plaintext override is ignored by design
github.com/anyrayHQ/install	Self-update, riding the refresh tick	Nothing — it downloads the published release binary
api.github.com	Once, during an explicit Copilot CLI apply	A seat-access probe using the Copilot sign-in the machine already holds

Where the content-mode caveat does and does not apply

Whether your gateway keeps request content (encrypted, off, or plaintext) is a gateway property, governed by ANYRAY_CONTENT_MODE — see Data boundary. Connect itself captures no prompt or response content: it holds none at rest beyond your own tool output in hook-tee/ on your own machine, and transmits none anywhere your gateway wasn't already taking it.

What it never does

Connect is a config writer plus an out-of-band credential heartbeat. Its legacy compatibility relay is loopback-only. It contains no code path for any of the following, and its design explicitly rejects the osquery-style collection model:

• No keystroke logging, no screen capture, no browser access. It reads the tool configs listed above, not your input devices, display, or browsing data.
• No file inventory or disk scanning. It opens the specific files in the tables above, nothing else.
• No process inventory or system telemetry. Health events describe connect's own checks, not your machine.
• No inbound access. Current direct installs open no listener. When the compatibility daemon is present, it listens on 127.0.0.1 only — port 8785 by default — and accepts no remote connections. There is no remote-control or shell capability of any kind.
• No privilege. Everything runs as you; nothing asks for root or admin.

Quittable and reversible

Turn it down, or off

anyray-connect --no-key-refresh    # keep the tools connected, install no background service
anyray-connect --revert            # remove the services and every config connect wrote

The services are visible, ordinary OS units under your own user account — inspect or stop them with launchctl, systemctl --user, or Task Scheduler like any other. The local hook stores are individually opt-out (ANYRAY_HOOK_TEE=off, ANYRAY_HOOK_CACHE=off).

Verify it yourself

anyray-connect doctor --security-review prints connect's full footprint — executables, service labels, unit files, the loopback port — from the machine it runs on, with no network and no key. Hand it to your security team with the EDR allow-list.