Privacy & security

MultiChamber aims for local-first operation, destinations you choose, no telemetry from MultiChamber, and no silent cloud fallback. That's a goal for how the product behaves, not a promise of absolute privacy or isolation. This page explains where the limits are.

What MultiChamber itself sends

• No telemetry. MultiChamber sends no analytics, ads or crash reports.
• Local logs only. Diagnostic logs roll over on your machine and leave out prompt and model-output text.
• Update checks are off by default. If you turn them on, see Update checks for exactly what is fetched.

Where your prompts go

MultiChamber sends model discovery and prompts to the model servers you configure.

• A local server keeps that traffic on your device or network.
• A cloud provider receives the prompts and project context sent to it, and its own privacy and retention terms apply.
• MultiChamber never switches to a cloud provider on its own. The selected model is always labelled Local or Remote.
• API keys belong in environment variables. MultiChamber’s configuration stores only the variable’s name.

The harnesses MultiChamber starts

When MultiChamber starts OpenCode itself, it runs it on your computer only (loopback), with sharing, self-update, model-catalog fetching and free-model discovery turned off. Its environment is rebuilt from an allowlist, so OpenTelemetry exporter settings from your own environment aren’t passed on. Pi runs with its offline and version-check switches on.

These controls apply only to harness processes MultiChamber starts. If you connect MultiChamber to an OpenCode server you run yourself, that server’s own configuration applies.

Tools can still use the network

An agent’s tools can make network requests when their permissions allow it.

• Managed OpenCode asks before shell commands and web fetch or search by default. Allow all is opt-in, and your organization can set or lock this.
• Pi has no per-call prompts. It runs only the tools in its allowlist, which MultiChamber shows you, and those tools (including PowerShell) may reach the network.
• A shell command or other tool you approve may reach the network.

Microsoft WebView2

MultiChamber’s window uses Microsoft’s Evergreen WebView2 Runtime, which Microsoft services separately. In a local-only test run, WebView2 made HTTPS connections to Microsoft; their exact purpose wasn’t established. IT can manage WebView2’s policies and network access separately.

What testing shows, and doesn’t

An automated test samples the TCP connections made by MultiChamber and the harnesses it starts during a run against a local model. In that test, no connection off the machine was observed from MultiChamber, its background service or the harnesses it started; WebView2’s connections are reported separately. That is evidence against regressions, not proof that no traffic is possible for every configuration, tool, component or timing.

Containment

Normal sessions run on your machine with the permissions described above. For stronger containment you can use sandboxed sessions (preview) for OpenCode, or run MultiChamber under your own OS, container or VM isolation with restricted network access. Isolation can’t stop a cloud provider you chose from receiving what you send it.

Update checks

Update checks are off by default, and IT can lock them off.

If you turn on Settings → Updates → Check for new versions, MultiChamber downloads two small files once a day: update-feed.json and its signature, from the MultiChamber GitHub releases. The request carries a MultiChamber/<version> user agent and no cookies, usage data, prompts, settings, project names or identifiers. Like any HTTPS request, it shows GitHub your IP address, and GitHub’s privacy terms apply to it.

• By default MultiChamber only tells you a newer version exists and links to its release page.
• On a per-user install you can also turn on Download updates and install them when MultiChamber quits. MultiChamber then downloads the installer named in the feed, checks its size and SHA-256, and installs it the next time you quit, never during a run. You can also install at once with Restart to update.
• System-wide (MSI) installs are only told about updates. Someone with admin rights, usually IT, installs the new version.
• You or IT can point updates at a folder or your own HTTPS address instead of GitHub. Feeds from anywhere must still carry a valid MultiChamber signature.

How updates are protected

• The feed is signed with Ed25519. The public keys are built into the app, and a feed that doesn’t verify is ignored.
• Each feed expires, normally after 30 days, so replaying an old feed can hide a newer version for that long at most. After that, MultiChamber says it couldn’t confirm the latest version.
• Only a strictly newer version is offered; MultiChamber never downgrades.
• The installer’s size and SHA-256 are inside the signed feed, so a swapped installer is rejected.
• The update feed comes from GitHub releases, or from a folder or HTTPS address that you or IT set. This website doesn’t serve it.

The installers are not code-signed yet. The update feed is signed, but the installer files themselves don’t carry a Windows (Authenticode) signature yet, so Windows may warn when you run one. Until they do, check each download’s SHA-256 against the value published with the release; Download shows how.

Release builds

Release builds pin every bundled runtime to an exact version and check it by hash. Before a release, automated gates check the runtimes’ dependencies for known vulnerabilities, their published checksums, signatures and attestations, and their licenses, and generate the third-party notices that ship with the installer. Vulnerability coverage is partial, a finding can be waived only through a recorded, time-limited exception, and passing these gates is not a full security review.

Reporting a vulnerability

Please don’t report a suspected vulnerability in a public issue. Until private reporting is switched on in the GitHub repository, email blueblock@multichamber.dev.

• Include the affected version or commit, the component, steps to reproduce, the impact and any suggested fix.
• Leave out real API keys, private endpoints, personal data and unrelated system details, and redact secrets from logs and screenshots.
• MultiChamber is pre-release, so there’s no promised response time. Please coordinate public disclosure so a fix can be prepared first.

Vulnerabilities in OpenCode, Pi, Node.js or other upstream software should also be reported to that project.