Local inference
tokspur runs model inference on your Mac. The server listens on the loopback interface only and every request needs the local key. It refuses any request that carries an Origin header, so web pages cannot call it. The calling agent supplies the conversation and receives the response through that interface, and it controls its own file access, shell commands, telemetry and connections to other services. Review those permissions in the client.
Bootstrap fetches no model weights. It installs the Python dependencies with pip when it creates .venv or when you pass --install-venv, and fetches the Rust crates pinned in rust/Cargo.lock so that the Rust build itself runs offline. The tokspur command from a release install asks GitHub for the latest release at most once a day and installs it in the background after checking its checksum and signature. Run tokspur update --off to stop it. The server makes no outbound requests: adoption reads the model files you already have, model-hub access runs offline, implicit tokens and telemetry are switched off and loopback addresses bypass any proxy.
Files and state
Everything tokspur writes lives below .tokspur/ in the checkout: the adoption and configuration records, and the private state/ directory (mode 0700) with the API key (mode 0600), the model link, the prefix checkpoints, the per-request records and the native worker's derived artefacts. By default the server stores no conversation text. Switching on the opt-in prefix trace with --private-prefix-trace changes that, because the server then writes token IDs from prompts and from replies that fail validation to state/prefix-trace.jsonl, and a tokenizer turns those back into text. New per-request records, in state/telemetry.jsonl, hold timings, counters, memory figures and sampling settings, and omit reply text and token IDs. Records written by earlier builds retain their reply data until you delete the file. That file stops growing at 16 MB. SSD checkpoints are off by default. Enabling them with --checkpoint-cap-gib writes unencrypted model state derived from recent prompts into an owned tokspur-checkpoints-v2/ subdirectory. They stay on disk across restarts until eviction or deletion and can enter backups or synchronised folders. Choose that location and its retention deliberately. File permissions restrict account access and do not provide encryption. Deleting .tokspur/ removes all of it and leaves the adopted model files untouched, because they were never copied.
This website
This is a static website. Its fonts, scripts and illustrations are served from the same site. The pages contain no analytics script, tracking pixel or account form.
The web host still receives ordinary requests for pages and assets, including network information such as the visitor's IP address. Following an external link takes you to that destination's own service and policies.
Sharing diagnostics
Remove keys, private paths, prompts, conversation text and tool output before sharing a diagnostic report. The troubleshooting guide lists the information useful for investigating a failure.