What do AI coding tools send over the network? I logged four of them

I use AI coding tools every day, and I could not answer a basic question about them: while one is working in my project, which servers does it talk to?

So I measured it. This post covers the method, the results, and the limits, and you can repeat every step.

The setup

Each tool ran the same short scripted session in a throwaway project:

1. List the files.
2. Add a function.
3. Run the tests.
4. Explain a file.
5. Exit.

All traffic went through a local intercepting proxy (mitmproxy) on a fresh Ubuntu image. The proxy logged one row per request: time, host, path, method, byte count and content type. It did not store request or response bodies.

Three of the tools were pointed at a local model, so no prompt had any reason to leave the machine. The fourth only works with its vendor's hosted model, so its model calls are expected traffic.

Every tool ran twice from a clean state, to see whether the behaviour repeats.

What I found

Tool	External hosts contacted	What the requests were
A	2	1 update check, 5 asset downloads
B	1	4 downloads of a model catalogue
C	2	1 asset download, plus 83 package-registry requests on the first run and 4 on the second
D	2	model calls to the vendor, plus 6 to 7 requests to a third-party log-intake host

Three things stood out.

Only one tool contacted a telemetry host. Tool D sent 7 requests in one run and 6 in the other to a logging service. With its documented telemetry opt-out set, it sent none. A later version of the same tool behaved the same way by default.

"Local model" does not mean "no network". Tools A, B and C all talked to a local model, and all three still contacted outside hosts for update checks, asset files and package downloads. None of those requests matched a telemetry rule. They are still connections you may not expect on a locked-down machine.

The host list was stable. For every default run, the set of external hosts was identical across both runs. Request counts moved a little.

The tool names, versions and raw logs are in the repository, so you can check each row.

What this does not show

• It only sees traffic that honours proxy settings. A program that opens its own sockets is invisible to this method.
• It is one short session. A longer or different session may reach other hosts.
• I logged hosts and sizes, not contents. I did not test whether a secret planted in the project leaves the machine.
• The classification of each host (update check, asset, telemetry) is a small rule file. Read it and disagree with it.

Run it yourself

You need bash, python3, git, Node.js (for npx) and mitmproxy. The script runs one tool, opencode, against a local model, so you also need Ollama running with the model pulled: ollama pull qwen2.5-coder:7b.

git clone https://github.com/ripplarity/stillherd.git
cd stillherd/egress
bash run_tool.sh

That runs opencode through the scripted session and writes requests.jsonl. It takes under ten minutes. The README in that folder explains the method and how to compare two runs.

Why I care

A privacy policy tells you what a vendor intends. A request log tells you what happened on your machine on a given day. The second is something you can check, keep and compare after the next update.

If you run this on your own setup, I would like to know what it shows, and where the instructions failed you.