Solutions
Does my code get sent to the model provider?
Yes. Any file the agent reads becomes part of the context it sends to its model provider, and no terminal can change that, because the agent makes that request itself. What a terminal does decide is the second question, which is what ELSE on your machine ends up in that context.
It is the first question people ask and the one that gets answered badly, usually by a vendor with a reason to be vague. You are running an agent against a private repository, on a work machine, under an agreement that may say something specific about where source code may travel. You want a straight answer rather than a paragraph about how much everyone values your privacy.
The honest split is between the agent and everything around it. Forkbench does not read or filter what your agent sends, and it could not without breaking the tool you chose. It runs the same binary you run today. What it does control is its own surface: your repositories, terminal scrollback and shell history stay on your Mac and are never uploaded by us, notebooks are end-to-end encrypted on every plan, free included, so the plaintext is not something we hold either, and a credential you put in Vault reaches the command rather than anything the agent reads. So the model provider sees the code you pointed the agent at, and it does not see a key that never entered the agent's context in the first place. If you need the code itself to stay off a provider entirely, the answer is a local model, not a terminal.
How it works
- 1Assume anything an agent opens has been sent. That includes files it opened without being asked, which several agents do.
- 2Keep the values out of the files it opens. Move secrets into Vault, so the command runs with the key and the context never contains it.
- 3Point the agent at the directory it needs rather than the repository root, so the blast radius is what you chose rather than what it wandered into.
- 4Check your own agreements before running an agent on client code. This is a contractual question more often than a technical one.
Straight about the guarantee: Forkbench does not inspect or restrict what your agent transmits, and any claim that a terminal can is worth distrusting. This page is about what the surrounding tooling adds to the payload, not about limiting the agent itself.