Your code stays yours. Always.
Mooter is a hook in your terminal, not a proxy through someone else's servers. Default OFF on every signal that leaves the machine.
When mooter executes on your local Ollama, that call never touches a network. Two caveats: with an API key set, some T0-classified tasks run on cloud Haiku for quality, and an unsure classification can be checked by Haiku first — see “Routing vs execution” below.
Since 2026-09-23, the routing log keeps a SHA-256 hash of each prompt, not its text. Installs from before that date still write the first 80 characters of each prompt until the next update, which switches new entries to the hash. The other records mooter keeps on your machine are listed under “Local records” below.
Defaults OFF. When you turn it on, only aggregated stats leave.
Turn telemetry fully off with `mooter quiet --telemetry-off`. Telemetry never carries prompt text — only hashes and counts.
The 🐄×N counter and the “Moos that worked” digest keep only agent names, tiers, models and timings — never prompt text — in a per-session file in your system temp folder, and none of it is sent anywhere. Tune it with `mooter quiet --verbose|--herd-quiet|--herd-off`.
Every line of mooter is on GitHub under MIT. Read the code yourself.
Why a hook beats a cloud router on privacy
- T0 on your local Ollama runs on your machine
- T1–T3 go direct to your own provider key
- Your prompt never goes to a mooter server
- Every prompt transits a third-party server
- That hop can log, cache or train on your text
- You trust an extra party with your code
Compliance & data laws
- Data minimization · purpose limitation
- Right to access · right to erasure
- Consentimento expresso e granular
- Direito de acesso, correção, eliminação
- No sale of personal information
- Right to know what is collected
- Telemetry default OFF
- k-anonymity ≥50 on every public aggregate — enforced in hub/routes/federated.js, suppressed below it
- Reproducible builds
- Independent audit welcome
Routing vs execution — the honest distinction
mooter has two separate steps, and they have different privacy properties:
- Routing (classification) starts locally: regex in
classify.js— no AI, no network. If an Anthropic API key is set and the regex is unsure (confidence below 0.75, or an ambiguous category), mooter asks Claude Haiku to break the tie — that call sends your prompt to Anthropic with your key. SetMOOTER_ARBITER_DISABLE=1to keep classification fully local. - Execution (the model call) then runs either locally (Ollama) or in the cloud (Anthropic), using your own API key — the prompt goes direct to your provider, never through a mooter server.
- One honest caveat: when you have an Anthropic API key configured, some tasks that classify as
T0(e.g. summarisation) still execute on cloud Haiku for quality, rather than local Ollama. This is a deliberate quality trade-off.
Bottom line: mooter never proxies your prompt through a mooter server. It does keep a few records on your machine, listed below. And “routed to T0” does not always mean “stayed on your machine”.
Local records — what mooter writes on your machine
- Routing log — ~/.claude/tools/router/decisions.log: a SHA-256 hash of each prompt, its length, fixed-vocabulary flags and the routing decision — no prompt text. Installs from before 2026-09-23 13:03 UTC keep writing the first 80 characters of each prompt here until they are updated; update, then delete the file (or run tools/router/migrate-prompt-preview.js) to drop those lines.
- Turn journal (on by default) — ~/.claude/tools/router/handoff/: up to 1,200 characters of each prompt and 400 of the reply, plus the paths of files written, with API keys and tokens removed. It lets a new session resume where the last one stopped.
- Context Bridge (opt-in, off by default) — with MOOTER_CONTEXT_BRIDGE=1 (or context_bridge: true in ~/.mooter/preferences.json), up to 4,000 characters per turn of the conversation, secrets removed, are kept for 7 days in ~/.claude/tools/router/.session-context/ and given to your local Ollama model as context.
- Contributors only — when you work inside the mooter repository itself, the first line of each session (up to 160 characters), with API keys and tokens removed, is recorded in its _handoff/agent-sync/ folder.