Privacy and governance

What the plugin observes, what it sends, and what it does with the answer. This is the page to read before installing.

What is observed

The hooks match these tool calls in your session:

Bash  Edit  Write  Read  Glob  Grep  WebFetch  Agent  mcp__*

Every matched call is checked against your organization's governance policy before it runs, and recorded afterwards.

What leaves your machine

Not the tool input. Two derived values are sent, and nothing else from the call:

Field	What it is
Content digest	A SHA-256 hash over the tool's input, canonicalized so the same input always hashes the same way. It matches repeat calls to each other; it does not carry the input and cannot be reversed into it
Summary	Deliberately lossy, and computed differently per tool — see below

The summary, per tool

Tool	What is sent	What is not
Bash	The first word of the command — git, npm, rm	The rest of the command line: no paths, flags, or arguments
Edit, Write	The file path relative to your working directory. A path outside it collapses to the bare filename	The file's contents, and the absolute path of anything outside your project
WebFetch	The hostname — example.com	The path, query string, or fragment
Read, Glob, Grep, Agent	The tool's name, nothing more	Which file, which pattern, which prompt
mcp__*	The tool's full name, which identifies the server and operation	The arguments it was called with

So we learn that you ran git, edited src/auth.ts, and fetched something from example.com. We do not learn the command, the code, or the URL.

Be clear-eyed about the residue. A first word, a project-relative path and a domain still describe your activity in outline. This is a much smaller disclosure than a session transcript, not a zero one, and you should install knowing which of the two it is.

One exception, stated plainly

Calls to NobleCloak's own MCP tools do not go through this local check at all. They are allowed immediately by the hook and governed at our gateway instead, where the full call is already visible because we execute it — see the connector documentation and our privacy policy.

This avoids governing the same call twice. It also means the digest-only guarantee above describes local tool calls, not NobleCloak tool calls. Do not read it more broadly than that.

Audit-only is the default

Mode	What happens to your tool call
Audit-only (default)	Nothing is ever blocked. The call is checked and recorded, and it runs — including when the server says deny
Enforce (opt-in)	The server's decision is obeyed: allow, prompt you, or block

An organization turns enforcement on deliberately, per environment. Run /bianoble-status to see which mode you are in — it prints audit-only or ENFORCE on every run.

If a page or a colleague describes the plugin as "governing" your session, check the mode before believing anything is being blocked. By default, nothing is.

When NobleCloak is unreachable

The plugin never silently drops a decision, and never hangs your session waiting for us. Every network step shares a budget well under the hook timeout, so a decision is always produced.

Mode	Read-type tools	Write, delete, admin, or external
Audit-only	Runs	Runs
Enforce	Runs — fail-open	Blocked — fail-closed

Calls resolved this way are marked as degraded in the audit record, so an outage is visible afterwards rather than being indistinguishable from a clean allow.

Where the record goes

Locally into a queue, then to NobleCloak, and into the Execution Ledger — the org-scoped audit log your organization can read and export. Retention and handling are covered in our privacy policy.

Turning it off

/bianoble-logout clears the governance session; the hooks then have nothing to report with. Removing the plugin through /plugin removes the hooks entirely. Records already written stay — they are an audit trail, not a cache.