Docs · Egress & trust
Know exactly what left your machine.
Corvi is local-first, so the question worth answering is what's allowed out. Every outbound call is opt-in, budgeted, and logged.
Opt-in per source
Nothing leaks by default. Each outbound surface — an MCP server, web_fetch, an integration — is enabled explicitly, per source. A run with no egress enabled makes no outbound calls beyond the model provider you configured. From the CLI, that means an --mcp server or --allow-web must be passed for anything to leave.
Fetch budgets
Outbound tool calls are capped by a per-run fetch budget (--max-fetches, 20 by default). Hitting it stops the run with a clear reason rather than quietly fanning out, so a run's outbound footprint is bounded and predictable.
A spending cap, too
The same guardrail covers cost. Set --max-cost and Corvi reserves against billed spend before each model turn — once the cap is reached it pauses cleanly instead of funding another paid call. It's off by default; turn it on for a hard ceiling on what a single run can spend.
Every call is audited
Each egress event is written to the run log with its arguments hashed — so the audit shows what left the machine and why, without recording the payloads. The app surfaces this as a read-only network-activity view per plan.
Untrusted content is wrapped
Content fetched from outside is wrapped before it reaches a model, so a malicious page can't smuggle instructions into the plan. The trust tier of every piece of evidence is tracked end to end.
Your keys, your providers
Model calls go straight from your machine to the provider on your own key — Corvi isn't in the path. For the env-var names, see Configuration.