> ## Documentation Index
> Fetch the complete documentation index at: https://aspex.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy

> Aspex is fully offline and never sends your data anywhere

<Info>
  Aspex is fully offline. It never sends your data anywhere, requires no account, and has no telemetry of any kind.
</Info>

## What Aspex Does Not Do

Aspex never:

* Sends tool schemas, server output, or scan results to any remote server
* Phones home or checks for updates after install
* Collects usage metrics, crash reports, or analytics
* Requires an account, login, or license key
* Reads credentials - only key names and file locations are reported, never values
* Transmits environment variables, config files, or filesystem paths off-device
* Persists any data outside your local machine

## aspex-attack: The One Exception

`aspex-attack` (and the `aspex scan redteam` subcommand) actively calls live MCP tools with adversarial payloads. This is the only component that sends data over the network - and it sends data **to your own MCP servers**, not to Aspex or any third party.

Explicit opt-in consent is required before any probe is sent. Only probe servers you own or have authorization to test.

## The Only Network Call

The sole network activity associated with Aspex is the binary download at install time:

```sh theme={"dark"}
brew install aspex-security/tap/aspex
# or
curl -fsSL https://raw.githubusercontent.com/aspex-security/aspex/main/install.sh | sh
```

Once installed, Aspex makes no outbound network connections during normal operation - including `aspex scan`, `aspex trace`, and `aspex doctor`.

## Release Integrity

Every Aspex release ships with:

* **SHA-256 checksums** for all binaries, verifiable before execution
* **Full SPDX Software Bill of Materials (SBOM)** listing every dependency and its license

You can verify the integrity of any release before running it.

## Open Source

Aspex is licensed under **Apache-2.0**. The full source is available at [github.com/aspex-security/aspex](https://github.com/aspex-security/aspex). You can audit exactly what runs on your machine.