Get started

What leaves your machine

Nothing, by default. Exactly what zn-gate evaluates locally, what it can send, and the settings that control it.

View .md

Nothing, by default. Everything zn-gate does runs on your machine. The cloud is optional, off until you turn it on, and only ever receives prompt text that was secret-redacted locally first.

Per type of data (zn-gate 1.4.1)

Data Evaluated Sent anywhere?
Tool output (check_tool_result, shield) Locally Never, in any configuration
Tool-call arguments (check_tool_call, shield) Locally Never, in any configuration
MCP tool and parameter descriptions (shield) Locally Never, in any configuration
Prompts (analyze_prompt, zn-gate analyze, Python analyze()) Locally Only if you set both ZN_CLOUD=1 and ZN_API_KEY. Secrets are redacted locally before sending.
Local audit log (~/.zn/evidence.jsonl) Written locally Never

In Python, evaluate, guard, check_tool_call, check_tool_result, sanitize_tool_result, redact_secrets and the LangChain, CrewAI, LlamaIndex and Promptfoo integrations are always local. The only function that can reach the network is analyze(), under the same two conditions.

The settings that control it

  • ZN_API_KEY alone enables nothing.
  • ZN_CLOUD=1 together with ZN_API_KEY lets prompt analysis also ask the cloud model for a second opinion.
  • ZN_LOCAL_ONLY=true (or --local-only) forces local-only, even with ZN_CLOUD=1.

Check your own configuration at any time:

npx -y zn-gate status

The MCP tool zn_status returns the same information to your agent. All settings: Configuration.

When the cloud is on

With ZN_CLOUD=1 and a key, a prompt is first checked by the local rules. If they block it, nothing is sent. Otherwise the text, with secrets replaced by placeholders such as [REDACTED_AWS_KEY], is sent to api.usezn.com for a second opinion from the Galvanize 2 model. If the cloud cannot be reached, zn-gate returns the local result. Retention and processing of what the cloud receives: privacy policy.

Earlier versions

zn-gate 1.4.0 and earlier (npm): with ZN_API_KEY set, tool output and tool-call arguments not blocked locally were sent to api.usezn.com without redaction. 1.4.1 removes that path. If you used 1.4.0 with ZN_API_KEY, upgrade and consider rotating any credential that could have appeared in tool output. Details in the CHANGELOG.

Python 1.4.0 and earlier: only analyze() and zn-gate analyze sent text, when ZN_API_KEY was set, without redaction.