Status only. Never your code.
AgentBell is built so that nothing sensitive needs to leave your computer. This page lists every field the hook sends, what it never sends, and how we store it.
Last updated 9 November 2026 · by the AgentBell team at Surge Software
What the hook sends
Each event is a small JSON message over HTTPS to our server, signed in with a token that belongs to that one computer.
| Field | What it is | Example |
|---|---|---|
agent | Which agent: claude-code, codex, cursor or run | claude-code |
session | The agent’s own session id (random) | a1b2c3d4-… |
kind | What happened: started, prompt, tool, waiting, finished, failed, ended | waiting |
project | The folder name only, not the full path | checkout-api |
branch | The git branch | fix/refund-rounding |
task | First line of your prompt, max 120 characters, secrets removed. Off in private mode. | Fix rounding in partial refunds |
message | Why it waits, e.g. the tool it wants. Off in private mode. | Wants to use Bash |
tool | Name of the tool in use | Edit |
model | Model name from the local log | claude-sonnet-… |
tokens_in / tokens_out / cost_usd | Totals counted on your computer | 182000 / 9400 / 0.61 |
files | Names of changed files from git status. Off in private mode. | src/refunds.ts |
What it never sends
- Source code, diffs or the contents of any file
- Your full prompts, or the agent’s answers or thinking
- Command output, test output or logs
- Environment variables,
.envfiles, API keys, tokens or passwords - Full file paths on your disk (only the project folder name)
How secrets are kept out
- The CLI is one readable file (
agentbell.mjs, no dependencies). You can read every line before you run it. - Before anything is sent, short text fields go through a filter that removes things that look like keys and tokens (OpenAI, Anthropic, Stripe, GitHub, Slack, AWS, Google, Razorpay, JWTs, private keys, passwords in URLs,
password=…) and long hex strings. - The server runs the same filter again, as a second line of defence.
- File names that look like secrets (
.env,*.pem,*.key,id_rsa) are replaced with “[secret file]”. - Private mode (
agentbell private on) sends only status, project name, branch and numbers.
Cost and tokens
Claude Code keeps a local log of each session on your computer. The hook reads the token counts from that log on your computer and sends only the totals. Cost is an estimate from public list prices and is shown as “est.”.
Approve from phone
This is off until you turn it on in Settings and install with --approvals. When on, the hook sends the tool name and a short summary (for example the command, secrets removed) so you can decide. If you don’t answer within 90 seconds, Claude Code shows its normal prompt in your terminal. AgentBell never approves anything by itself.
Connecting a computer
agentbell login shows a short code. You approve it while signed in to the dashboard. The computer then gets its own token, stored in ~/.agentbell/config.json with owner-only permissions. Our database keeps only a SHA-256 hash of it. Remove a computer in Settings and its token stops working at once.
Where data lives and for how long
- On Surge Software’s own servers in India, behind Cloudflare. Traffic is encrypted with HTTPS.
- Session history is kept for 7 days (Free), 90 days (Pro) or 1 year (Team), then deleted automatically.
- Passwords are stored as bcrypt hashes.
- We do not sell data. We do not use your data to train AI models.
- Sub-processors: Cloudflare (network), your browser’s push service (Google, Apple or Mozilla) for notifications, Razorpay for payments. Telegram only if you connect it.
What we do not claim
We hold no security certifications (such as SOC 2 or ISO 27001) today. If you need something we don’t offer, tell us.
Report a problem
Email [email protected]. We reply within 2 working days.