-
Notifications
You must be signed in to change notification settings - Fork 0
Security Summary
Product: Devloop (devloop-mcp) · Version: 0.9.1 · License: MIT (open source)
Vendor: Vincent Vella · Source: https://github.com/vincentvella/devloop · Site: https://devloop.build
Devloop is a local developer tool that helps engineers build and debug web and mobile apps. It drives the developer's own browser, dev server, and mobile simulator, and places their logs, network activity, and errors on a single correlated timeline so problems are easier to diagnose. It is distributed as an npm package (command-line) and an optional desktop application ("cockpit").
It has no hosted service, no user accounts, and no vendor backend. It runs entirely on
the developer's machine and operates against localhost.
| Topic | Answer | Notes |
|---|---|---|
| SaaS application? | No | Local CLI + desktop app. No hosted/multi-tenant service. |
| Vendor SaaS / external storage / external API connections? | No | No backend, no cloud storage, no third-party API integrations. Operates on localhost. |
| Screen-sharing / remote viewing? | No | Screenshots and the live device mirror render locally only; nothing is broadcast. |
| Automatically transmits user data off-machine? | No | No telemetry, analytics, or crash-reporting. Data leaves only via explicit user export. |
| Telemetry / analytics collected? | No | No analytics SDKs present. |
| Listens on a network port? | No | Local HTTP interface binds to loopback (127.0.0.1) only. |
| Stores proprietary / confidential information? | Yes (locally, transient) | May incidentally capture app data; held in-memory and cleared on exit. See "Data handling." |
| Encrypts data at rest? | Relies on OS disk encryption | Local config is plain JSON; no app-level encryption. |
| Open source? | Yes | MIT-licensed; source publicly available. |
Captured content stays in memory and is transient. As a debugging tool, Devloop captures whatever the application under test produces — console logs, network requests/responses, server output, native device logs, and screenshots. This is held in bounded in-memory buffers (oldest entries evicted; network bodies truncated to a few kilobytes) and is cleared when the application exits. It is not written to disk automatically.
Only configuration metadata is persisted automatically — under a local ~/.devloop
directory: project names, working-directory paths, window/pane layout, session state, and
build-fingerprint hashes. No captured logs or network content are stored here.
Browser session data (cookies, localStorage) is stored locally in per-project, isolated browser partitions managed by the embedded Chromium engine, and can be cleared on demand from within the app.
Captured content reaches disk only when the developer explicitly exports it — via an export action that writes a self-contained report (logs, network trace, screenshots) to a file the developer chooses through a save dialog. Because such exports can contain sensitive values present in the app's own traffic (tokens, personal data, screenshots), they should be treated as confidential and reviewed before sharing.
Devloop communicates only with localhost during normal operation. The only outbound
internet traffic is software distribution, not data exchange, and never transmits user
data:
| Activity | Destination | When | Transmits user data? |
|---|---|---|---|
| Version/update check | GitHub Releases | On launch (desktop app) — download requires user confirmation | No |
| Browser engine download | Puppeteer CDN | One-time, at install | No |
| Bug report (optional) | GitHub issue form | Only if the user chooses to file one; user reviews and submits | No |
| Browser extension install (optional) | Chrome Web Store | Only if the user installs one | No |
Firewall allowances (optional): github.com for update checks; *.google.com /
*.gstatic.com only if developers install browser extensions.
- Runs under the developer's own OS user account; no elevated privileges or system services.
- Multi-user machines: each user has a separate local data directory (configurable via the
DEVLOOP_HOMEenvironment variable). - The local control interface binds to loopback only by default and is not reachable from the network.
- Source is publicly available for independent review.