Docs
What leaves the machine
ZYBE sends names, counts, hashes and decisions. It never sends the value of a key, the contents of a file, the text of a prompt, or the page an AI tool read. Every switch, listed.
The rule
Everything is judged on the laptop. What travels to the console is what's needed to name a finding and act on it.
Never sent
- The value of a key or password. ZYBE finds a key by its name and reports its kind and where it sits, plus a hash so the same key is recognised on two laptops. The value is never read into anything that leaves.
- The contents of any file an AI tool read or wrote.
- The text of a prompt, or of an AI's answer.
- A web page or an MCP server's answer. Injected instructions are matched on the laptop; only that it happened, and which patterns matched, travel.
- The arguments of a command, unless you switch on "Commands and evidence in clear" below.
The switches
All under Settings, Rules, Advanced. Each can be set per endpoint group.
| Switch | Default | What it reads |
|---|---|---|
| Scan every | 15 minutes | How often the laptop is described again |
| Keep logs for | 7 days | ZYBE's own logs on the laptop |
| Packages | On | Which packages are installed, so vulnerabilities can be matched |
| Project lockfiles | On | Every dependency of the projects an AI tool works in. The slow part on a big machine. |
| Agent environment | On | The environment of running AI tools, readable only on a whole-machine install. Where most keys are. |
| Project .env files | On | Only in folders an AI tool is actually working in. Names only. |
| Shell profiles | On | Keys exported into every terminal session. Names only. |
| Cloud CLI credentials | On | Whether the AWS and gcloud credential files exist and what they're named |
| Inspect for injected instructions | On | Tool output, on the laptop. Only the verdict is sent. |
| Read transcripts for session activity | Off | For sessions that opened before ZYBE was installed: tool names and counts from the AI tool's own records. Never the text. |
| Token usage | Off | The usage numbers an AI tool records. Counts only. |
| Commands and evidence in clear | Off | The command a call was about to run, and the sentences an injection matched, so you can read a detection back to the words. Truncated, and anything that looks like a key is masked. |
| Send skills and subagents to be judged | On | The text of a skill or plugin, once per version, judged for hidden instructions, then discarded |
Who can see what
Roles decide who can reveal masked text, contain a server, grant an exception, or only read. Every such action is in the audit log, by name, and can't be edited.
Where it runs
The console is hosted in the EU. The sensor talks only to your workspace, over TLS, with a token minted when the laptop enrolled. The sensor package is signed, and a laptop refuses an update whose signature doesn't verify.