Your code stays home.
No account, and your code stays on your machine. A usage ping sends the command or tool name and whether it worked. PRISM_PULSE=0 turns that off. Prism keeps its library in ~/.prism/ and does not write that library into your checkout. prism install --project and prism strength --repo do write config into the repository.
Local analysis
The map, the impact and the checks all run on your machine. Analysis has no model.
One network call
At most once a day, a published install asks registry.npmjs.org for a newer @prismapp/mcp-server. The request carries no repository data, and Prism never downloads or installs the update itself. A checkout of this repo does not check. Set PRISM_SKIP_SELF_UPDATE=1 to turn it off. A server added by hand with npx is downloaded from npm by npx.
Tested
No-network tests fail the build if analysis reaches the network. The daemon test only allows loopback.
What is stored
All under ~/.prism/. prism uninstall --purge also deletes ~/.prism and this repository’s .prism.
| Path | What |
|---|---|
workspaces/<key>/cache/ | The SQLite index: file metadata, symbols and graph edges |
workspaces/<key>/hooks/ | The hook snapshot and the session baseline |
workspaces/<key>/receipts/ | Stop receipts. prism data prune keeps the newest 20 |
workspaces/<key>/memory.json | Notes saved with prism remember |
workspaces/<key>/feedback.jsonl | Paths prepare suggested, paths that were edited, and short task stems. Kept 30 days. No file contents |
sessions/ | Hashes of what a session already showed, kept 24 hours. No file contents |
skills/<habit>/SKILL.md | One file per habit, readable only by you. A step that looks like a secret is refused |
lenses/lenses.json | Lens definitions, shared by every repository |
config.json | Strength, and which extra tools are on |
events.jsonl | What the hooks, the daemon and the snapshot writer did. Rotated at 5 MB |
install.json | What prism install wrote, so uninstall can remove exactly that |
update.json | The cached update check |
This website
Everything above is about Prism. This site, prismhq.in, counts visits with its own Umami analytics (pulse.shaileshjha.in). It keeps a random device id in a pulse_did cookie for up to 400 days, and records the page, referrer, screen size, language, time zone, connection type, and which install, navigation, docs, and GitHub controls were used. It never sees your code.