Security
Your code never leaves your machine
Locus is GitHub-native with zero infrastructure. Local execution, git isolation, and full source transparency.
Runs entirely on your machine
Locus agents execute locally using your own AI provider credentials. Your code, your prompts, and your output never pass through any third-party server. The CLI communicates directly with GitHub via the gh CLI and with your AI provider — nothing in between.
GitHub-native — no custom backend
There is no Locus server, no database, and no cloud API. All project data — issues, sprints, status, PRs — lives entirely on GitHub. You control access through standard GitHub repository permissions.
Fully open source
Every line of Locus is MIT-licensed and available on GitHub. You can audit the code, verify what data flows where, and modify anything. No black boxes, no proprietary backends processing your code.
Credentials stay local
No API keys are stored in the Locus config. GitHub auth is handled by the gh CLI. AI provider credentials are managed by environment variables (ANTHROPIC_API_KEY, OPENAI_API_KEY) or the provider CLI's own config. The .locus/ directory is gitignored by default.
Git isolation for parallel tasks
Standalone tasks execute in isolated git worktrees. Each agent works on its own branch with no interference. Failed worktrees are preserved for debugging and cleaned up on success.
Data flow
Here's exactly what data goes where when you use Locus.
Direct. Handled by the provider CLI on your machine.
Direct API calls from your machine to GitHub.
Posted directly to GitHub. No intermediary.
Found a vulnerability?
We take security seriously. If you discover a vulnerability, please report it responsibly via GitHub Issues or contact us directly.