Skip to content
ContextCake

Update checks and privacy

The engine itself — resolver.mjs, mcp-server.mjs, and every other CLI tool — makes no network calls of its own beyond what a layer’s source requires (an mcp layer spawns the command you configured). This page is about a separate, optional convenience in the two UI surfaces: the Console and the Playground.

What it sends

Section titled “What it sends”

Both UIs can check whether a newer ContextCake release exists. The check is a single unauthenticated HTTPS GET to a pinned host:

https://api.github.com/repos/ContextCake/context-cake/releases?per_page=20

Nothing is attached beyond the implicit HTTP request — no personal data, no tokens, no identifiers, no telemetry. The request carries the same information any browser request to that URL would (the standard HTTP headers your client sends; GitHub sees whatever it would see from any anonymous visitor). From the response, each surface picks the newest release in its own tag namespace (console-v* for the console, v* for the playground/engine), compares it against the running version, and caches the result for the session — at most one request per page load, no matter how many components ask.

It is disable-able

Section titled “It is disable-able”

Both surfaces expose a Check for updates toggle in the header, next to any “update available” notice (a small gear icon opens the setting). It is backed by a single localStorage flag, cc-update-check, shared by the Console and the Playground:

  • Console, demo build (the public /demo-app/ embed on this site): off by default. The public embed is network-silent unless you turn the toggle on.
  • Console, live/local use: on by default.
  • Playground: on by default — it is a local dev tool, not a public embed.

When the toggle is off, no network request is made at all — the check function returns immediately without calling fetch.

Why this exists

Section titled “Why this exists”

ContextCake is privacy-by-default: the engine doesn’t phone home, and the one place a UI convenience touches the network, it’s unauthenticated, minimal, cached, and switchable. If you’d rather never make the call — air-gapped environments, strict network policies, or just preference — turn the toggle off once and it stays off (the flag persists in localStorage).

Section titled “Related”
  • The trust boundary — the one place ContextCake does execute code you didn’t write directly (an mcp layer’s command)
  • Playground tour — where the settings menu lives