Network connections

Every connection OpenOrc makes, where it goes, what it sends, and which ones you can turn off.

Every connection

OpenOrc has no server of its own. Every connection goes straight from your computer to one of the services below. This table lists each one, when it happens, and how to stop it. Cloud threads add connections from a sandbox or the cloud brain on your own account, described under Cloud threads and the brain.

Connection	Goes to	When	To stop it
Agent turns	The agent's own service: Anthropic for Claude Code, OpenAI for Codex, the providers you set up in OpenCode	Each message you send, and each turn a schedule, Slack request, pull request review, or another thread's agent starts	Pause schedules, disconnect Slack
Thread titles	The thread's own agent, or the harness you chose	Once, after a new thread's first turn	Harness set to Off · use opening message, under Memory & models
Code explanations	The conversation's own agent, or the harness you chose	When you choose Plain English, Walkthrough, or Diagram for a file that has no saved explanation of its current text	Don't choose those views, or set Harness to Off · use opening message
Run summaries	The agent that did the work, the provider you chose, or the Anthropic API with your key	After each run, while memory is on	Leave memory off, the default, or set Provider to Off · no background learning
Usage and limits	Claude Code's and Codex's services, through their CLIs	When the usage ring on the sidebar's rail needs fresh numbers, at most once a minute for each account; while Settings shows Usage, which it opens on; and when a thread shows a Codex usage limit	No setting
Embedding model	`huggingface.co` and its download servers on `hf.co`	Once, the first time memory needs it	Leave memory off
App updates	GitHub Releases	30 seconds after launch, then every 6 hours, in installed macOS and Windows releases	Check for updates automatically, under General
Agent updates	`registry.npmjs.org`, `formulae.brew.sh` for Codex or Claude Code installed as a Homebrew cask, or `downloads.claude.ai` for Claude Code from its own installer	30 seconds after launch, then every 6 hours	Check for agent updates automatically, under Connections
Git	Your repository's remotes	Creating a worktree, pushing, and reviewing a pull request	Work in the Local checkout
GitHub CLI	GitHub, through `gh`	Using the Pull requests pages or creating a pull request, and every 5 minutes for each thread with an open pull request	The check stops once the pull request is merged or closed
Reviewer app	`github.com` and `api.github.com`	Setting the app up, and posting a review as the app	Don't set it up, or Remove it
Slack	Slack, or your shared relay	While Slack is connected	Disconnect Slack, or Disconnect desktop and Disconnect relay for a shared relay
Browser preview	The pages you or an agent open	When a page loads, including pages an agent opens with no Preview on screen	No setting; agents can open pages in every mode
Preview search	`www.google.com`	When you type words instead of an address in the Preview's address bar	Type an address
Phone access	Your paired phones, which connect to this computer over your local network or tailnet	While Allow paired phones is on, under Phone	Turn off Allow paired phones, the default
Phone notifications	Apple's push service, `api.push.apple.com`	When a thread needs you or finishes and a paired phone has notifications on, if you added an Apple push key	Don't add a key, or turn notifications off on the phone
Cloud services	Vercel at `api.vercel.com` and, for sandboxes, `vercel.com/api`, or Agent37 at `api.agent37.com`, `sandbox.agent37.app`, and each instance's address on `agent37.app`	Connecting a service, while Settings → Cloud is open, and while a cloud thread's sandbox starts, syncs, runs a turn, or stops	Disconnect under Settings → Cloud, after removing what runs there
Cloud brain	The brain's address on `vercel.run` or `agent37.app`, over a link encrypted end to end	When OpenOrc starts, after your computer wakes, every 2 minutes while not connected, and when you open one of the brain's threads	Remove the cloud brain
Cloud sign-ins	Anthropic through `claude setup-token`, and OpenAI through Codex	When you create a Claude token or sign Codex in for the cloud, and before a sandbox gets a ChatGPT sign-in that is a day old	Don't make sign-ins for the cloud
Device tools	`registry.npmjs.org`, through your own `npm`	When you turn on device support and a pinned version isn't installed yet	Leave Device support off, the default, under Devices
MCP Apps	The `https` domains the app's MCP server declares	While a Codex tool result shows an interactive app	Remove that MCP server from Codex
OpenCode skill catalogs	Web addresses listed as skill sources in your OpenCode configuration, or in the project's	When the Skills section of Settings is open	Remove those addresses from the configuration that lists them

Agents

OpenOrc runs the agent CLIs you installed, signed in with your own accounts, and they connect to their services themselves. OpenOrc doesn't sit between an agent and its provider. It decides what a request starts with: your message, the conversation so far, and a short brief of its own. The agent adds whatever it reads while it works, such as files and command output.

The CLIs also make connections of their own, under their own terms: telemetry, their own update checks, and the MCP servers in your configuration. OpenOrc runs them for short jobs too, such as sign-in checks, model lists, usage, and skills; whether those go online is up to the CLI.

Claude Code connects the MCP servers from your Claude Code settings only in Autonomous, and only while Your Claude Code MCP servers is on under General. Other modes connect only OpenOrc's tools.
Codex turns off the MCP servers in your Codex configuration only in Plan mode.
In a copy of a pull request under review, no agent loads settings or MCP servers from the copied project.

The CLIs keep their own transcripts on your computer, such as ~/.claude/projects for Claude Code and ~/.codex/sessions for Codex. OpenOrc doesn't redact or delete them.

Background requests

OpenOrc has no model of its own. When it needs one in the background, it runs an agent CLI once, in a new folder of its own inside your system's temporary folder, removed afterwards, and sends the prompt over standard input:

Thread titles send the first 1,500 characters of your first message and of the reply. By default the thread's own agent answers with a small model: Claude Haiku 4.5 for Claude Code, or a small Codex model, so the text stays with that provider. For an OpenCode thread, the small model can come from any provider you set up in OpenCode. A thread whose agent has no small model keeps its first line.
Code explanations send the file's path and its text, up to 160,000 characters. OpenOrc finds the other files that use it on your computer. The conversation's own agent answers with the model chosen under Text generation.
Run summaries for memory send a digest of the run, up to 12,000 characters, with the thread's or task's title and a task's description. Memory is off in a new profile. Choosing a provider under Memory & models sends every run's digest to that provider.

For titles, explanations, and summaries, Claude Code runs with Bash, Edit, Write, WebFetch, and WebSearch turned off and without MCP servers, but can still read and search files. Codex runs in a read-only sandbox with no MCP servers, where it can still run commands that only read. OpenCode is denied every tool.

For usage, Claude Code answers a usage request with its own sign-in, and Codex reads your account's limits through its app server. Pressing Use reset asks Codex to spend a reset. OpenOrc never reads the credentials these CLIs store, and doesn't read OpenCode's usage at all.

Source: packages/memory/src/text-generator.ts, packages/core/src/services/text-generation.ts, provider-usage.ts

Downloads and update checks

The embedding model

Memory's search by meaning uses a small model that runs on your computer, and it isn't part of the app. The first time memory needs it, OpenOrc downloads the model's files, 91 MB in all, from huggingface.co, which serves the largest through its download servers on hf.co. It keeps them only if each one matches a SHA-256 checksum written into OpenOrc's source. While memory is off, it is never downloaded.

App updates

Installed macOS and Windows releases ask GitHub Releases whether a newer version exists, including beta versions. Development builds and Linux releases never check. A check only compares versions: downloading and installing each wait until you choose them from the update notice or the app menu.

The update library keeps a random ID in .updaterId in the data folder, meant for releasing to a share of installs first. OpenOrc doesn't release that way and sends the ID empty.

Agent updates

OpenOrc asks registry.npmjs.org for the latest version of each agent's package, formulae.brew.sh when a Homebrew cask installed Codex or Claude Code, or downloads.claude.ai for the release channel of a Claude Code that its own installer put in ~/.local/bin. The request carries no cookies or credentials. Installing waits for you to press Update, and then runs the installer that put the agent there, such as npm, brew, or claude update.

Device tools

Turning on device support installs expo-device-hub, and agent-device when agents may use devices. OpenOrc runs your own npm ci with each tool's lockfile, so every package comes from your npm registry at a version and checksum fixed in OpenOrc's source, with install scripts turned off.

Source: packages/memory/src/model-files.ts, apps/desktop/src/main/app-updates.ts, packages/core/src/services/agent-update-installation.ts, packages/core/src/devices/toolchain.ts

Git and GitHub

OpenOrc runs your own git and gh, so they use your credentials and configuration. Three things use the network without you pressing a Git button:

Creating a worktree from a branch fetches that branch from origin first, so the work starts from the remote branch. If the fetch fails, the local branch is used. Work in the Local checkout never fetches.
A new worktree of a repository with submodules runs git submodule update --init --recursive, which can clone each submodule from its own remote.
For each thread with an open pull request, OpenOrc runs gh pr view <url> --json state every 5 minutes to show when it is merged or closed.

Everything else happens when you ask: pushing, creating a pull request, listing and reading pull requests on the Pull requests pages, fetching a pull request to review it, and posting a review. Before creating a pull request from a thread, OpenOrc checks that your branch is pushed using the remote branches Git already knows about, without going online.

Source: packages/core/src/services/workspace.ts, lifecycle.ts, review.ts, packages/git/src/github.ts, github-app.ts

Local servers

These parts of OpenOrc listen for connections on 127.0.0.1, so other computers can't reach them:

OpenOrc's MCP server, which gives agents OpenOrc's tools, on a random port.
The MCP Apps sandbox, which serves interactive tool results in isolated frames, on a random port. An app can load files from, and connect to, the https domains its MCP server declares, except localhost, .local names, and IP addresses.
The Slack shared relay, on the computer that hosts it, at the port you set (47831 by default). Other users reach it through an SSH tunnel.
The reviewer app's setup page, on a random port, only while you set the app up, for at most 15 minutes.
OpenCode's own server, opencode serve, which OpenOrc starts briefly to list OpenCode's skills. It is protected by a password OpenCode makes up.
On macOS, the update library's handoff to the system installer, on a random port behind a random password, while a downloaded update waits to install.
While device support is on, expo-device-hub on a random port behind a token only OpenOrc holds, and agent-device's helper, which OpenOrc and agents reach on 127.0.0.1 with its token.

One listens on your network. While Allow paired phones is on, OpenOrc accepts phone connections on port 47820, or a free port when that one is taken. It drops any connection that doesn't come from this computer, a private or link-local address, or a Tailscale address before reading from it. Then only a paired phone can complete the encrypted handshake. See Phone app.

The app window loads only files that ship with OpenOrc. Its content security policy blocks remote scripts, styles, fonts, and images.

See Security model for what keeps web pages and other programs out of these servers.

Cloud threads and the brain

A cloud thread's sandbox and the cloud brain run on the Vercel or Agent37 account you connect in Settings → Cloud. Your computer talks to Vercel through its API, at api.vercel.com for your teams, projects, and costs, and at vercel.com/api for sandboxes. The sandbox calls also carry each command's input and output, including the connection to OpenOrc's runner inside the sandbox. On Agent37, it talks to OpenOrc's own server in each instance, at the instance's address, with your Agent37 key. Code moves both ways as Git bundles over these connections, never through a Git remote.

From inside a sandbox, these connections go out:

The agent's own service, as on your computer. On Vercel, when your plan allows it, the sandbox's firewall adds the agent's sign-in to these requests on their way out.
registry.npmjs.org, through npm, to install the thread's agent at the version on your computer.
Your system's package sources and download.docker.com, to install Docker for a project that uses it.
Whatever the agent and its commands open. A sandbox's internet isn't limited.

The cloud brain makes the connections OpenOrc makes on a computer for the work it holds: the agents' services, its own sandboxes on the same account, GitHub if you switched its GitHub sign-in on, Apple's push service if it holds your push key, and Hugging Face for memory's model while memory is on. Paired phones reach the brain at its address. On Vercel they first knock on its door, a small function at openorc-door-….vercel.app in your team that wakes a sleeping brain.

See Cloud threads for what each service bills, and Security model for what the sandbox holds.

Source: packages/cloud/src/vercel-sandbox.ts, agent37.ts, instance-port.ts, agent-install.ts, docker.ts, brain/door.ts, packages/core/src/services/brain-link.ts

What OpenOrc does not send

No usage analytics or crash reports. OpenOrc has no account of its own.
No identifier for your installation with update checks or downloads.
Nothing to an OpenOrc server, because there is none.

OpenOrc does name itself: Codex and OpenCode see the client name openorc, and the reviewer app's requests to GitHub say OpenOrc. The privacy policy also covers this website, which does use analytics.

What an agent connects to while it works, such as when it runs a command or fetches a page, depends on the agent and the thread's mode. See Modes and permissions.

Next steps

Security modelWhat stops web pages, other accounts, and other programs from using OpenOrc's access, and what it cannot protect against.Data and storageWhat OpenOrc stores on your computer, where, for how long, and what deleting removes.How OpenOrc worksThe processes OpenOrc runs, how it talks to each agent, and the path a message takes from the composer and back.

Checked against OpenOrc's source on November 9, 2026.