A privacy audit tool that detects undisclosed telemetry and repo exfiltration in AI coding CLI binaries
A user did manual reverse-engineering to discover that an official MiMo CLI build ships hidden code that uploads Git repo identity and bundles conversation/code diffs to a tracking endpoint, while the public source repo does not contain these implementations. Developers who install AI coding CLIs want a fast way to verify what data the binary actually sends before trusting it on private repos.
他们的问题
Developers running AI coding CLI tools on private or client repositories have no easy way to know whether the installed binary contains hidden telemetry or codebase exfiltration. The author had to download the package, grep strings in the binary, diff against public source, and set up HTTPS capture to prove what was being sent, which took significant manual effort and required reverse-engineering skills.
可以怎么做
Build a CLI/CI tool that downloads a given AI coding tool package, statically scans the binary and build scripts for network endpoints and suspicious symbols, diffs shipped artifacts against the public source repo, and runs the tool in a sandboxed throwaway repo while capturing outbound HTTPS to report exactly what repo data, prompts, and metadata leave the machine. Output a simple privacy report with an opt-out confirmation.
适合谁做
谁在说（1）
相关话题
机会描述由 AI 整理，原话在上面「谁在说」的链接里。