What Kratu does with your code
Kratu runs on your computer, inside your editor. This page explains exactly what it reads, what it sends where, and what it changes.
Applies to Kratu 0.10 · Updated 13 November 2026
New in 0.10: what changed for privacy and security. The new features keep the same rules: everything runs on your computer, and a person reviews and merges.
- Code on a different service than your board (Jira with GitHub, for example) gets its own sign-in. Kratu never reuses your board’s token for another service.
- Changes you ask for on a pull request go through the same guardrails and checks as a normal fix, to the same branch. Nothing is ever force-pushed.
- Merge conflicts are resolved by the agent, then Kratu checks that no conflict markers or secrets are left before pushing.
- Your 👍 / 👎 ratings and the “work finished” pop-ups are made locally. Nothing is sent.
New in 0.8: stronger protection. Kratu 0.8 adds new layers of defense against hostile work items and tighter limits on what AI agents can do. Update from your editor’s Extensions view to get them.
- Work item text is now treated as untrusted data: hidden text is removed, and items that look like instructions to the agent, or come from people outside your team, wait for a person.
- The agent never sees Kratu’s tokens or other secrets in its environment, and your checks run without them too.
- Analysis has no shell, and unattended fixes run without shell commands by default.
- Kratu checks what the agent actually changed, not only what it planned, and holds anything outside the plan before your checks run.
- More guardrails (symlinks, submodules, executables, weakened tests, CI and agent instruction files), screenshots off by default, transcripts deleted after 30 days, and a Pause switch for all automatic runs.
In short
- There is no Kratu server. Kratu talks only to your board (Azure DevOps, Jira or GitHub), directly from your machine.
- Kratu collects no telemetry, no analytics and no usage data, and needs no Kratu account.
- Your code is read by the AI agent you choose (Claude Code, Codex and others), running under your own account and that provider’s terms.
- Work item text is untrusted data. Kratu never runs an item on its own when it looks like instructions to the agent or comes from outside your team.
- Tokens live in VS Code’s secure storage (your operating system’s keychain), never in config files or the repository.
- Kratu never merges, never pushes to protected branches and never force-pushes. Every change is a pull request you review.
What Kratu collects
Nothing. Kratu has no analytics, crash reporting or tracking of any kind, and it does not phone home. The only network requests Kratu makes go to the board you connect (Azure DevOps, Jira or GitHub, including your own servers) and to your git remote.
Kratu’s reports of what it did, and why runs failed, are made on your computer from local run records. Report a problem shows you a short diagnostics text first (versions, agents, settings and recent errors; no code, no work item text, no links), and then opens your own email app. Nothing is sent unless you press Send.
The ratings you give to Kratu’s results (👍 / 👎, with an optional note) are saved on your computer only, next to the run record. The pop-ups that tell you when Kratu finished an item are made from those same local records.
VS Code itself, and the AI agent you use, have their own telemetry settings. Kratu doesn’t change them.
Where your code goes
Kratu never uploads your code anywhere itself. It starts the AI coding CLI that is installed on your machine and gives it the work item to analyze or fix. That agent reads code in an isolated copy of your repository and sends context to its provider, exactly as it does when you use it on your own.
| Step | What the agent may do |
|---|---|
| Analysis | Read and search files only, with no shell (see the agent table below). Kratu looks up the related commits itself and shows them to the agent, so it can tell whether the work is already done. Any file it writes is discarded. |
| Fix | Edit files inside a separate git worktree. Shell commands only when you allow them, and never in unattended runs unless your team turns that on. Kratu, not the agent, does every commit, push and pull request. |
| Checks | Kratu runs your project’s own lint, type check and test commands for the changed files, inside that worktree, without your tokens in their environment. If the fix changed how checks run (for example package.json scripts or test config), a person approves first. |
Choose the agent and plan that match your company’s policy. For example, many teams use an enterprise plan whose provider doesn’t train on their code.
Work item text is untrusted
Anyone who can write on your board can write text the agent will read. Kratu treats that text as data, never as instructions:
- Fenced: the title, description and comments go to the agent inside clearly marked data blocks, with a warning not to follow instructions found there.
- Hidden text removed: HTML comments, hidden elements, scripts and invisible characters are stripped and replaced by a visible “[hidden text removed]” marker.
- Held when it looks wrong: if the text asks the agent to ignore its instructions, run downloaded code, read credential files, send secrets, push with git, or contains hidden text, unattended runs stop before the agent starts and wait for a person. When you run it yourself, Kratu shows you why and asks.
- Author trust: on GitHub, unattended runs only work on issues and comments from owners, members and collaborators. On Azure DevOps and Jira you can list trusted authors (
policy.trustedAuthors). Anything else waits for a person. - Screenshots: images attached to work items are not sent to the agent unless your team turns on
policy.sendAttachments, because they often contain customer data.
What each agent is allowed to do
Kratu restricts each agent with the controls its CLI offers. Not every CLI offers the same controls, so here is exactly what applies:
| Agent | Analysis | Fix | Unattended runs |
|---|---|---|---|
| Claude Code | Read and search tools only. No shell, no web. | File edits; shell only when allowed | Yes, without shell |
| OpenAI Codex CLI | Read-only sandbox | Workspace sandbox without network | Yes |
| GitHub Copilot CLI | Write and shell tools denied | No shell unless allowed | Yes, without shell |
| Aider | Dry run | Shell suggestions off unless allowed | Yes, without shell |
| Gemini CLI, Cursor Agent | Kratu can’t keep these read-only | Their CLIs run without asking, so Kratu can’t block shell commands | Refused, unless your team sets agent.allowUnrestrictedAgents |
| Your own agent | Whatever you configure | Only if you mark it restricted | |
Kratu never silently swaps your chosen agent for another one. Read-only analysis depends on the agent CLI honoring its own settings; Kratu also discards any file the agent writes during analysis.
Sign-in and tokens
- Azure CLI, Git Credential Manager or GitHub CLI: Kratu asks them for a token when needed. Nothing is stored by Kratu.
- Jira: Jira Cloud uses your account email and an API token; Jira Data Center uses a Personal Access Token. The email is a team-visible setting; the token is kept like any other token below.
- Tokens you paste (Azure DevOps, Jira or GitHub): kept in the editor’s secure storage, which uses Windows Credential Manager, macOS Keychain or the Linux secret service. Kratu passes it to its own engine for each run and never writes it to disk. Use Kratu: Remove Saved Token to delete it. If you use the Kratu command line outside VS Code, it keeps the token in
~/.kratu/credentials.jsonin your user profile, readable only by you, or reads it from an environment variable. - Code on a different service than your board (for example Jira issues with a GitHub repository): the code host gets its own sign-in (the GitHub CLI, a token, the Azure CLI or Git Credential Manager), stored like any other token. Kratu never sends your board’s token to the code host.
- Tokens are never written to
.kratu/config.json, which only holds team settings and is safe to commit. - Tokens are redacted from logs and run transcripts, along with common provider keys (GitHub, OpenAI, Anthropic, AWS, Slack, Google, Atlassian, Stripe, npm) and private keys. Git receives the token through environment variables, never through the remote URL or git config.
- The agent never sees Kratu’s tokens. It starts with an allow-list of environment variables: system and toolchain settings plus its own provider’s keys. Your board token, CI tokens and other secrets are left out. Your checks run with secret-looking variables removed. Teams can pass extra variables on purpose with
agent.passEnvandverify.passEnv.
What Kratu changes
| Where | What | When |
|---|---|---|
| Your repository | A new branch (kratu/…) or a branch you choose, and a pull request | Only after a fix passes guardrails |
| Work item | A comment with the analysis or the pull request link | If “comment on work item” is on (default) |
| Work item | A state change, for example to Resolved | Only if you chose a state in setup |
| Your repository | New commits on the branch of a pull request Kratu opened, when you ask for a change or update it with the base branch (never a force-push) | Only when you ask, after the checks |
| Your working copy | Nothing. Fixes happen in a separate worktree. | Never |
Kratu only fixes items in the states you allow, leaves items that already have linked commits or pull requests alone, and asks before any change above your risk limit.
After the agent finishes, Kratu compares what it actually changed with what it planned. Files outside the plan, sensitive files, check configuration, weakened tests, new executables or binaries, or a higher risk than planned stop an unattended run for a person, and a run you approved anyway opens as a draft pull request with those files marked. Changes to your shared dependency folders (node_modules, .venv) are flagged too.
Guardrails
- Blocked paths:
.envfiles, private keys and certificates, CI/CD pipelines (GitHub Actions, Azure Pipelines, GitLab, Jenkins, CircleCI and others), files that instruct AI agents (CLAUDE.md,AGENTS.md,.cursor, Copilot instructions and others), Kratu’s own settings, git hooks, package registry credentials and dev containers can’t be changed. - Blocked changes: symbolic links and git submodules.
- Needs a person: files made executable, binary files, and deleted or skipped tests.
- Secret scan: every diff is checked for credentials (cloud keys, tokens, private keys) before anything is committed.
- Sensitive areas: migrations, authentication, security, payments, infrastructure, Dockerfiles and dependency lockfiles raise the risk to high, which always needs your approval.
- Size limits: a fix must stay within your file and line limits (10 files and 400 lines by default).
- Protected branches: main, master, develop, dev, trunk, prod, production, staging, release and hotfix branches, your repository’s default branch, and branches protected on GitHub are never committed to directly.
Pause everything
Click Kratu in the status bar and choose Pause all automatic runs, or run kratu pause. Clock-in and background runs then start no new work until you resume; the item in progress finishes. Unattended runs are also capped at 20 items per repository per day (policy.maxRunsPerDay), as a safety net.
Files on your machine
Kratu keeps its working files in a .kratu folder in your home directory: your personal settings, a record of which items it handled, logs, and a transcript of each run (prompts, agent output and check results), so you can see exactly what happened. Transcripts are deleted after 30 days (policy.keepRunsDays). Isolated worktrees are removed after a successful run. You can delete the folder at any time.
The extension package
Like every VS Code extension, Kratu is distributed as a .vsix file that anyone can download from the Marketplace. It contains only the compiled, minified program (the Marketplace build is also obfuscated), the icon, the license and the documentation. It contains no source code, no tests, no keys and no secrets of any kind, so downloading it gives no access to anyone’s data.
This website
This website counts page views with Vercel Web Analytics, to see how many people visit and which pages help. It uses no cookies and no advertising trackers, and it doesn’t identify you: visitors are counted with an anonymous identifier that resets every day. This applies only to the website. The Kratu extension itself collects nothing.
Future cloud features
Optional team features, such as shared settings and a dashboard, may later use a Kratu service. Before any of that ships, this page will list exactly what it stores, where, and for how long, and it will stay optional. The local extension will keep working without it.
Report a security problem
If you find a security issue, please email manojdevarakonda786@gmail.com with the details, rather than posting them publicly. You’ll get a reply as quickly as possible.