Security & privacy
You are trusting Agent Switch with access to several paid accounts. This page says exactly what it does with that access, so you can check it rather than take it on faith. Everything here describes the code; the source is on GitHub.
The short version
Section titled “The short version”- Agent Switch is a local tool. There is no server, no account, no telemetry, and it never listens on a port.
- Each login stays where the provider’s own tool put it. Agent Switch does not hold, forward or share logins.
- It does not sit in your traffic. Claude Code, Codex and Antigravity talk to their providers directly.
- Nothing changes a running session’s account without your confirmation.
Where your logins live
Section titled “Where your logins live”Every account signs in through the provider’s own login flow, into that
account’s own folder under ~/.agent-switch:
| Tool | macOS | Linux | Windows |
|---|---|---|---|
| Claude Code | Keychain, one entry per account (derived by Claude Code from the folder) | .credentials.json in the account’s folder | .credentials.json in the account’s folder |
| Codex | auth.json in the account’s folder | same | same |
| Antigravity | a keychain inside the account’s folder | — | — |
What Agent Switch reads and writes
Section titled “What Agent Switch reads and writes”It reads each account’s login only to ask the provider how much of that account’s usage is left, and who the account belongs to. It reads your local session files to show context %, the prompt cache and session previews.
It writes a login in exactly two cases, both on your command:
agent-switch import <name>copies the login of your existing default install into a new account, so you do not have to sign in again.agent-switch rebindswitches a running Claude session to another of your accounts (macOS), andrebind --restorereverses it.
When agent-switch takeover moves a session to another account, it also copies
that account’s answer to “do you trust this folder?” for the session’s folder,
but only if you already said yes on the source account. Tool permissions are
never copied, and an answer the target account already gave is kept.
Refreshing a login is always left to the provider’s own tool. To keep idle
accounts signed in, the background service runs that tool for the account:
claude doctor for Claude, codex app-server asked to refresh its account for
Codex, and agy models for Antigravity (macOS). Each makes the tool refresh its
own login under its own lock, without a model request, and never while a session
runs on that account. Turn it off with agent-switch keep-signed-in off.
It stores usage numbers, your settings, folder rules and a log of its own
actions (agent-switch activity) under ~/.agent-switch. It never stores a
token outside the provider’s own place for it.
Every connection it makes
Section titled “Every connection it makes”| Destination | Why | With what |
|---|---|---|
api.anthropic.com | Claude usage and the account’s identity | that account’s own login |
chatgpt.com (/backend-api/wham/…) | Codex usage and banked resets (reset redeems one only when you run it) | that account’s own login |
api.github.com, github.com | update checks, release notes, downloading the desktop app | nothing personal |
registry.npmjs.org | the desktop app checks for new versions of the claude and codex CLIs; update and tooling install install packages through npm | nothing personal |
raw.githubusercontent.com | only agent-switch tooling install rtk, which runs rtk’s own install script | nothing personal |
127.0.0.1 (your own machine) | only when you open agent-config’s settings from the desktop app: it talks to agent-config’s local server | a token agent-config created for this |
That is the complete list. agent-switch web opens claude.ai in a browser
window, which then talks to claude.ai like any browser. Your prompts, code and conversations never pass
through Agent Switch.
What it refuses to do
Section titled “What it refuses to do”No proxy and no TLS interception. No pretending to be another client. No pooling of free tiers. No forwarding or brokering of logins. No hosted dashboard. Each refusal is explained in What it will never do.
Is this allowed by the providers?
Section titled “Is this allowed by the providers?”Each account signs in through the provider’s own login and uses the provider’s own client, unmodified, for the person who owns the account. Agent Switch only chooses which of your own accounts a new session starts on. Check your plan’s terms for your situation; this page describes the code, it is not legal advice.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Please report security issues privately through GitHub’s private vulnerability reporting rather than in a public issue.