What arcy init reads and sends

arcy init touches your codebase. Here is exactly what it reads, what it sends, and what never leaves your machine.

What the CLI reads locally

The CLI scans your project directory and reads the following:

Source files. The CLI reads up to 30 of your source files (.tsx, .jsx, .ts, .js). It prioritizes entry files, layouts, providers, nav components, page files, and pricing pages: the parts of your codebase that reveal how your product is structured and what it does.

package.json. Read to detect your framework and auth library.

Existing ARCY files. If .arcy/ already exists, the CLI reads it to detect prior configuration.

What it does NOT read: business logic files, API routes, server actions, database queries, test files, or anything in node_modules, .next, or dist.

What it sends to ARCY servers

The CLI sends the actual content of the scanned source files to AWS Bedrock, for analysis. This is what generates your .arcy/ knowledge graph and determines where to add data-arcy attributes.

File limits: Up to 30 files, capped at 120KB total. Files larger than 80KB are individually skipped.

Always excluded (never sent):

• .env, .env.local, .env.production, and any file matching .env*
• *.pem, *.key, *.p12, *.pfx, *.cert, *.crt, *.secret
• id_rsa, id_ed25519
• Test files (*.test.*, *.spec.*)
• Story files (*.stories.*)

The consent prompt

Before anything is sent, the CLI lists every file it will transmit along with its size:

    src/app/layout.tsx                    2.1 KB
    src/app/page.tsx                      1.4 KB
    src/components/sidebar.tsx            3.8 KB
    ... and 21 more
    Run arcy init --scan-preview for the full list.

  24 files · 58.3 KB total
  Config files (.env, *.pem, *.key) are always excluded.

  ARCY AI does not store your files or use them for data training.
  For details, see docs.arcyai.com/privacy.

  ? Send files for analysis? (y/N)

Type n to cancel. Nothing is sent and no files are changed.

To preview the exact file list without running init or sending anything:

arcy init --scan-preview

Data handling

Source files are used once: to generate your .arcy/ knowledge graph and determine data-arcy placement. Once analysis completes, ARCY discards the raw file content. Your code is not stored, indexed, or used to train any model.

After you run arcy push, the contents of your .arcy/ YAML files are stored server-side so the SDK can retrieve them at runtime. You own and control these files. Deleting your ARCY account removes the server-side copy within 30 days.

See the AWS data processing agreement (section 50) for AWS Bedrock's data handling commitments.