Privacy and security

Brimline handles sign-ins, so it is built to do as little as possible with them.

Read only

For each Claude account, Brimline reads one item of the macOS Keychain: the one Claude Code keeps for that folder. It asks macOS's own security tool for that exact item by its name, and never lists the Keychain. Of what it reads, it uses the access token only. For ChatGPT, Grok and Cursor it reads the one file their own tool keeps (~/.codex/auth.json, ~/.grok/auth.json, Cursor's state database), decodes only the few fields it needs, and never reads a Keychain item of those tools.

Off until you turn it on

Claude is on. ChatGPT, Gemini, Grok and Cursor are off until you switch each one on in Settings (or with brimline providers enable <name>), and a provider that is off is not touched at all: no file opened, no request sent, no program launched. An account marked Don't read this account is never read either. An agent cannot turn a provider on for you.

The one program Brimline launches

To read Gemini, Brimline launches Google's own command agy --print /usage (Antigravity CLI), and nothing else. Google's program may then renew its own sign-in; Brimline neither reads nor writes that sign-in. The launch is guarded: only the exact path ~/.local/bin/agy (the PATH is never searched), only a build Brimline has verified (its checksum and its version must be on the list), fixed arguments with --sandbox, an empty working folder, a stripped environment, 20 seconds at most, and one launch every 15 minutes at most.

Cursor. Its request carries the cookie of Cursor's web session, which is worth a full session of cursor.com: Brimline sends it to that one address, over HTTPS, and nowhere else.

Claude Code reports and hiding icons

brimline report claude reads what Claude Code prints about its own limits on its standard input and keeps only the share used and the reset time of the 5 hour session and of the week, in a file of Brimline's own folder. It reads no token and sends no request. Hiding the icons of other apps (off by default) writes no file of macOS or of another app. On macOS 27 and later, it uses a private framework of macOS (its allow-list of the menu bar) and the Accessibility permission, with which Brimline reads only where the menu bar icons of the other apps are; it keeps the apps found right of its bar in its own settings.json. The permission covers one build of Brimline (an ad hoc signature), so it may have to be given again after an update. On macOS 26 and before, it asks for no permission and uses no private API.

No token renewal

Brimline never uses the refresh token and never renews anything. Renewing a token can replace it, which could sign Claude Code out. When the access token has expired, Brimline does not call the provider at all: it shows the last known numbers and asks you to open the tool with that account (Claude Code, Codex, the Grok CLI or Cursor). The one exception is Google's own program for Gemini, above.

The token stays in memory

The access token lives in memory for the time of one request. It is never written: not to the cache, not to a log, not to the command's output, not to the MCP server's answers.

A cache without secrets

~/Library/Application Support/Brimline/usage.json holds the numbers only: addresses, percentages, reset times, the time of the reading. Its format is versioned. Deleting it loses nothing that the next reading will not bring back.

What goes over the network

One HTTPS request per account at each reading (every 5 minutes by default), to the provider that issued the sign-in (api.anthropic.com for Claude, chatgpt.com, cli-chat-proxy.grok.com and cursor.com for the others), carrying that account's own token, and announcing itself as User-Agent: Brimline/<version> (never as the official tool). For Gemini Brimline sends nothing itself: Google's program does what it does with Google. Nothing else: no Brimline server, no telemetry, no analytics in the app.

An undocumented endpoint

To our knowledge, none of the providers documents an endpoint for subscription limits (Google documents the /usage command of Antigravity, not the format of its text). For Claude, Brimline reads https://api.anthropic.com/api/oauth/usage; for the others, the address their own tool or dashboard uses. These are internal endpoints that can change or disappear without notice. When an answer no longer looks as expected, Brimline marks the account “format changed” or unavailable rather than guessing a number.

Anthropic's terms

Anthropic's documentation (Legal and compliance, Authentication and credential use) says that OAuth sign-ins are meant for Claude Code and Anthropic's own apps, and that third-party developers may not collect, store or intermediate Claude.ai credentials or session tokens. Brimline reads your own token on your own Mac, read only, never writes, renews or copies it, sends it only to Anthropic to ask for your own usage, and announces itself under its own name. It is not an official or endorsed product, and we do not claim this use is allowed. The same page says Anthropic may enforce these restrictions without prior notice: the risk, if any, is on the account Brimline reads. Read the terms of your plan and judge for yourself. Each of the other providers has its own terms, which we have not established either: OpenAI's page on Codex, for one, does not allow codex app-server for a commercial service, and because it renews and rewrites Codex's sign-in, Brimline does not use it.

Report a security problem

See the security policy of the repository. Please do not open a public issue for a vulnerability.