AppMap traces stay in your environment.

AppMap does not send traces to an AppMap-operated cloud. AppMap records, sanitizes, and compares traces in your developer environment or CI. Working AppMap traces stay in the developer environment. When Gold Traces are committed with the code, AppMap sanitizes them first. If the developer uses a hosted coding agent, some context goes to that provider. The provider's configuration and terms apply.

Traces are written locally at capture time, typically to a tmp/appmap directory in the project. Traces your team keeps as AppMap Gold Traces are committed to the gold_traces directory in the repository and versioned like any other file. Gold Traces are sanitized before they are committed to protect against including PII, secrets, or credentials. AppMap is open source, so the implementation can be inspected directly.

On the developer machine and in your repository. Working traces live in tmp/appmap. AppMap Gold Traces live in the gold_traces directory in the repository. They are plain files: retention is under your control, and deleting a trace is an ordinary file delete.

Community activation is a one-time identity check via GitHub, GitLab, or email, in the editor. No traces are involved. Enterprise deployments support offline activation and internal distribution for air-gapped environments.

No. GitHub and GitLab act as OAuth identity providers only. The requested scopes cover your email address and public profile, nothing else. AppMap requires no permissions to your hosted code.

AppMap exposes the traces over the Model Context Protocol. Coding agents query the same traces behind the maps you see in the editor, calling get_call_tree, find_calls, find_queries, and find_requests over the AppMap MCP server.