Does tracing Claude Code with Rius send my code or prompts?

Rius sends no prompts, replies, file contents or command output from a Claude Code folder you enable with /rius:enable-here, only the session structure. Prompts and code leave your machine only from a folder you enable with /rius:enable-content-here, and the plugin removes the secrets it recognizes first, on a best-effort basis. Tracing is off for every folder until you turn it on, and only you can run the enable commands. Everyone with access to the workspace can read what is sent.

How it works

Each folder is in one of three states, and the plugin decides which on your machine before anything is sent.

• Off (the default). Installing the plugin sends nothing. Nothing is traced until you enable a folder.
• Structure only (/rius:enable-here). Rius receives the span tree, model names, tokens, cache reads and writes, cost, timing, tool names, error types and subagent types. It also receives the kind of command a shell call ran (test, build, lint, package, git or other) with its exit code, the folder path, the git branch, and your sign-in email as user.id. The folder path can include your local user name.
• Content (/rius:enable-content-here). Everything above, plus your prompts and Claude’s replies (never its thinking), tool inputs such as commands and file paths, tool outputs such as file contents and command output, error details of failed tool calls, and the session name as the trace name.

With content on, the plugin replaces the secrets it recognizes with a marker such as [redacted:aws-key] before export. It covers cloud, GitHub, Slack, Stripe, OpenAI, Anthropic and Rius keys, JWTs, private keys, password= style values and Authorization headers. The output of a read of .env*, key and credential files is replaced whole. A secret in a format the plugin does not know is sent. Each captured value is capped at 32 KB.

A folder rule covers every folder beneath it, and a disabled folder always wins at any depth. You can enable ~/code and still keep ~/code/client-secrets out.

OpenHands works differently. It needs no plugin and always sends prompts and output. The plugin agents (Claude Code, plus Codex and Cursor, both in beta) send content only from folders you opt in.

Set it up

1. Install the plugin and sign in. Claude Code plugin covers both in full.

   claude plugin marketplace add glassflow/rius-coding-agents && claude plugin install rius@rius-coding-agents

   Then run /rius:login. Installing sends nothing.

2. To send structure only, run this in the folder you want traced:

   /rius:enable-here

3. To also send prompts, replies, file contents and command output from a folder, run this there instead:

   /rius:enable-content-here

4. Run /rius:status to confirm. The Content: line reads none (structure only) for the first mode and prompts, replies, file contents and command output for the second.

5. To stop a folder, including one inside an enabled parent, run /rius:disable-here. If a session is open, nothing after that point is sent. When it ends, the plugin closes the trace with structure only. For one session only, /rius:off stops tracing.

6. To turn content off on the whole machine, whatever each folder chose, set RIUS_CAPTURE_CONTENT to false in the env block of ~/.claude/settings.json, then restart Claude Code. The variable can only lower capture, so true is ignored.

   {
     "env": {
       "RIUS_CAPTURE_CONTENT": "false"
     }
   }

A session already open when you enable its folder is traced from its start, so earlier messages in it are sent too. Start a new session after enabling to trace only from now on. If you enabled folders before plugin 0.5.0, they keep sending content until you run /rius:enable-here or /rius:enable-content-here in them again.

What you get

• Tracing that is off until you decide, per folder, and that no repository setting can switch on.
• Cost, tokens and timing for every session without sending a single prompt, so you can watch usage on repos you keep private.
• Content where you want it: prompts, replies and tool output in the waterfall, with recognized secrets removed.
• A clear answer on who sees it. Everyone with access to the workspace can read what a session sends. When you sign in as a member rather than an admin, the connect page reminds you that the organization’s admins can see these sessions. Your team can agree which repos send content, as described in Track Claude Code usage and cost across a team.
• Control over past data. Turning capture off applies from then on, and traces already in the workspace keep their content.
• A key you can revoke. /rius:logout revokes the key on the server, and a workspace admin can revoke it under Settings → API keys.

When something else fits

• If a repo holds material that must never leave your machine, leave it off or run /rius:disable-here in it, or set RIUS_CAPTURE_CONTENT to false everywhere.
• If you use OpenHands, expect prompts and output to be sent on every conversation, because it has no per-folder opt-in. The Coding agents page compares what each agent sends.

Related