Code signing policy
How Lithnode's downloads are built and signed, who can release them, and what the app sends over the network.
Not signed yet. Lithnode's Windows installer isn't code-signed. SignPath Foundation, which signs open-source projects for free, said the project is too new for now, so Lithnode will apply again as it grows. Until then, Windows may say it protected your PC: click More info, then Run anyway. Every installer is built in public by GitHub Actions (below). This page will say when signed releases start.
Signing
Once SignPath Foundation approves the project, Windows releases will be signed under this arrangement:
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
That means the publisher shown on the installer will be SignPath Foundation, and a signature proves the file was built automatically from the public source code, not on someone's own computer.
How a release is built
- Every release is built by GitHub Actions from the lithnode repository on GitHub, on GitHub's own machines.
- The Windows installer also includes Claude Pet, by the same maintainer, also MIT licensed, built from its public repository in the same run.
- Before anything is published, each build runs a whole flow through the built app to check it works.
- Every signing request is approved by hand, one release at a time.
Team roles
| Committers and reviewers | drewguitarist18-lang, the maintainer and owner of both repositories. Changes from anyone else come in as pull requests and are reviewed by the maintainer before they're merged. |
|---|---|
| Approvers | drewguitarist18-lang |
Everyone with these roles uses two-factor sign-in on GitHub.
Privacy
This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
The only network traffic Lithnode makes is what you set up:
- Your engines. Lithnode runs Claude Code, Codex, Cursor or Antigravity, whichever you've installed and signed in to. They talk to Anthropic, OpenAI, Cursor or Google under those companies' own privacy policies, exactly as when you run them yourself. Ollama runs models on your own computer.
- Your API keys. If you add one, agents send their requests to that key's provider (for example OpenAI, Anthropic or Google), under its own terms.
- Update check. Every few hours Lithnode asks GitHub's public releases page whether there's a newer version. It sends nothing about you. Turn it off in Settings (the cog).
- Install count. The first time each version opens, Lithnode tells lithnode.com once whether it's a new install or an update, with the version number and Windows, Mac or Linux. No ID, no name, no IP address is kept. Turn it off in Settings → Count my install.
- Things you add. Webhooks, connectors and the web tools you give a team only send what that team produces, to where you pointed them.
Apart from that one install count, the app has no analytics or tracking. Your flows, runs and logs stay in the Lithnode folder on your computer. On lithnode.com, Download clicks are counted by day, computer type and the site that sent the visitor, also without cookies or IP addresses.
Changes to your system
- The Windows installer installs for your user only (no admin rights) into
%LOCALAPPDATA%\Programs\Lithnode. - Claude Pet is optional, with its own checkbox in the installer. If you keep it, it adds hooks to Claude Code's settings
(
~/.claude/settings.json) so the pet can show what Claude is doing.
Uninstalling
Windows: Settings → Apps → Installed apps → Lithnode → Uninstall. That removes the app and Claude Pet's hooks.
Your flows and past runs stay in ~/.lithnode; delete that folder to remove them too.
Mac: drag Lithnode from Applications to the Trash. Linux: flatpak uninstall com.lithnode.Lithnode.