anki-mcp communicates only with localhost:

• AnkiConnect at http://127.0.0.1:8765 — no remote connections
• No telemetry, analytics, or external data collection
• No credentials stored — AnkiConnect requires no authentication

• MCP tools: read/write Anki data via AnkiConnect (local HTTP)
• Daily progress script: read-only access to Anki's SQLite database
• Archive files: .apkg exports written to a configurable local directory
• No network access beyond localhost AnkiConnect and AnkiWeb sync (triggered through Anki's own sync mechanism)

The server only writes to:

• ANKI_MCP_ARCHIVE_DIR (default: ~/.local/share/anki-mcp/archive/) — .apkg exports
• ANKI_MCP_OUTPUT_DIR (default: ~/Anki Progress/) — daily progress reports (script only)

Path traversal is guarded: import_deck validates that resolved paths stay inside the archive directory.

• FastMCP — MCP protocol server
• httpx — HTTP client for AnkiConnect
• Pydantic — data validation

All dependencies are from well-maintained, widely-used Python packages.

If you discover a security issue, please open a GitHub issue or email the maintainer directly. There is no bug bounty program.