Skip to main content
This page is the whole list. DeckTalk itself contacts the hosts in the first two tables and no others, and it sends no telemetry, no usage report and no crash report anywhere. The one request it does not choose is a page’s own: a page you record loads what its author wrote it to load, and the third table says when that reaches the network and how a machine refuses it. Hand this page to a reviewer who has to approve DeckTalk on a managed machine. The four facts that decide most reviews are that a cloud speech service receives your script, that the first run downloads a browser and a media tool, that a recorded page reaches the network as it would in a browser unless the machine sets record.page_policy = "untrusted", and that a program a project names runs only when the machine sets record.programs to ask or run. Such a program runs with your user’s rights and can read every file you can, .env included, and it reaches whatever your user can reach. The default is refuse, and decktalk check lists every program a project names, as programs a project names says.

​
Requests that carry your content

These requests carry text from your project. Every one of them is made only by a command you run on purpose. Every one sent to a cloud service needs an API key that you supply, and the local voice needs none. Narration to api.elevenlabs.io. The request carries the value of ELEVENLABS_API_KEY in a header, to the host [elevenlabs] base_url names. Only this machine’s own file, environment or --set can name it, and a project file that sets it is refused, because the key goes wherever it points. The context is drawn only from the sections a run selects, so a run narrowed with --section to one section read by one voice sends no neighbouring text. A run with --no-spend sends nothing at all. Narration by the local voice to 127.0.0.1:9361. No key is sent. The host is the one [dtsp] base_url names, 127.0.0.1:9361 by default, and only this machine’s own file, environment or --set can name another. A project file that sets it is refused. The local voice bills nothing, so a run with --no-spend still sends the text. At the default address the text never leaves the machine. Word timing by the local aligner to 127.0.0.1:9361. No key is sent. The host is the one [dtsp] base_url names, the same server the local voice speaks to, and only this machine’s own file, environment or --set can name another. The aligner bills nothing. A take whose aligned words are kept in takes/aligned/ plays them without asking it, so a build of a project that commits them sends nothing. Sound effects and ambience to api.elevenlabs.io. The request carries the value of ELEVENLABS_API_KEY in a header. The prompt is text you wrote in decktalk.toml, so you decide what it describes. Music to api.elevenlabs.io. The request carries the value of ELEVENLABS_API_KEY in a header. Each part of the music is bought once into the score directory, score/ unless [score] dir names another, and the ledger there keeps it from being bought again. Deleting build/ sends nothing.

​
Reading a request before you make it

decktalk check --json prices the narration of a voiced run with no API key and no request. Its cost object reports the sections a voiced run would pay for, their character count, the price per thousand characters and the layer that set it, so a reviewer can read exactly what would be sent before anything is sent. decktalk build stops at the same point and names the price before it buys anything, and --max-cost N refuses the whole run before the first call when the ceiling is above N. Set narration.context_characters = 0 when the neighbouring sections must stay on the machine. Each section is then sent on its own, with no surrounding text.

​
One-time downloads

DeckTalk fetches the tools a recording needs, once per machine: the first command that opens a page downloads the browser, the first command that encodes downloads the media tool, and decktalk install does both up front. These requests carry nothing from your project, and after they succeed a build that does not spend needs no network at all, unless a page loads something from another host. cdn.playwright.dev. This is Playwright’s own download host. PLAYWRIGHT_DOWNLOAD_HOST points it at a mirror, and [tools] chromium skips the download by recording with a browser the machine already has. github.com. GitHub answers a release download with a redirect to its asset host, so a proxy rule needs both. The archive is checked against a pinned SHA-256 digest and discarded when the digest does not match. evermeet.cx. The archives are checked against pinned SHA-256 digests and discarded when a digest does not match. ffmpeg.martin-riedl.de. The archives are checked against pinned SHA-256 digests and discarded when a digest does not match.

​
Requests a page makes

A deck is a web page, and its own script runs in the browser that records it. DeckTalk serves the page and the files the project declares from inside that browser, so none of those requests leaves the machine. A request the page makes for any other host is the page’s, not DeckTalk’s. A page’s own requests. Under the default record.page_policy = "trusted" the request goes to the network the way it would in the author’s browser, through the machine’s own proxy. Under untrusted it is refused before it leaves the browser, whatever its scheme. Either way the run names every other origin the page reached for, as PAGE_CDN_ASSET, so a reviewer reads which hosts a deck depends on from decktalk check --json before anything is recorded.

​
What never leaves

DeckTalk has no telemetry. It reports no usage, no errors and no project contents to its authors, and it has no update check. Nothing about a build is sent anywhere unless a command in the first table above sends it, or a page you record sends it itself. DeckTalk’s log records are written to the run’s own events file. When DeckTalk runs inside a program of your own, the same records also reach that program’s logging, with every credential DeckTalk holds already replaced by its variable name. Where that logging goes is the program’s choice. No DeckTalk environment variable has its value printed, logged or placed in a request body. An error message that quotes a reply from a service has every credential the request carried replaced before the quote is cut to length, whatever header carried it. A redirect to another host, scheme or port never carries a header that holds a credential. KaTeX ships inside the wheel, so an equation needs no download and no content delivery network.

​
The agent is a second service

The six DeckTalk skills run inside your coding agent. When you ask an agent to write a script, place cues or fix a finding, the agent puts your script.md, your decktalk.toml, your cues.json and the JSON that DeckTalk prints in front of whatever model that agent runs. That model is a cloud service of its own, under its vendor’s terms and not under DeckTalk’s, and a policy review that covers the speech service should cover it too. Running DeckTalk from the command line alone contacts no model.

​
On a managed machine

A laptop with an intercepting proxy, no administrator rights and a policy review needs five things, and none of them is a DeckTalk feature you have to wait for.
  • Build with no voice and no key. decktalk build --no-spend plays every take on disk, writes placeholder narration where a take is missing, and makes a complete video. It contacts no service, so you can show a finished internal video before any approval comes back.
  • Use the browser the machine already has. Set tools.chromium with decktalk config set tools.chromium PATH --scope machine, or point [tools] cache_dir at a directory whose ms-playwright folder your administrators have already filled. Both are machine keys, so a project file that sets either is refused. The pinned build is the reference, and a managed browser is supported and unverified.
  • Use the ffmpeg the machine already has. [tools] ffmpeg and [tools] ffprobe name executables directly, and a build that finds them downloads nothing from the second table. Both are machine keys, so they belong in this machine’s settings file rather than in a project that ships to somebody else.
  • Bypass the proxy for the preview server alone. A recorded page is served at http://project.localhost/ from inside the browser: no socket opens, no port is chosen and no proxy sees that host, so recording needs no proxy rule. decktalk serve is the one command that opens a real server, for previewing a deck in your own browser. It binds to 127.0.0.1 by default and takes --host and --port, so a proxy that intercepts the loopback address needs a bypass for it.
  • Refuse what a page reaches for. Set record.page_policy to untrusted with decktalk config set record.page_policy untrusted --scope machine when the machine records pages it should not trust with the network. A page someone else wrote says what that policy holds.
Requirements and costs has the full managed-machine section, with the package index mirror and the [tools] keys. decktalk doctor reports what is installed and which browser and media build a run would use. It fetches nothing unless it is on a terminal, where it offers once to fetch what is missing, or --fix is passed, and decktalk doctor --json prints the same reading as one object with no credential in it.