Causalist runs in your browser. Your API keys are stored only in this device’s localStorage, sent directly to Anthropic and GitHub, and never touch our servers.
localStorage
Powers the four-agent pipeline (Structure / Dependency / Semantic / Oracle) and per-node review agents. Calls go directly from your browser to api.anthropic.com — your key never leaves this device.
Connect GitHub first.
Causalist needs to know who you are before it stores a key for you — it’s also what makes “Open PR” in the Agents tab work.
Required to analyze private repos. Public repos work without one.
Create a fine-grained token with repo read access at github.com/settings/personal-access-tokens.
repo
Each key is a long random token (cspl_live_…) that lets an agent — Claude Code, a CI job, anything that can make an HTTP request — act on your account. Tied to your GitHub identity, scoped to your account only. Revoke any time.
cspl_live_…
Keys live in browser storage only. Analyze requests call api.anthropic.com and api.github.com directly from your browser. Nothing is stored server-side.