Architecture

Tern is mostly a thing that runs on your machine, plus a hosted web app that renders what it produced.

What runs where

On your machine. The tern CLI lives under ~/.tern/. When you run tern tour, a local agent process reads your git repo, your Claude Code session logs in ~/.claude, and the PR diff, then assembles the tour. The agent listens on localhost:1457 so the browser can fetch the tour content from your laptop directly.

In your browser. The web app at tern.sh renders the tour, holds your account, scopes sharing to your org, and brokers a thin Anthropic proxy for LLM calls. The page you’re looking at is the bridge: it reaches back to your local agent for the tour’s stops, pointers, and rationale, rather than storing them itself.

What we see, roughly

Most processing happens locally. The agent reads your repo on your machine, queries the LLM from your machine, and keeps the tour content in its local SQLite under ~/.tern/.

What ends up on Tern’s servers: your account, org membership, and tour-set identity (the PR/branch/commit pointers, the lens history, the bridge so a browser can find your local agent). Light identifiers and short text summaries, not your code.

What’s sent to the LLM: file paths, the diff text the LLM needs to reason about, and prompts/plans from your Claude Code sessions. By default this goes to Tern’s Anthropic proxy; route it through your own gateway with ANTHROPIC_API_KEY or another supported provider if you’d rather. The proxy exists so we can keep spend bounded, which is also why the first run creates an account.

It’s not hermetically sealed, and we’re not going to claim it is. Tern is well-intentioned and competent, not hoovering up data it doesn’t need.

Authentication

First run creates an autogenerated account and stores credentials in ~/.tern/auth/. The account is what lets us bound spend on the proxy; it’s not strongly identifying. You can pick a username, or accept the autogen.

If you’d rather skip Tern’s proxy entirely, configure your own provider and disable the proxy: set ANTHROPIC_API_KEY (or any other supported provider) plus TERN_MODEL_BASE_URL=null, or switch providers in Settings. The Tern account still exists for org membership and sharing, but the LLM call itself no longer touches our infrastructure.