The model server never leaves your Mac's loopback interface

Start with the ordinary part: Ollama, MLX, and llama-server all bind to 127.0.0.1 by default when you start them — the host's own loopback interface, not a real network address. That alone means the model server isn't reachable from another device on your LAN, let alone the internet, unless someone deliberately reconfigures it to bind elsewhere. Nothing Velo Workspaces does changes that default; it's just how these tools already work.

AI Bridge can't reach anywhere else, even if you tried

This is the part worth being precise about, because it isn't a setting or a promise — it's how the code is actually written. The vsock proxy that connects a guest to the model server has its target host hardcoded to 127.0.0.1, checked directly against the app's own source rather than assumed. Even the Custom provider option, which lets you point AI Bridge at any OpenAI-compatible server — covered in the AI Researchers post — only ever contributes a port number to that connection; whatever host or scheme you typed as part of that URL is discarded, and the proxy still dials the Mac's own loopback on that port. There's no field in the app's configuration that could route this channel to a genuinely remote address, because the code that opens the connection never reads one.

It goes a step further than that, too. The guest's regular network device — the one it uses for everything else, like apt or git — explicitly does not reach the model server either. A request sent to the guest's normal network gateway "arrives at the host's network stack having never touched the bridge," per the engineering comment describing exactly this failure mode, because the model server is bound to loopback and the gateway address is a different, unrelated door. AI Bridge's traffic takes an entirely separate path: vsock, a hypervisor-only channel addressed by machine ID rather than IP, proxied to the host's loopback on the host side. It never enters the IP networking stack that would let it reach a LAN or the internet, at any point in that path.

No collector on the other end, either

The channel being closed only matters if something's actually listening for the traffic on the other end — so it's worth confirming there isn't one. There is no analytics SDK, crash-reporting library, or telemetry collector anywhere in the Velo Workspaces codebase. That's not "collection you can opt out of" — there's no code path that collects anything to opt out of in the first place.

One thing worth flagging plainly rather than glossing over: this blog and the app's own Preferences pane have described diagnostics and crash reporting as an active, opt-in-but-available toggle. Checking the app's current source directly, that toggle was actually removed from Preferences — the engineering rationale on record is that a control promising data collection which doesn't happen is worse than no control at all, since it implies a choice that has no effect either way. That's a stronger privacy position than "off by default," not a weaker one — but it means some of Velo Workspaces' own published material describing an active toggle is currently out of date, and that's worth correcting rather than leaving as-is.

What this doesn't cover

Precision matters here, so it's worth stating the boundary of this claim rather than overstating it. Everything above describes AI Bridge's own channel specifically — the model server, and the vsock path a guest uses to reach it. It says nothing about the guest's normal internet access, which is unrelated and still there: a workspace can still apt install, git clone, or run anything else that talks to the internet over its regular network device, the same as any VM would. AI Bridge doesn't grant that access and doesn't take it away — it's simply a separate, narrower channel that only ever does one thing: proxy requests to a model server on your own Mac's loopback, nothing else, and nowhere else.

Related reading: the architecture behind AI Bridge, building and testing agents against a local model, and the security deep dive on what isolation levels actually protect against. Or download Velo Workspaces and try it yourself.