Profiles: sourced access facts for 15 local tools (Q4 plan E3)

[YugantM]

Q4 plan E3. Line-reviewed by the owner on 9 Oct; every edit applied as proposed. The diff only touches safety_facts.json.

What it adds

55 facts for the 15 local tools behind most of the remaining safety searches in the E1 audit (#344). Each fact has a source and a label: PUBLISHER (the project's own words), CHECKED (observed by us on 9 Oct) or IN CODE (read from a pinned release of its source):

Profile	Highlights
Ollama	API binds 127.0.0.1:11434 by default; the official Docker image binds 0.0.0.0 (IN CODE); cloud prompts are processed but not stored or trained on (its words); OSV: 16 advisories (1 critical, 11 high), 3 in 12 months
AnythingLLM	telemetry on unless turned off; 25 maintainer advisories, 23 in 12 months
OpenCode	every tool, edits and shell included, runs without asking by default; asks outside the project and before reading .env (IN CODE; its docs wrongly say .env is denied)
Desktop Commander	its own SECURITY.md: reads/writes files and runs any command; guardrails "not a security sandbox"; tool arguments logged unredacted locally; 2 low OSV advisories
Open WebUI	Tools/Functions run arbitrary Python on the server (admins only, per its docs); 165 maintainer advisories, 162 in 12 months
Cherry Studio	data local; prompts go straight to your provider, except via its built-in model service relay
Blender MCP	any Python runs by default (safe mode opt-in); socket server has no auth; telemetry may train AI models; 1 OSV advisory
Qwen Code	Auto mode default; usage statistics on by default (IN CODE), though its notice calls them optional
Headroom, OpenShell, Odysseus, OnGrid, CKAN MCP, Aider, Agent Reach	access model, telemetry defaults, advisories, security policy

Review rules applied (from #347)

• A PUBLISHER fact says only what its source says. Defaults are read from code (pinned tag and line) when the docs are silent or wrong.
• Advisory lines carry severities. GitHub counts are paginated; OSV counts are de-duplicated across aliases (GHSA, GO-, PYSEC-). Products with no GitHub advisories were checked on OSV, which added Aider and Blender MCP.
• Agent Reach's README is in Chinese. The facts are close translations, and the first one says so.
• lastmod_diff: 7 profiles re-dated locally. The other 8 are pending_signals in stale local data but scored in prod, so all 15 will show and re-date there. No other pages move.

./scripts/gates.sh green; safety_fact_problems returns none.

🤖 Generated with Claude Code