no-telemetry

no-telemetry is an open-source CLI tool built by apvarun that scans a JavaScript or TypeScript project's package.json, identifies dependencies that collect telemetry, and writes the appropriate opt-out environment variables to a .env file in a single command. It is released under the MIT license, has zero production dependencies, and makes no runtime network requests — including no telemetry of its own.

What It Is

no-telemetry is a developer privacy and policy enforcement tool for Node.js projects. It maintains a curated registry of JS/TS libraries that collect telemetry and the documented environment variables used to disable that collection. Running npx no-telemetry init -y matches the current project's direct dependencies against the registry and writes the correct opt-out variables to .env, including the cross-tool DO_NOT_TRACK=1 convention. The doctor command prints a per-tool status table, and check exits with code 1 if any installed library still has telemetry enabled — making it suitable for CI enforcement.

Registry Coverage and Supported Tools

The bundled registry covers 43 tools as of v0.2.0, including:

• 34 documented environment-variable opt-outs (e.g., NEXT_TELEMETRY_DISABLED=1, TURBO_TELEMETRY_DISABLED=1, CHECKPOINT_DISABLE=1)
• 2 opt-in checks (telemetry off by default)
• 7 config-only tools detected and reported but not modified

Named tools in the registry include Next.js, Prisma, Vercel CLI, Turborepo, Storybook, Expo, Wrangler, Supabase CLI, GitHub CLI, and Claude Code. The list and why <id> commands expose the full registry without requiring a project.

How It Works

1. Reads dependencies and devDependencies from the current directory's package.json.
2. Matches direct dependencies against the bundled registry (no network fetch at runtime).
3. Adds missing opt-out variables to .env (or a custom target path) in a marker-delimited block.
4. Resolves effective values from the process environment, .env.local, and .env in that precedence order.

Key safety properties: it never overwrites a non-empty value, never edits shell profiles or package.json, fills empty KEY= placeholders in place, and is fully idempotent on re-runs. Workspace scanning and transitive dependency scanning are explicitly out of scope.

CI Integration

no-telemetry is designed to be pinned and run in CI pipelines. The check command exits 1 on policy failure, making it a drop-in gate:

npx --yes no-telemetry@0.2.0 check --json=compact

All commands support --json and --json=compact for structured output suitable for pipes and automation. The --dry-run flag on init previews changes without writing files, and --target stdout sends pure KEY=VALUE lines to stdout for scripting.

Programmatic API

Beyond the CLI, no-telemetry exposes a stable ESM-only programmatic API for Node.js 18+. Key exports include scan, planInit, applyInit, failsCheck, buildReport, and REGISTRY. LibraryResult.status uses machine-stable tokens (disabled, enabled, not_applicable, not_found, unsupported) for reliable downstream processing.

Update: v0.2.0

The latest release is v0.2.0, published on 2026-08-22. The project was created on 2026-08-19, making this an early-stage but actively developed tool. The repository is TypeScript-first, tested on Node.js 18, 20, and 22, and uses pnpm. An agent skill definition is also included in the repository under skills/no-telemetry/SKILL.md, signaling intent for use in agentic workflows.