What is grok-network-monitor?

Grok Network Monitor is a research toolkit that watches network traffic from xAI's Grok Build command line tool to see exactly what data it sends back to xAI's servers. It works by routing the grok CLI's traffic through mitmproxy, a tool that intercepts and inspects network connections, then classifying and logging what it finds. The project documents a set of findings about Grok Build's behavior. The CLI ships with working code that can package an entire git repository as a bundle and upload it to xAI's storage. That upload path is currently switched off by a setting controlled from xAI's servers, not by anything on the user's machine, so xAI could turn it back on at any time without a software update. The README also reports that an environment variable meant to disable data collection has no measurable effect on network traffic, that a privacy opt out setting only affects how long data is kept rather than whether it is sent, and that any file grok reads including files containing secrets is transmitted in plain text to xAI as context for the AI. It also counts more than fourteen tracking events sent per prompt to two separate analytics destinations. Alongside these findings the README gives practical advice: keep secrets out of repositories where grok runs, use gitignore to exclude sensitive files from any bundle upload, run the included detect-exfil script to check whether your own repositories were uploaded in the past, and block the analytics domain in your hosts file if you want to stop tracking without breaking the tool. Enterprise users are told that a zero data retention setting provides a second safeguard against uploads even if the remote flag changes. To use it you need macOS or Linux, mitmproxy, a working Grok CLI install, Python 3.8 or later, and bash, then run the included setup and test scripts. The project also raises a list of unanswered questions it has sent to xAI about retention, consent, and the scope of any past uploads.