great_cto

v2.70.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 1mo AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agentic-coding claude-code-plugin claude-code-skills claude-code-subagents code-review cto

+2 more

multi-agent sdlc

Affected surfaces

auth

Summary

AI summary

Anonymous CLI telemetry is now opt‑in by default with strict data safeguards.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	Collects no PII; anonymizes user via truncated SHA-256 hash Collects no PII; anonymizes user via truncated SHA-256 hash Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Security	Medium	Server-side Cloudflare Worker drops IP addresses and validates keys/commands Server-side Cloudflare Worker drops IP addresses and validates keys/commands Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Feature
Feature	Low	Re‑introduces opt‑in CLI telemetry, default OFF Re‑introduces opt‑in CLI telemetry, default OFF Source: llm_adapter@2026-06-13 Confidence: low	—
Feature	Low	Adds opt-in CLI telemetry (default disabled) Adds opt-in CLI telemetry (default disabled) Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Feature	Low	Provides `npx great-cto telemetry` commands to toggle or query status Provides `npx great-cto telemetry` commands to toggle or query status Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Feature	Low	Respects `DO_NOT_TRACK=1` environment variable and skips CI automatically Respects `DO_NOT_TRACK=1` environment variable and skips CI automatically Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Feature	Low	Implements `/v1/forget` endpoint for Right-to-Be-Forgotten compliance Implements `/v1/forget` endpoint for Right-to-Be-Forgotten compliance Source: granite4.1:30b@2026-06-13-audit Confidence: low	—

Full changelog

Anonymous, opt-IN CLI telemetry (default OFF, no PII)

Re-introduces usage telemetry after the zero-collection stance of v2.9.2 — strictly opt-in. A fresh install collects nothing until the user enables it.

Sent only when opted in: one event per command — { ts, version, command, archetype, node, os, exit_code, duration_ms, anon_id }. No paths, no code, no repo names, no IP, no PII. anon_id = sha256(user@hostname) truncated to 8 hex (not reversible).
Toggle: npx great-cto telemetry on|off|status|whoami · GREAT_CTO_TELEMETRY=on · honors DO_NOT_TRACK=1 · auto-skips CI.
Server-side guards (Cloudflare Worker + D1): drops IP, rejects unknown keys + non-allowlisted commands, 30-day TTL, /v1/stats public aggregates, /v1/forget RtBF.
Policy: docs/PRIVACY.md. Tests: 7 privacy invariants. Verified end-to-end against the live endpoint.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track great_cto

Get notified when new releases ship.

About great_cto

Engineering-management layer of 34 specialist AI agents covering the full SDLC (architect, PM, senior-dev, reviewer, QA, security, devops, L3-support + 18 archetype-specific reviewers) with auto-detected archetypes and compliance gates (PCI-DSS, HIPAA, FedRAMP, GDPR, EU AI Act). Runs in Claude Code, Cursor, Codex CLI, Aider, and Continue via AGENTS.md + MCP. MIT.

All releases →

Related context

Related tools

Earlier breaking changes

v2.72.2 Removes Autopilot sidebar item and Operate topbar button from dev board.
v2.55.0 Hard-gates the Build board; redirects invite sessions to Operate for operators.
v2.43.0 Runtime now blocks autonomous execution of irreversible actions without prior human checkpoint.
v2.43.0 Adds reversible and blastRadius fields to every flow step.
v2.32.0 Removed AgentShield scanner and its CLI commands.