← Back to blog

AI Commit Messages with Your Own Key: Your Diff Never Touches Our Servers

feature privacy

The Case for AI Commit Messages -- and Where It Ends

Every developer knows the moment. You have just finished a long refactoring session, the staged diff touches a dozen files, and Git asks you to summarize all of it in a line or two. You type "refactor stuff", promise yourself you will write better messages someday, and move on. Six months later you are digging through the history, trying to remember what "refactor stuff" actually changed.

This is the problem an AI commit message generator genuinely solves. A language model is good at exactly this task: it reads the staged diff, notices everything that changed -- including the config file you forgot you touched -- and drafts a message that describes the change instead of your mood at 7 pm. For large, multi-file commits, that is a real gift to your future self and to anyone who ever reviews your history.

Let us be equally honest about the other side: for trivial one-liners, AI is overkill. If you fixed a typo, typing "Fix typo in README" is faster than any generation round-trip will ever be, and no model will improve on it. The point of AI commit messages is not to replace your judgment on a one-character change. It is to remove the tedium from the changes that are genuinely hard to summarize.

The Question Nobody Asks: Whose Servers See Your Diff?

When Git clients started adding AI features, most followed the same playbook: the app sends your diff to the vendor's own cloud, the vendor's backend forwards it to a model provider, and the response travels back through the same pipe. It is usually sold as convenience -- no API key to configure -- and often bundled into a subscription with a monthly quota of "AI credits".

Now think about what is actually travelling through that pipe. A diff is not metadata. It is your source code: the unreleased feature, the security fix you have not shipped yet, the credentials a teammate accidentally staged. When an AI request is proxied through a vendor's servers, that vendor's infrastructure sees all of it. You are no longer trusting just a model provider. You are also trusting a middleman -- their logging configuration, their retention policy, their subprocessors, and whatever their terms become after the next acquisition.

To be clear, we are not claiming that any particular company mishandles your diffs. The problem is structural. Every additional party in the path is an additional party you have to trust, audit, and keep trusting over time -- and in most cases you have no way to verify any of it. If you have read why GitSquid ships with zero telemetry, you already know how we feel about being that party.

GitSquid's Answer: Bring Your Own Key

GitSquid took the other route. When you use an AI feature in GitSquid, the request goes directly from your machine to the provider you configured. GitSquid has no servers in the path -- not as a policy we promise to uphold, but as a matter of architecture: there are none. No proxy, no markup on tokens, no retention by a middleman, because there is no middleman.

You choose the provider in Settings → AI:

  • Anthropic Claude. Paste your API key and requests go straight from GitSquid to Anthropic.
  • OpenAI. Same model: your key, your account, a direct connection.
  • Claude Code. If you already have the Claude Code CLI installed, GitSquid drives it locally. There is no API key to paste at all.
  • Gemini CLI. Added in v2.7.7, and also key-free: GitSquid reuses your existing Gemini CLI sign-in.
  • Any custom OpenAI-compatible endpoint. Point GitSquid at any server that speaks the OpenAI API -- which includes local models running behind an OpenAI-compatible server on your own machine. In that setup, your diff does not even leave your computer.

On Anthropic, OpenAI, and custom OpenAI-compatible providers, the generated text streams in as it arrives, so you can read the draft while it is being written. Claude Code delivers its result as a single chunk on completion -- a limitation of the CLI, not of GitSquid. Either way, generation is cancellable: the Generate button turns into Cancel while a request is in flight, and Explain has its own Stop button. Nothing keeps running behind your back.

One small detail we care about: every AI-driven menu entry and button in GitSquid is marked with a sparkle icon. You always know, before you click, whether an action will send something to your AI provider.

The Three AI Features in Practice

1. Commit message generation

Stage your changes exactly as you always do, then click Generate. The AI reads the staged diff -- only the staged diff -- and drafts a commit message describing it. You can edit it, accept it, or throw it away and write your own. It is a draft, not a decree: the commit is still yours.

2. AI pull request descriptions

The Create Pull Request dialog has a "Generate with AI" button that streams a structured description -- Summary, Changes, Test plan -- straight into the body. If your repository has a PULL_REQUEST_TEMPLATE.md, GitSquid respects it: the AI fills in your team's template instead of bulldozing it with its own format.

3. AI explain, anywhere

Right-click a commit in the graph, a hunk header in a diff, or any file -- staged or unstaged -- and ask for an explanation. You get an inline breakdown of what the change does. It is equally useful for archaeology ("what did this commit from 2023 actually do?"), for reviewing your own work before you commit it, and for finding your bearings in an unfamiliar codebase.

What It Actually Costs

Because you bring your own key, you pay your provider directly -- and only for what you use. A commit message generation sends a single prompt roughly the size of your diff. On current API pricing, that typically works out to a fraction of a cent. We are deliberately not quoting exact figures: providers change their prices, models vary, and any number we print here would eventually be wrong. The honest answer is the best one: check your provider's price list, then check your own bill.

And that is exactly the point. Every request appears on your bill, from your provider, with no markup from us and no opaque bundle of "credits" in between. If you use the Claude Code or Gemini CLI paths, you are reusing tools and plans you already pay for. And with a local model behind an OpenAI-compatible endpoint, the marginal cost of a commit message is approximately the electricity it takes to generate it.

Answers in Your Language

One more thing a raw API key will not give you out of the box: Settings → AI lets you pick the response language for every AI feature -- ten languages to choose from, plus "Same as app". So you can have commit messages and pull request descriptions in English for an international team, while AI explanations arrive in the language you actually think in.

Your Key, Your Data, Your Bill

The AI bundle -- commit message generation, pull request descriptions, and explain -- is part of GitSquid Pro, at 49 EUR per year. The free tier covers everyday Git work; Pro adds the features that take the tedium off your hands. Either way, the architecture is the same: no account required, zero telemetry, and no GitSquid servers between your diff and your AI provider, because there are no GitSquid servers at all.

If you want to see how that compares with the rest of the market, our Git GUI telemetry comparison looks at what popular clients send home. And if you would rather just try it yourself: Download GitSquid, plug in your key -- or your CLI, or your local model -- and let the AI write the commit message while your diff stays strictly between you and your provider.