01
Where each workflow runs
The important distinction is not simply “text” versus “URL.” A text-only web analysis runs locally. When one part of a combined workflow is a URL, the web app sends every input required for that request to the stateless API so the comparison uses one consistent analysis contract.
No document is sent to the API. Custom stop-word lists and an explicitly saved comparison baseline may remain in your browser storage.
The API receives the inputs needed for that operation. In a mixed comparison, this can include companion pasted text as well as the public URL.
Request content is processed to create the response. It is not added to an account, document database, or analysis history.
Files, inline text, and stdin stay in the CLI process. A URL is downloaded directly by the CLI.
Tool arguments and results stay between the MCP client and the local server. A URL is downloaded directly by that process.
02
Web tools and browser storage
Pasted text is analyzed in the browser when every selected source is text. The browser does not need to upload that document for the calculation. If a workflow includes a public URL, the tool clearly switches to the API path and sends the inputs needed for the combined operation.
Editable stop-word lists are saved in local browser storage so they survive a refresh. The Bag of Words analyzer can also save a comparison baseline locally when you choose that action. This data stays on that browser profile until you reset it, clear the saved baseline, or clear the site's browser data.
Do not combine confidential pasted text with a public URL if the text must never leave your device. Run both sources as local text instead, or use the CLI.
03
Public API processing
The versioned API receives JSON, processes it in server memory, and returns a JSON result with Cache-Control: no-store. The service does not create accounts, save submitted documents, build a server-side analysis history, or put result terms into a document database.
Successful API payloads declare storage: "none". That declaration refers to submitted content and analysis results. It does not mean the server has no security, quota, access, or reliability metadata; those limited records are described below.
Every API response has a random request ID for support and correlation. The ID is not derived from the input text, analyzed URL, result, or network address.
04
Fetching public URLs
URL inputs are fetched only after you explicitly submit them. The API and local CLI accept public HTTP or HTTPS destinations, resolve addresses before connecting, reject private and reserved networks, recheck redirects, and enforce request, byte, time, and analysis limits.
The destination website necessarily receives a request from the machine performing the fetch and can apply its own logs, cookies, terms, or access rules. Text Analysis Tools cannot control that third party's retention practices. Do not use URL mode for private dashboards, authenticated pages, intranet services, or URLs containing secrets.
05
CLI and local MCP workflows
The npm CLI analyzes inline text, local files, and piped stdin inside your Node.js process. The local MCP server exposes the same deterministic operations over stdio. Neither needs to send local document content to textanalysis.tools.
When you give the CLI or MCP tool a public URL, that local process downloads the page directly. Your MCP client or agent may have separate logging or conversation-retention behavior, so review that product's settings before supplying sensitive data.
06
Quota state and privacy-safe operational logs
The application's structured API logs are deliberately restricted to a random request ID, operation name, HTTP method and status, duration, response byte count, and a coarse error class. They do not include submitted text, analyzed URLs, result terms, document content, request headers, or client IP addresses.
Rate limiting keeps a bounded counter and time window for a hashed network identifier. On a multi-worker deployment, those hashed quota buckets may be kept in a shared local directory. Expired entries no longer affect requests and are cleaned as their bucket is updated. Quota state is not an analysis history.
Application-log retention is controlled by the production hosting configuration. The hosting and network layers can separately keep standard security or access records, such as a client address and the API route requested, under the hosting provider's controls. An analyzed destination remains inside the JSON request body rather than the API route. The application logs can therefore diagnose latency, errors, quota responses, and remote-fetch failures without reconstructing an analysis.
07
Optional analytics
The core tools do not require analytics to function. A deployment can optionally enable Google Analytics for page usage and limited product events, such as the tool, input mode, selected language, and aggregate counts. Server-side events can likewise report the operation and coarse execution metadata. These integrations are disabled when their environment configuration is absent.
Analytics events are designed not to include submitted documents, the URL entered for analysis, or result tables. If analytics is enabled, Google's own identifiers, cookies, and retention controls are governed by the configured Google Analytics property and your browser settings.
08
Retention, control, and safe use
- Clear this site's browser data to remove locally saved stop-word settings and baselines.
- API document content and results have no server-side history to retrieve or delete.
- CLI output exists only where you print or save it; MCP retention depends on the client you connect.
- Do not submit secrets, personal data you are not authorized to process, or access-bearing URLs.
- Review the API limits and the source website's terms before automating URL analysis.
This description reflects the open-source implementation as of August 2, 2026. If the data flow changes, the implementation and this page should change together.
LOCAL-FIRST · EXPLICIT NETWORK USE
Choose the boundary that fits your document
Use the browser for text-only work, the CLI or local MCP server for files and private local workflows, and the API when an application needs stateless HTTP analysis.
Read the local CLI guide →