Everything the client sends over the network
A complete list of the connections Matcha makes, why each one exists, and how to turn them off.
A client that asks to be trusted should say exactly what it does. This is every network connection Matcha makes, why it exists, and whether you can disable it.
On launch
Mojang authentication. The same session handshake vanilla performs. Matcha does not see your password; it uses the token the launcher already holds. If this fails, the client still starts in an offline session rather than refusing to run.
Version check. A single request to the releases endpoint to find out whether a newer client exists. It sends the current version and nothing else. If it fails, nothing happens.
While playing
Presence, if enabled. When the realtime features are on, the client tells the presence server that you are online and which server you are connected to, so friends can see it. This is off unless you turn it on.
The Matcha tag. To draw a badge beside players who also run Matcha, the client asks the presence server which of the players near you are also connected. It sends the usernames it can already see in the player list — nothing it did not already know.
AutoTip, if enabled. Sends chat commands to Hypixel on your behalf, which is the entire point of the mod. It talks to the game server, not to us.
What is not sent
No analytics. No crash telemetry. No hardware fingerprint. No advertising identifier. No account beyond the Mojang session the game already uses. There is no Matcha account to create.
How to check
Do not take the above on faith. The realtime client is one file, and the mods that talk to the network are individually small. If you find a connection this post does not describe, that is a bug in the post or the code, and we want to hear about it either way.