For (my) magic-wormhole, yep, entirely, source is on the github link above. It uses a pair of helper servers (that I run), for which the source is also on gith

For (my) magic-wormhole, yep, entirely, source is on the github link above. It uses a pair of helper servers (that I run), for which the source is also on github. But the protocol (implemented in the client, not the server) is carefully designed to be resistant against server misbehavior. So you can either study the client and convince yourself the protocol is indeed secure, or rely upon my claims that my code is working as advertised. But you don't need to rely upon my claims that my servers are not snooping or interfering: that's protected by the protocol.