Audit a codebase that cannot reach the internet.
For the repositories that are the reason your team cannot use a hosted scanner.
Lucid Train's audit is a desktop application shelling out to scanners on your machine, so nothing about the architecture requires your source code to be uploaded to a vendor. The agent-configuration scan makes no network call whatsoever and works fully air-gapped. The dependency scanners themselves vary: those that carry or cache a local vulnerability database keep working offline, while any that query a remote service need whatever access that service needs. Paired with a local Ollama model, the whole loop from finding to fix can run with no outbound connection.
Where the boundary actually is
The honest split is between the parts that are ours and the parts that are the scanner's. The tab, the manifest discovery, the merge and the agent-config scan are local and need nothing. Whether a given vulnerability database is reachable is a property of the scanner you installed, so an offline deployment is a question about provisioning osv-scanner's database rather than about this application.
Nothing is uploaded to us
There is no server-side component to the audit. Manifests are read on your machine, scanners run on your machine, and findings are rendered from a local process. This is the same architectural property that lets the rest of the product run against local models, and it is why it fits environments where a browser-based scanner is not an option.
The fix loop can be offline too
If the engine is the bundled one pointed at a local Ollama model, then reading the findings, reasoning about an upgrade and writing the change all happen without a network. That is the configuration to reach for in a genuinely disconnected environment, because every third-party CLI engine will want to talk to its own vendor.
Bring your own scanners
The scanners are not bundled. Each backend is probed on PATH before it runs, and a missing one becomes an entry telling you what to install rather than a silent gap in the report. That keeps the download small and means you are running the same scanner versions your CI runs, but it does mean a machine with none of them installed gets an inventory and the agent-config findings rather than a vulnerability list.
Questions
Related
- Security Audit Inside a Coding AgentScanning where the code is, rather than reporting to somewhere the code is not.
- Software Supply Chain AuditThe packages you import are audited by everyone. The programs your agent launches are audited by almost no one.
- MCP Server Security ScanningAn MCP server is a program with your agent's permissions. Most people install one without reading what it launches.
- Dependency Vulnerability AuditReal scanners, run locally, with an agent that can then do the upgrades and show you the diff.
Last updated