Skip to content

Air-gapped code RAG for AI coding agents

If you ask an AI assistant "how do I give a coding agent retrieval over a codebase that cannot leave the building?", the answer is a parts list: a code-aware chunker, an embedding model, a vector store, a reranker, a call graph, an MCP server to expose it, a secret scanner in front of it all, and a way to update the whole thing without an internet connection. This page is that parts list — and what CodeNavi ships for each item, so you can decide whether to assemble or install.

What "RAG for code" has to do differently

Retrieval-augmented generation (RAG) over documents is a solved shape: split text, embed, search by similarity, hand the top hits to a model. Code breaks three of those steps:

  1. Splitting. A paragraph boundary means nothing in source code. Chunks have to follow the syntax — a function, a class, a method — or the model receives half a loop and a stray }.
  2. Embedding. General-purpose text embedders were trained on prose. They rank a comment that mentions authentication above the function that performs it. A code-specialized embedder is the difference between "where is the session token validated?" returning the validator and returning the README.
  3. Relationships. "What calls this?" and "what breaks if I change it?" are not similarity questions. They need a call graph — a structural index built alongside the vector index, not derived from it.

Add the operational requirements an air-gapped site imposes — no model downloads at runtime, no telemetry, signed artifacts, updates by file transfer — and the parts list gets long.

The parts list, and what CodeNavi ships

You need Assembled yourself In CodeNavi
Syntax-aware chunking tree-sitter grammars per language, your own splitter AST chunking for 15 languages plus splitters for SQL, templates, config and docs
Code embedding model pick one, host it, quantize it, keep it offline Buric-E4B, a code-specialized 2560-dimension embedder, baked into the image — no runtime download
Vector store + reranker LanceDB/pgvector/Qdrant + a cross-encoder, wired together Vector search with cross-encoder reranking; 96/100 on the published retrieval suite (benchmarks)
Call graph SCIP/LSIF indexers per language, a graph store find_callers, impact_analysis, diff_impact, graph_neighborhood from a precomputed relations sidecar
MCP server write the tool layer, auth, scoping, health 33 MCP tools over HTTP, OAuth 2.1, per-codebase endpoints (/mcp/{codebase}), /health, Prometheus metrics
Secret / PII / injection scanning regex pipeline before indexing, kept current One scanner across code, docs and crawled pages: 48 rules, secrets and PII redacted at index time, prompt-injection content quarantined (security model)
Chat for humans a UI, session storage, provider adapters Web UI chat and CLI chat over the same index; local LLMs (Ollama, vLLM, LM Studio) by default
Offline install and update image export, checksum discipline, a runbook Signed self-contained package, ./setup.sh --airgap, cosign-verified updates by file transfer (air-gapped setup, updates)
Evidence for the questionnaire write it SBOM per release, framework fit for GDPR / SOC 2 / HIPAA / PCI / FedRAMP, compliance gap analysis

How the air-gapped deployment works

  • One container, one GPU. The image carries the embedder and the server. Docker or Podman (Fedora/RHEL guide); NVIDIA CUDA or AMD ROCm (GPU matrix). No outbound connection is made at any point — indexing, search, reranking and (with a local model) chat are all on-box.
  • Agents connect over MCP on the LAN. Claude Code, Codex CLI, Antigravity, VS Code, Zed, OpenCode, Pi and any MCP client point at http://<server>:8765/mcp — see Connect your agent. One server serves the whole team; each developer's machine holds nothing but a URL and a token.
  • Updates arrive as files. A signed update package is copied in and applied with one command; the updater refuses unsigned artifacts unless you explicitly override. Nothing on the server ever needs to reach the vendor.
  • Cloud is a choice, not a default. A remote LLM for chat is possible, and the UI warns before code chunks leave the box. Leave it unset and the deployment is zero-egress end to end.

Who runs it this way

Teams whose source code is the asset: client work under NDA, regulated industries (finance, healthcare, defense, industrial control), and anyone whose security review ends the conversation at "the embeddings are computed on the vendor's servers." The security model documents what leaves the box (nothing), what is redacted before an agent sees it, and what CodeNavi deliberately does not claim.

Next steps