CodeNavi runs entirely on hardware you own, and a scanner reads every chunk before it is stored or handed to a model — redacting secrets and PII and flagging prompt injection at the source. No telemetry, no code leaving your network. When you opt into a cloud LLM, it receives ranked chunks with citations — never whole files.
Every path from your source to an answer runs through the same gate. The scanner sits between your code and the index, so a credential or an injected instruction is caught before it can be embedded, stored, or returned to an agent.
Repositories stay on hardware you own. Nothing is uploaded to index it.
Functions and classes split on real boundaries across 15 languages.
Reads every chunk before it goes anywhere. Secrets and PII are redacted; injected instructions are flagged. Run it in tag-only dry-run or hard blocking mode.
A code-specialist model and your LanceDB index — both on your disk. Redacted values never reach either.
Bearer-token auth, a startup exposure guard, and tiered /health disclosure stand in front of the server.
Claude Code, Antigravity, or any MCP client gets ranked chunks with file:line citations.
Opt into a cloud LLM and it receives the same ranked chunks — never whole files. Zero telemetry from CodeNavi either way.
Detection rules span AWS, GitHub, Slack, Stripe, GCP, OpenAI, JWTs, database DSNs, PEM/private keys, Firebase, and generic credential patterns — plus PII, on by default: payment card numbers (Luhn-validated) and IBANs (mod-97-validated), with an opt-in extended set (SSN, email, phone, public IP). A match becomes [REDACTED:rule_id] before the chunk is embedded — so a leaked key or card number never enters the index, a search result, or a chat context.
Instructions hidden in code comments, string literals, or documentation — a hostile README or PDF telling an agent to exfiltrate — are caught by dedicated rules plus prose heuristics and marked [FLAGGED:...], so your agent is told to ignore them rather than obey them.
Flagged chunks land in a review queue, not silently into your index. Inspect each one in the Security screen and quarantine or allowlist it with a click — false positives are one action away, real hits stay contained.
Embedding, indexing, search, and reranking all run locally in a container you host — on your NVIDIA or AMD fleet, including Instinct MI300, with identical index quality on either. There is no usage beacon and no account. The only network calls are ones you can see and switch off: an optional once-a-day update check (version number and trial token, never code — disabled by deleting one file), and any cloud LLM you explicitly configure.
Images are cosign-signed, shipped with a CycloneDX SBOM, and built on pinned model revisions with no remote model-code execution. You verify the signing-key fingerprint out of band — over this page, a different channel than the package — before you install.
The MCP server takes bearer-token auth, and a startup exposure guard refuses to bind wide open by accident. The /health endpoint discloses in tiers, so an unauthenticated probe learns liveness, not internals.
CodeNavi works fully offline. Enable Claude, OpenAI, or OpenRouter for chat and the model receives ranked chunks with citations, never whole source files — and the choice is yours to make, per install.
A dedicated Security screen in the web UI shows scanner status, lets you flip dry-run to blocking, browse every flagged chunk, manage quarantine and allowlist, and run a scan tester against arbitrary text. The policy is yours to see and set.
Self-hosted with zero egress by default means the hard questionnaire rows answer themselves: no third-party recipient exists (GDPR), the data-flow diagram has no outbound arrow (SOC 2, ISO 27001), no PHI reaches the vendor (HIPAA), and there is no cloud service to authorize (FedRAMP). The framework-by-framework mapping →
The bundled Claude Code plugin adds /codenavi:compliance: an evidence-linked review of your indexed code against OWASP ASVS 5.0 core (30 rules) or the OWASP Top 10 2025. Every verdict cites file:line, "not applicable" and "cannot check from code" are stated honestly — audit preparation, not a certification.
Security you can't inspect is just a marketing claim. CodeNavi is built so you can check the
work — the whole architecture, threat model, and disclosure policy ship as SECURITY.md
in every package.
cosign.pub against the fingerprints published here, on a separate channel, before installing.Signed 30-day trial license, self-hosted on your infrastructure. Your code never leaves your machine, and you can prove it.