Your Code Never Leaves
Your Machine
Privacy-first, local processing. No telemetry, no cloud backend — built for proprietary and compliance-bound codebases.
Local-First Analysis
Scanning, parsing, indexing, and search make no network calls. Your source code and embeddings never leave your machine — there is no Devscriptor backend.
- •FTS5 keyword and sqlite-vec search run locally
- •Embeddings computed on-device via bundled ONNX
- •No cloud dependencies, no code upload
- •Verify with: strace -e trace=network devscriptor scan
No Telemetry
No usage data is ever collected or transmitted. No analytics, no tracking, no phone-home — your usage patterns stay entirely private.
- •No telemetry collection
- •No analytics or usage statistics
- •Self-update is not compiled into official binaries
- •Official binaries never check the network for updates
One-Time Model Download
The embedding model downloads once on first embed (Hugging Face, with the Devscriptor mirror as a fallback), then runs fully offline. Pre-stage it for air-gapped machines.
- •Downloads ~150 MB once, then caches locally
- •Runs offline after the first fetch
- •Pre-populate the cache for zero network access
- •Suitable for HIPAA/SOX and air-gapped environments
No Dynamic Extension Loading
Devscriptor never loads a SQLite extension from disk. The dynamic-extension API is never enabled, so there is no extension attack surface at all — nothing to allow-list, nothing to verify at runtime.
- •sqlite-vec is a statically linked Rust crate
- •Registered via sqlite3_auto_extension, before any connection opens
- •FTS5 and JSON1 compiled into the bundled SQLite
- •No enable_load_extension / dlopen anywhere in the codebase
Respects Your Secrets
Three independent filters decide what is opened at all: .gitignore, a built-in exclude list, and an extension allow-list. Devscriptor only reads inside the path you point it at.
- •Native .gitignore support (ignore crate)
- •Extension allow-list: SSH keys and credential files are never opened
- •Built-in excludes: node_modules, target, .venv, dist, vendor…
- •json/yaml/toml/xml are in the allow-list — exclude them if sensitive
Memory-Safe Rust
Written in Rust for memory safety without garbage collection. Eleven unsafe constructs exist in shipped code, each confined to mmap reads, C FFI, or platform memory queries — and each carries a justification.
- •11 unsafe constructs in shipped (non-test) code
- •Confined to mmap parsing, sqlite-vec FFI, libc queries
- •Parsing, analysis, MCP and LSP request paths contain none
- •Pinned dependencies in Cargo.lock, regularly updated
Our Privacy Promise
Devscriptor is designed with privacy as the foundational principle. We believe your code is your intellectual property, and it should never be shared with third parties. That's why scanning, indexing, and search run entirely on your machine — with no telemetry, no analytics, and no cloud backend. The only optional network activity is the one-time model download and on-demand LSP installs, both of which can be pre-staged for fully air-gapped use.