de>scriptor
Security First

Your Code Never Leaves
Your Machine

Privacy-first, local processing. No telemetry, no cloud backend — built for proprietary and compliance-bound codebases.

Local-First Analysis

Scanning, parsing, indexing, and search make no network calls. Your source code and embeddings never leave your machine — there is no Devscriptor backend.

  • •FTS5 keyword and sqlite-vec search run locally
  • •Embeddings computed on-device via pure-Rust ONNX inference (tract)
  • •No cloud dependencies, no code upload
  • •Verify with: strace -e trace=network devscriptor scan

No Telemetry

No usage data is ever collected or transmitted. No analytics, no tracking, no phone-home — your usage patterns stay entirely private.

  • •No telemetry collection
  • •No analytics or usage statistics
  • •Self-update is not compiled into official binaries
  • •Official binaries never check the network for updates

One-Time Model Download

The embedding model downloads once on first embed (Hugging Face, with the Devscriptor mirror as a fallback), then runs fully offline. Pre-stage it for air-gapped machines.

  • •Downloads ~150 MB once, then caches locally
  • •Runs offline after the first fetch
  • •Pre-populate the cache for zero network access
  • •Suitable for HIPAA/SOX and air-gapped environments

No Dynamic Extension Loading

Devscriptor never loads a SQLite extension from disk. The dynamic-extension API is never enabled, so there is no extension attack surface at all — nothing to allow-list, nothing to verify at runtime.

  • •sqlite-vec is a statically linked Rust crate
  • •Registered via sqlite3_auto_extension, before any connection opens
  • •FTS5 and JSON1 compiled into the bundled SQLite
  • •No enable_load_extension / dlopen anywhere in the codebase

Respects Your Secrets

Three independent filters decide what is opened at all: .gitignore, a built-in exclude list, and an extension allow-list. Devscriptor only reads inside the path you point it at.

  • •Native .gitignore support (ignore crate)
  • •Extension allow-list: SSH keys and credential files are never opened
  • •Built-in excludes: node_modules, target, .venv, dist, vendor…
  • •json/yaml/toml/xml are in the allow-list — exclude them if sensitive

Memory-Safe Rust

Written in Rust for memory safety without garbage collection. Eleven unsafe constructs exist in shipped code, each confined to mmap reads, C FFI, or platform memory queries — and each carries a justification.

  • •11 unsafe constructs in shipped (non-test) code
  • •Confined to mmap parsing, sqlite-vec FFI, libc queries
  • •Parsing, analysis, MCP and LSP request paths contain none
  • •Pinned dependencies in Cargo.lock, regularly updated
Don't trust us — verify it

Point Wireshark at it. We'll wait.

A “no telemetry” claim on a closed-source binary is worth nothing on its own — so don't take our word for it. Watch the wire yourself.

From the moment you install it, Devscriptor is dead to the outside world. Scan, index, search, embed — not a single byte leaves your machine. The only packets you will ever see are the one-time embedding-model download (pre-stage it and even that disappears) and the LSP-server installs you explicitly ask for. Everything else is silence. The same holds for Juggler — except for the one thing it exists to do: talk to the model endpoint you configured, and nothing else.

This is a promise we cannot fake. A phone-home is trivial to catch — five minutes with any packet sniffer — and for tools that live inside your private code, getting caught would be the end of us. That asymmetry is the guarantee: falsifiability beats a privacy policy. “Point Wireshark at it, we'll wait” is a dare only an honest vendor can afford to make — so we're making it.

Linux

tcpdump · Wireshark · OpenSnitch · strace

# watch every outbound packet, system-wide
sudo tcpdump -n -i any tcp or udp
# or trace the process's network syscalls directly
strace -f -e trace=network devscriptor scan .

macOS

Little Snitch · LuLu · Wireshark · nettop

# Little Snitch / LuLu prompt on ANY connection attempt.
# Or sniff the wire and watch per-process traffic:
sudo tcpdump -n -i any
nettop -p "$(pgrep -x devscriptor)"

Windows

Wireshark · TCPView · GlassWire · Defender Firewall

# Sysinternals TCPView lists every socket, live.
# Or list the process's connections in PowerShell:
Get-NetTCPConnection -OwningProcess (Get-Process devscriptor).Id

Run any of these, then exercise both tools hard. Filter out your own model endpoint and the first-run model fetch, and the capture stays empty.

Verify your download

Every archive ships with a .sha256 checksum file right next to it. Confirm your download is byte-for-byte what we published before you run it — swap in your exact filename. On Linux and macOS the -c flag checks it for you and prints OK; on Windows, compare the two printed hashes yourself.

Linux

sha256sum -c devscriptor-<ver>-<target>.tar.gz.sha256

macOS

shasum -a 256 -c devscriptor-<ver>-<target>.tar.gz.sha256

Windows (PowerShell)

(Get-FileHash -Algorithm SHA256 devscriptor-<ver>-<target>.zip).Hash.ToLower()
Get-Content devscriptor-<ver>-<target>.zip.sha256   # the two hashes must match

Juggler archives are published the same way — every .tar.gz and .zip has a matching .sha256.

Our Privacy Promise

Devscriptor is designed with privacy as the foundational principle. We believe your code is your intellectual property, and it should never be shared with third parties. That's why scanning, indexing, and search run entirely on your machine — with no telemetry, no analytics, and no cloud backend. The only optional network activity is the one-time model download and on-demand LSP installs, both of which can be pre-staged for fully air-gapped use.

No TelemetryNo Analytics100% LocalAir-gapped Ready