Local-first code analysis — your code never leaves your machine
Most code-intelligence tools are a cloud service wearing a desktop icon: the repository goes up, the insights come down, and somewhere in between your employer's intellectual property sits on someone else's infrastructure. For a lot of codebases that is not a trade-off — it is a hard no from legal, and the tool evaluation ends there.
prism0x2A runs the other way round. Every scan — structure, cycles, churn, coverage — executes on your machine. We never see your codebase or your API key; the only call that reaches us is the licence check every 30 days. That is what makes it usable on the repository your company would never allow near a cloud tool.
What each layer sends — spelled out
The LLM features call your own key, and what that call carries depends on the layer:
- BLUE — structure, cycles, churn. Sends condensed metrics only. Your source code never leaves the machine.
- AMBER — checks whether your documentation still matches your code, which means it has to read both. Sends bounded excerpts of the files under review, capped per request.
- GREEN — works on what BLUE and AMBER already produced. Self-Heal is the exception: to patch a file, it sends that file.
The rule behind the split: features that interpret or rewrite code send code. Everything else stays local.
The honest part
Local-first is not a magic privacy wand — if you turn on the layers that read code, bounded excerpts go to the LLM provider you chose, under your key and their terms. The difference is that nothing moves without a feature you switched on, the boundaries are documented above, and the methodology is published rather than asserted.