Local-first · signed & notarized
Run it all on your machine.
The Companion does the real work locally — code, credentials, and PoC runs never leave your device. The Workspace only ever sees a finding's shape.
Browser workflow
Install once. Drive from anywhere.
1
Download
Install the Companion — one signed package.
2
Pair
Enter the 6-character code from the Workspace.
3
Scan
Drive everything from the browser; work stays local.
Privacy by architecture
What never leaves your machine.
Not a policy — a boundary. The control plane is intentionally blind to your code.
Your repositories
Cloned and analyzed on your machine. Never uploaded.
stays on-deviceYour model keys
Stored in the OS keychain. The cloud never sees them.
stays on-deviceYour evidence
PoC runs, logs, and the final advisory render on-device.
stays on-devicePrefer the terminal?
Same engine, no app.
Run the methodology directly in Claude Code, or from any shell.
claude code plugin
/plugin marketplace add vulntraceai/vulntrace
/plugin install vulntrace@vulntracemacos · linux
curl -fsSL https://vulntraceai.com/install.sh | bashany os
npx vulntraceai@latest