Run it all on your machine.
The Companion does the real work locally — code, credentials, and PoC runs never leave your device. The Console only ever sees a finding's shape.
v0.1.8 · verify against SHA256SUMS.txt · macOS 12+, Windows 10+, Apple Silicon & Intel
Windows: the app is unsigned, so SmartScreen shows "Windows protected your PC" on first run — click More info → Run anyway. If Defender quarantines it, the surest path is to skip the app entirely and run it from your terminal (the plugin or CLI — no binary, nothing to flag).
Install once. Drive from anywhere.
Download
Install the Companion — one signed package.
Pair
Enter the 6-character code from the Console.
Scan
Drive everything from the browser; work stays local.
What never leaves your machine.
Not a policy — a boundary. The control plane is intentionally blind to your code.
Your repositories
Cloned and analyzed on your machine. Never uploaded.
stays on-deviceYour model keys
Stored in the OS keychain. The cloud never sees them.
stays on-deviceYour evidence
PoC runs, logs, and the final advisory render on-device.
stays on-deviceSame engine, no app.
Point the plugin at a repo inside Claude Code, or pipe a target through the CLI from any shell. Same gate, same advisories.
/plugin marketplace add VulntraceAI/vulntraceai-plugin
/plugin install vulntraceai@vulntraceai
/vulntrace ./your-reponpx github:VulntraceAI/vulntraceai-plugin ./your-repo