AI-assisted development on air-gapped networks

The problem with AI assistance on a disconnected network

Most AI coding tools are cloud services with an editor attached. On a network with no route to the internet, they do not degrade gracefully, they simply do not work, and the developers working there have spent the last few years watching everyone else get faster.

The usual workarounds are worse than the problem. A second laptop on a different network invites copy and paste across the boundary, which is the exact thing the boundary exists to prevent. A self-hosted model behind a proxy means someone now owns a model server, its GPUs, its updates and its access control. Neither is a tool decision; both are infrastructure projects.

Onyx Code takes a different approach: the inference engine and the model live inside the editor, on the workstation, and the product ships a switch that blocks outbound traffic and proves it did.

How Air-Gap Mode is enforced

Air-Gap Mode is a toggle in the Command Palette and a status-bar pill that reads AIR-GAPPED when it is on. It blocks model downloads, the extension marketplace, auto-update, external server probes and HTTP-transport MCP servers. Localhost stays available, so the bundled engine keeps working. It is enforced in three independent places, deliberately.

• In the application code. Every outbound call from an Onyx code path goes through a wrapper that throws before the network stack is touched.
• In the extension host. The check runs inside every MCP HTTP and SSE transport, and the callback is a required constructor parameter, so a future transport that forgets to wire it up fails to compile rather than leaking quietly.
• In Electron itself. A request-level backstop aborts any non-loopback request that got past the first two layers and writes it to the main log. The wildcard bind address is not treated as loopback, so a crafted MCP URL cannot use it as a route out.

Alongside it, a per-workspace AI kill switch disables every AI surface for one repository, which is the right control when a machine is only sometimes handling regulated code.

The evidence an auditor will ask for

A control that produces no record is difficult to attest to. These are all on the Free tier; privacy features are never paywalled.

• AI Activity Log. Every prompt, every file the AI read, every edit it proposed, with timestamps, on the machine.
• Audit PDF export. The same record as a document you can hand to somebody who is not going to open your editor.
• .onyxnoai exclusion patterns. Gitignore-style paths that no AI surface may read: not chat, not the index, not autocomplete, not agents. It lives in the repository, so it travels with the code and is reviewable in a pull request.
• Prompt sanitizer. Every send and every attachment is scanned locally for credentials, keys, tokens and certificates, with redaction offered before the prompt is built.
• Loopback-only inference binding. The bundled engine listens on the loopback interface, so nothing on the LAN can reach it.
• Binary integrity. Signed and notarised installers on all three platforms, with a SHA-256 sidecar for the engine binary.
• No telemetry by default. Nothing to disable, nothing to negotiate.

The privacy policy states what the product collects, and the documentation describes each control in the detail a security reviewer will want, including the commands to verify air-gap enforcement independently.

Getting it onto a machine that has never been online

• The installer. Signed and notarised builds for macOS, Windows and Linux are ordinary files. Download on a connected machine, verify the signature, transfer by whatever route your policy allows.
• The model. Model files are GGUF files on disk. Fetch one on a connected machine and copy it across, or fetch it before Air-Gap Mode is switched on.
• The licence, if you want Pro. Normal activation is online. For a machine that will never be online, generate an offline activation file elsewhere and copy it over. The Free tier requires no activation at all, and includes every privacy control on this page.
• Extensions. Install from VSIX files, the same way any disconnected VS Code installation works.

Where this comes up

Situations, not job titles. If any of these describe your week, this page was written for you.

• Defence and government work on classified or restricted networks, where the tooling question is settled by the network, not by preference.
• Healthcare and health-tech engineering against systems holding patient data, where the review cost of adding a processor is measured in months.
• Financial services and anything under a regulator that expects you to evidence controls rather than describe intentions.
• Legal and professional services bound by client confidentiality terms that name third-party processors explicitly.
• Industrial, energy and manufacturing control-system networks that are segmented from the internet by design.
• Consultancies working under a client agreement that forbids code leaving the client environment, one project at a time.

For teams and procurement

Onyx Code is sold today as a one-time personal licence: $39 for three machines, major version upgrades included, no subscription and no seat management. Teams buying several licences, or anyone who needs a security questionnaire answered, a signature on a data-processing position, or an evaluation build for a review board, should get in touch directly at [email protected].

The short version for a review board: inference is local, there is no account on the Free tier, there is no telemetry by default, outbound traffic can be blocked and the block is enforced in three layers, and the tool produces an exportable log of everything the AI read and wrote.

Questions

Can an AI coding assistant work on an air-gapped network?

Yes, if the model runs on the workstation. Onyx Code bundles the inference engine, runs the model locally, and has an Air-Gap Mode that blocks outbound traffic in three enforcement layers while leaving localhost available.

How is this different from running Ollama behind a firewall?

Functionally you can get to a similar place. The differences are that nobody has to operate a model server, the block is enforced by the product rather than by network configuration, and the tool produces an audit record. If you already run a model server, Onyx Code can connect to it instead on the Pro tier.

Does Air-Gap Mode block extensions too?

It blocks the marketplace, since that is an outbound call. Extensions already installed keep working, and new ones can be installed from VSIX files.

Can I prove nothing left the machine?

Yes, and you should not take our word for it. The documentation includes the steps: turn on Air-Gap Mode, attempt an action that would need the network, confirm the block in the application log, then check the process for established non-loopback sockets.

Is the audit log tamper-proof?

It is a local record on a machine its user controls, so treat it as evidence of what the tool did, not as a tamper-evident chain of custody. We would rather say that plainly than let a security reviewer discover the limit themselves.