AI-assisted development on air-gapped networks

The problem with AI assistance on a disconnected network

Most AI coding tools are cloud services with an editor attached. On a network with no route to the internet, they do not degrade gracefully, they simply do not work, and the developers working there have spent the last few years watching everyone else get faster.

The usual workarounds are worse than the problem. A second laptop on a different network invites copy and paste across the boundary, which is the exact thing the boundary exists to prevent. A self-hosted model behind a proxy means someone now owns a model server, its GPUs, its updates and its access control. Neither is a tool decision; both are infrastructure projects.

Onyx Code takes a different approach: the inference engine and the model live inside the editor, on the workstation, and the product ships a switch that blocks Onyx Code's own outbound traffic and logs what it blocked.

How Air-Gap Mode is enforced

Air-Gap Mode is a toggle in the Command Palette and a status-bar pill that reads AIR-GAPPED when it is on. It blocks Onyx Code's own outbound traffic: AI requests, model downloads, the extension marketplace, update checks, external server probes, the built-in browser and HTTP MCP servers. Localhost and the external model server you configured stay available, so the bundled engine keeps working. It is enforced in three independent places, deliberately.

• In the application code. Every outbound call from an Onyx code path goes through a wrapper that throws before the network stack is touched.
• In the extension host. The check runs inside every MCP HTTP and SSE transport, and the callback is a required constructor parameter, so a future transport that forgets to wire it up fails to compile rather than leaking quietly.
• In Electron itself.A request-level backstop aborts any non-loopback request from the app's windows and the built-in browser that got past the first two layers and writes it to the main log. The wildcard bind address is not treated as loopback, so a crafted MCP URL cannot use it as a route out.

What it does not cover: extensions (including the built-in Git and npm extensions) make their own network requests, and the integrated terminal, tasks and stdio MCP servers run as ordinary processes. Air-Gap Mode does not block them, so on a machine that must never reach the network, block it at the operating system or firewall too.

Alongside it, a per-workspace AI kill switch disables every AI surface for one repository, which is the right control when a machine is only sometimes handling regulated code.

The evidence an auditor will ask for

A control that produces no record is difficult to attest to. These are all on the Free tier; privacy features are never paywalled.

• AI Activity Log. Every prompt, every file the AI read, every edit it proposed, with timestamps, on the machine.
• Audit PDF export. The same record as a document you can hand to somebody who is not going to open your editor.
• .onyxnoai exclusion patterns. Gitignore-style paths that no AI surface may read: not chat, not the index, not autocomplete, not agents. It lives in the repository, so it travels with the code and is reviewable in a pull request.
• Prompt sanitizer. Every send and every attachment is scanned locally for credentials, keys, tokens and certificates, with redaction offered before the prompt is built.
• Loopback-only inference binding. The bundled engine listens on the loopback interface, so nothing on the LAN can reach it.
• Binary integrity. The macOS installer is signed with a Developer ID and notarised; the Windows and Linux packages are not code-signed, so verify those by hash. A SHA-256 sidecar ships for the engine binary on every platform.
• No telemetry by default. Nothing to disable, nothing to negotiate.

The privacy policy states what the product collects, and the documentation describes each control in the detail a security reviewer will want, including the commands to verify air-gap enforcement independently.

Getting it onto a machine that has never been online

• The installer. Every build is an ordinary file: download on a connected machine and transfer by whatever route your policy allows. The macOS build is signed with a Developer ID and notarised by Apple, so its signature can be verified before transfer. The Windows installer and the Linux packages are not code-signed, so verify those by hash rather than by signature.
• The model. Model files are GGUF files on disk. Fetch one on a connected machine and copy it across, or fetch it before Air-Gap Mode is switched on.
• The licence, if you want Pro. Normal activation is online. For a machine that will never be online, generate an offline activation file elsewhere and copy it over. The Free tier requires no activation at all, and includes every privacy control on this page.
• Extensions. Install from VSIX files, the same way any disconnected VS Code installation works.

Where this comes up

Situations, not job titles. If any of these describe your week, this page was written for you.

• Defence and government work on classified or restricted networks, where the tooling question is settled by the network, not by preference.
• Healthcare and health-tech engineering against systems holding patient data, where the review cost of adding a processor is measured in months.
• Financial services and anything under a regulator that expects you to evidence controls rather than describe intentions.
• Legal and professional services bound by client confidentiality terms that name third-party processors explicitly.
• Industrial, energy and manufacturing control-system networks that are segmented from the internet by design.
• Consultancies working under a client agreement that forbids code leaving the client environment, one project at a time.

For teams and procurement

Onyx Code is sold today as a one-time personal licence: $39 for three machines, major version upgrades included, no subscription and no seat management. Teams buying several licences, or anyone who needs a security questionnaire answered, a signature on a data-processing position, or an evaluation build for a review board, should get in touch directly at [email protected].

The short version for a review board: inference is local, there is no account on the Free tier, there is no telemetry by default, Onyx Code's own outbound traffic can be blocked and the block is enforced in three layers, and the tool produces an exportable log of everything the AI read and wrote.

Questions

Can an AI coding assistant work on an air-gapped network?

Yes, if the model runs on the workstation. Onyx Code bundles the inference engine, runs the model locally, and has an Air-Gap Mode that blocks Onyx Code's own outbound traffic in three enforcement layers while leaving localhost available.

How is this different from running Ollama behind a firewall?

Functionally you can get to a similar place. The differences are that nobody has to operate a model server, the block is enforced by the product rather than by network configuration, and the tool produces an audit record. If you already run a model server, Onyx Code can connect to it instead on the Pro tier.

Does Air-Gap Mode block extensions too?

No. It blocks the extension marketplace, since that is Onyx Code's own outbound call, but an extension makes its own network requests and Air-Gap Mode does not block them. Installed extensions keep working, new ones can be installed from VSIX files, and on a machine that must never reach the network, block it at the operating system or firewall too.

Can I check what Onyx Code sent?

Yes, for Onyx Code's own traffic, and you should not take our word for it. The documentation includes the steps: turn on Air-Gap Mode, attempt an action that would need the network, confirm the block in the application log, then check the app's processes for established non-loopback sockets. For extensions, the integrated terminal and tasks, and stdio MCP servers, the evidence is your operating system or network firewall.

Is the audit log tamper-proof?

It is a local record on a machine its user controls, so treat it as evidence of what the tool did, not as a tamper-evident chain of custody. We would rather say that plainly than let a security reviewer discover the limit themselves.