Ship fast and safe.

No secrets leave your Mac.

A local pre-commit gate for teams shipping with AI coding tools. Catches secrets, vulnerabilities, and bad patterns before git does — entirely on your machine.

26 secret patterns0.982 L3 precision145 labeled evals<1ms Layer 1

Download for Mac View on GitHub

LocalForge

Check it out on Product Hunt →

macOS 14+ · Apple Silicon · MIT License · Zero cloud

zsh · local-forge

How the 4-layer pipeline works

Every commit passes four gates in under 10 seconds — entirely on-device.

git commit

Staged diff

Layer 1

Rust Regex

< 1ms · BLOCKS

Layer 2

CoreML / ANE

~200ms · BLOCKS

Layer 3

Qwen 7B LLM

~5-8s · ADVISORY

Layer 3.5

Static Analysis

bandit · clippy · vet

Report

Terminal + App

0.982 precision

Qwen2.5-Coder-7B on 145-diff eval corpus — 40× fewer false positives than 1.5B

0.754 F1

CoreML trained on 297 samples across 11 languages on Apple Neural Engine

< 10s total

full 4-layer pipeline — Rust regex, CoreML, 7B LLM, static analysis — entirely offline

Coming soon

LocalForge for Teams

A full desktop app with dashboards, KPIs, and commit logs built for startup engineering teams. Track security posture across your whole org — not just your own machine.

Org-wide commit security dashboard
Per-repo KPIs — block rate, issue categories, trend over time
Team log viewer with filtering by severity and engineer
VS Code Extension — scan from your editor, no commit required

No spam. We'll reach out when early access opens.

Layer 1 · Rust Regex

Blocks secrets before they ship.

26 patterns across 13 providers, compiled once at boot and matched in under 1ms. The fastest gate in the pipeline — no LLM needed to catch an exposed AWS key.

AWS, GCP, Azure, Stripe, GitHub tokens
SSH private keys, Anthropic & OpenAI keys
Hard blocks the commit — no bypass

pre-commit hook output

$ git commit -m 'update config'

LocalForge · scanning staged diff…

L1 Checking 26 secret patterns…

L1 ✗ MATCH: AWS_SECRET_KEY detected

in: config/aws.py (line 14)

✗ Commit BLOCKED — remove the secret and retry

Layer 3 · Qwen2.5-Coder-7B

Semantic review by a local 7B LLM.

Upgraded from 1.5B to 7B — precision jumps from 0.649 to 0.982, false positives drop from 40 to 1 on the eval corpus. Clean-diff commits skip the model entirely for near-zero latency. Advisory only, never blocks.

0.982 precision · 40× fewer false positives vs 1.5B
Fast path skips model on refactors, deletions, whitespace
Post-inference filter removes known-safe patterns

advisory report

LocalForge Advisory — commit a3f2c1d

L3 Model: Qwen2.5-Coder-7B (MLX)

[MEDIUM] SQL injection risk

in: models/user.py · fetch_records()

String interpolation in raw SQL query.

Fix: use parameterised queries or an ORM

[LOW] Unhandled exception path

in: api/routes.py · create_user()

Missing try/except around db.commit()

Layer 3.5 · Static Analysis

Deterministic tools run alongside the LLM.

AST-level checks that require more than pattern matching. bandit, pylint, ESLint, go vet, staticcheck, and cargo clippy run automatically — all installed by `localforge --install`.

Python: bandit (security) + pylint (dead code, unused imports)
JS/TS: ESLint · Go: go vet + staticcheck · Rust: cargo clippy
Results merged into the advisory report alongside L3

static analysis output

L3.5 Static Analysis

[bandit] B608 SQL injection via string format

models/user.py:42

[pylint] W0611 unused import os

api/routes.py:3

[clippy] suspicious use of unwrap()

src/parser.rs:88

Native App

A live window into every commit.

The SwiftUI app streams real-time scan events from every protected repo. Monitor tab shows each layer result as it runs. Repos tab manages hook status across all projects with one-click upgrades.

Live stream from ~/.localforge/hook.log
Multi-repo management — Active / Outdated / Missing
Scan Folder discovers all git repos automatically

LocalForge● Active

MonitorRepos

INFOScanning — files: api/routes.py

L1Rust regex: ready — 26 patterns active

L2CoreML score: 0.214 — clean

L3[LOW] No critical issues found (7B)

INFOScanning — files: models/user.py

L2CoreML score: 0.789 — BLOCKED

ERRCommit BLOCKED — secret detected

Installation

Install once. Protect every commit.

`localforge --install` wires the pre-commit hook, copies the binary to PATH, auto-downloads the 7B model, and installs all static analysis tools — all in one command.

Sets up ~/.localforge/ and installs hook (v4)
Auto-downloads Qwen2.5-Coder-7B, falls back to 1.5B if present
Installs bandit, pylint, ESLint, go vet, staticcheck, clippy

one-command install

bash

$ ./scripts/install_hook.sh ~/Developer/my-app

✓ Binary copied to ~/.localforge/bin/

✓ PATH added to ~/.zshrc

✓ CoreML model installed

✓ Qwen2.5-Coder-7B downloaded

✓ Static analysis tools installed

✓ Pre-commit hook (v4) installed

✓ Repo registered in LocalForge.app

LocalForge is active. All commits are now protected.

Team Setup

Ship security culture with --install-org.

Generates a turnkey shell script your team runs once. Drop it in your setup docs or Makefile — every engineer is protected without any per-user configuration.

Generates a shareable install script
Paste into dev setup docs or Makefile
Auto PATH setup — no manual steps

team install

bash

$ localforge --install-org

# Generated: localforge-team-setup.sh

# Share with your team. Run once per machine.

✓ Script written to ./localforge-team-setup.sh

# In your Makefile or setup docs:

curl -sSL <url> | bash

MCP Server

Connect your IDE via MCP.

A JSON-RPC 2.0 server lets Cursor, VS Code, and any MCP-compatible tool query LocalForge directly. Integrate scan results into your editor workflow.

JSON-RPC 2.0 · MCP-compliant
Works with Cursor, VS Code, any MCP client
Query scan results from your editor

VS Code / Cursor

MCP Server (JSON-RPC 2.0)

LocalForge Engine

MCP-compliant · JSON-RPC 2.0

VS Code Extension

Coming soon

What LocalForge catches

Seven categories of issues caught across three layers — from regex patterns to semantic LLM review.

Hardcoded SecretsBLOCKS

AWS, GCP, Stripe, GitHub, Anthropic keys caught before they reach git history.

AWS_SECRET_KEY = "AKIAIOSFODNN7EXAMPLE"

SQL InjectionBLOCKS

Raw string interpolation in queries flagged with parameterised query suggestions.

query = f"SELECT * FROM users WHERE id={id}"

XSS VulnerabilitiesBLOCKS

Unescaped user input inserted into DOM contexts identified across JS/TS.

el.innerHTML = userInput

Command InjectionBLOCKS

Unsanitised variables passed to shell commands — blocked before commit.

os.system(f'ls {user_path}')

Dead FunctionsADVISORY

Unreachable and unused code detected across 11 languages to keep the diff clean.

fn unused_helper() { ... } // never called

Unhandled ErrorsADVISORY

Missing try/except, unchecked Results, and swallowed panics surfaced before merge.

db.commit() // no exception handler

Logic BugsADVISORY

Off-by-one, incorrect conditionals, and edge-case gaps caught by Qwen semantic review.

if i <= len(arr): # should be <

v2.0.0 Release

See it in action

A live walkthrough of LocalForge intercepting a commit, running all three layers, and blocking a hardcoded secret — entirely on-device.

What developers say

Real reviews from engineers using LocalForge.

No reviews for now.

Be the first to leave one.

Start protecting your commits today.

Install in one command. Runs entirely on your Mac. Free and open source.