Ghost Architect™ Local · 8.0.93  ·  commercially released

Your code never leaves the building.
Your cost never surprises you.

Codebase intelligence that runs on your own machines, on a model you own, inside your network. Air-gapped if that is how you work. And every report tells you what it did not examine.

Same scans. Same reports. The model lives with you.

Start the evaluation trial See it running Local pricing →
Zero egress at the code level One monthly licence, no per-token bill Hub and spokes across your machines macOS, Linux and Windows
scroll

The most expensive question in software is still: where are we on that?

Today the answer lives in a ticket. Find it, hope it is the right one, hope someone updated it, ask in the channel, wait. Your codebase already knows where the project stands. Your ticketing system is a rumor about it.

Ghost Architect™ Local reads your codebase and puts the answer on a page: health, risk, what a change would reach, where the code disagrees with itself, and what to fix first. Run it on a commit, on a push, or five minutes before someone asks. Every scan is kept, so what changed and what it did to the health of the code is in front of you, not reconstructed in a meeting.

Stop looking for the ticket. Ask the code.

// the scan, on your machines

Every Ghost Open™ mode, plus Pre-Sprint, Pre-Epic and teams. On hardware you own.

A multi-pass read of the whole tree. Findings are verified against the source before they reach the page, the health score shows the denominator it was computed from, and the trend runs scan over scan.

  • 01

    Points of Interest

    The health of the codebase, with its evidence beside each finding. Red flags, dead zones, fault lines, landmarks.

  • 02

    Pre-Engagement Recon

    One planner call that reports what a full scan would read, how many passes, and how long, with the basis of the estimate printed beside the number.

  • 03

    Pre-Sprint Planning

    From the code as it is today: what the planned work will touch, what is fragile there, and what to settle first.

// on every commit

Ghost Triple Crown™
from a hook, on your LAN.

  • 01

    Blast Radius™

    Point it at the files you are about to touch and it maps what they pull in and what pulls on them, so the review starts with the map instead of building it.

  • 02

    Conflict Detection™

    Contracts, schemas and the seams between components, read for the places two parts of the system assume different things.

  • 03

    Ghost Brief™

    Remediation instructions grounded in your real files, dependencies and findings, for whatever coding assistant you already use. Ghost finds it, you decide, your tooling executes.

A pre-push hook runs the three-pass review on the developer's machine and asks before a risky push goes out. Pull request comments to a git server on your LAN when you turn them on.

// zero egress

Nothing leaves. Not a promise, an inventory.

The model runs on your hardware, so there is nothing on the other side to send the code to. Zero-egress mode refuses every outbound destination at the code level and prints the inventory that proves it: every destination that could exist, what it would send, and the switch that turns it off. That is the page your security director reads.

One call, once: licence activation sends the licence key and an install id to ghostarchitect.dev and gets a signed licence back. Nothing from the codebase is in it. After that the product runs with egress off at the code level, air-gapped if that is how you work. Read how →

// it tells you what it did not do

Coverage, in files and passes.

We are not going to tell you a local model is smarter than a frontier model. It is not, and you already know that. What we will tell you is that Ghost Architect™ does not let the model make claims it cannot back.

  • 01

    Nothing counted is not zero

    A report says 8 of 52 files analysed and claims nothing about the other 44. When a scan dies before it finishes counting, the record says nobody counted rather than reporting zero findings.

  • 02

    A verdict that hangs on one word says so

    The report prints what the score would be if one finding were graded one band lower. When the verdict flips on that word, it tells you, instead of burying the fragility in an average.

  • 03

    Every ending is recorded

    Completed, failed, cancelled, killed, lost: each is a row in the compliance ledger with the scan it belongs to, who ran it and on what. Signed CSV and PDF exports; a hash-chained audit log the product verifies in front of you.

Estimates name their basis. "About 120 minutes, measured on this machine: 6 recent passes, median 10 min each." Not a constant dressed as a measurement.

// for the CTO

It solves your problems, not just your code's.

The reasons a CTO looks at a local tool at all, and what happens to each of them.

Source that may not leave

Three clients forbid their code from leaving infrastructure they control

The model runs on your hardware, so there is nothing on the other side to send the code to. Zero-egress mode refuses every outbound destination at the code level and prints the inventory that proves it.

Spend you cannot forecast

The AI line on the invoice moves every month

One monthly licence, sized to the team. No meter, no per-token bill. A bad answer costs a re-run on machines you already own, not another line on an invoice, and the trial converts at half price for the first month.

Confident tools you cannot trust

Every scanner reports with the same confidence whether it read the whole tree or a tenth of it

Ghost prints its coverage in files and passes, says nobody counted rather than zero when a scan died early, and tells you when a verdict hangs on one severity word.

Status by chasing people

"Where are we on that?" costs a meeting

Every scan is kept, with its health score and trend, so the state of a codebase is on a page rather than in someone's head. Run it on a commit, on a push, or five minutes before the question.

Inherited codebases

A new engagement starts with a system nobody documented

Recon sizes it in one call and says what a full scan would read; Points of Interest reads it and grades it with the evidence beside each finding; Ghost Brief™ turns the findings into a prompt written from the real files.

Auditors and renewals

SOC 2 renews in January and the auditor wants records, not assurances

A compliance ledger with a row for every scan ending, who ran it and on what; signed CSV and PDF exports; a hash-chained audit log the product verifies in front of you. Evidence you can hand over.

Six teams, not one laptop

A tool that tells one engineer what one engineer scanned does not survive contact with six delivery teams

A hub and spokes: one queue for the whole fleet in the order you set, one Fleet page that says what every machine is doing, and LLM Status that tells you whether the model under all of it is healthy today against last week.

Sizing the hardware

What does forty engineers cost in machines?

The product measures its own pass time and prints the basis of every estimate, and LLM Status shows memory held and available per machine, so the second scan on your hardware is sized from the first and the next machine is a decision, not a guess.

// hub and spokes

How it runs, and what it runs on.

A hub and as many spokes as you enrol. The hub holds the model server, the queue and the fleet page; a spoke is any machine that runs scans and reports them back. Everything talks over your LAN.

Hardware, stated as measured, not as a brochure. On our own estate, a MacBook Air with 24 GB running qwen3:14b through Ollama, a Points of Interest pass takes about ten minutes, and a 125-file codebase is 20 to 27 passes. A bigger machine or a smaller model is faster. The product measures its own pass time and prints the basis of every estimate it makes, so the second scan on your hardware is sized from the first.

What you need: macOS 13 or later, Linux, or Windows 10 or later; Node.js 24 or later; a model server on your network with a model pulled: Ollama, vLLM, LM Studio, Jan.ai or any OpenAI-compatible endpoint you point it at. The installer checks the OS and Node floors and refuses rather than guessing. The Linux installer is verified on a fresh machine for every release.

// two deals

Local or Open?

Two products, two different deals. If your clients forbid source from leaving infrastructure they control, or more than one person needs it, Local is the one built for you. If you work alone and want to start in a minute on your own Anthropic key, Ghost Open™ is free for one person.

Ghost Architect™ LocalGhost Open™
Who it is forTeams, from one seat to unlimitedOne person
Where the model runsYour machines, your model serverAnthropic's API, through your own key
Where your code goesNowhere. Zero egress at the code levelTo Anthropic, per request, on your key
How you payOne monthly licence per team sizeFree. You pay Anthropic for model usage
Multiple machinesHub and spokes, one fleet pageOne person's own machines
Air-gappedYes, after activationNo

// pricing that does not move

A monthly licence, sized to the team.

No per-token bill, no metering, no surprise in month four. Start with the evaluation trial; convert during it and the first month is half price.

Solo Developer
$80
per month
1 seat
Small Team
$400
per month
5 seats
Agency
$1,000
per month
15 seats
Enterprise
$2,000
per month
Unlimited seats

Prices in USD. Full pricing and what each tier includes.

// questions people ask first

Questions people ask first.

Does anything leave my network?

One call, once: licence activation sends the licence key and an install id to ghostarchitect.dev and gets a signed licence back. Nothing from the codebase is in it. After that the product runs with egress off at the code level, and the egress inventory it prints lists every destination that could exist and shows each one switched off.

Which models does it use?

Whatever your model server serves: Ollama, vLLM, LM Studio, Jan.ai or any OpenAI-compatible endpoint. Our estate runs qwen3:14b. The LLM Status page shows the model, quantization, context window, memory and measured speed, so you can see what a model change did.

Is it the same as Ghost Open™?

No. Ghost Open™ is the free single-user CLI on npm. Local is a separate product delivered directly by us as a tarball, installed with its own installer, licensed per team, and it does not use a hosted model at all.

How long does a scan take?

It depends on your hardware and model, and the product tells you before you commit: the estimate names its basis, and once you have run a few passes it is measured from your own machine rather than a constant. On a 24 GB laptop with a 14B model, plan on hours for a real codebase and start it in the background; the fleet page and email tell you when it is done.

Can I run it in CI or on a commit hook?

Yes. The CLI has a non-interactive mode, the CLI registers a pre-push hook that runs the Ghost Triple Crown™, and the REST API on the hub is documented at /api/v1/docs on your own install.

Do I get the source?

The product ships as source in the tarball; that is what the installer installs. It is licensed, not open source, and the licence is signed and verified on the machine.

// start

Your code stays in the building.
Start there.

Download and try it Talk to EJ about Enterprise