Air-Gapped Code Search for High-Security Engineering Environments

Air-gapped code search stopped being a nice-to-have somewhere around the last two years, and it's now a hard line item in procurement documents at banks, defense contractors, and hospitals. The shift is structural: regulators in finance, government, defense, and healthcare have started treating source code and its surrounding telemetry, meaning log lines, stack traces, incident transcripts, as sensitive data in its own right, not as some lesser category beneath "real" application data. That reclassification changes what counts as an acceptable AI coding tool, and it changes it in a way that most vendors were not built to satisfy.

The forcing functions are concrete and dated. The EU Data Boundary for the Microsoft Cloud was completed on February 26, 2025, and EU procurement teams now use it as the template they apply to every other vendor's data-residency claims. The EU AI Act is phasing in through 2027, converting what used to be a preference (keep the training and inference data in-region) into a legal obligation. And in a major national jurisdiction, cybersecurity disclosure rules adopted by a securities regulator on July 26, 2023, mean that incident data and system telemetry now carry disclosure risk on their own, independent of whatever the underlying application does. The compliance perimeter around code has gotten wider, not narrower, when those three are put together, and it keeps moving toward the "assume everything is sensitive" end of the spectrum.

The practical result, as of 2025, is a procurement wall. Regulated buyers, banks especially, but also defense contractors and healthcare systems, found that essentially every credible commercial AI coding tool required production telemetry (code, logs, stack traces) to leave the customer's perimeter in order to run inference. For a compliance officer at a bank, that single fact ends the conversation. It doesn't matter how good the autocomplete is.

What "air-gapped" means, and what it rules out

The word gets stretched past its useful meaning in most vendor marketing. Three structurally different architectures all get called "self-hosted" or "air-gapped," and only one of them actually earns the term.

The first is a self-hosted collector with VPC peering: the agent runs inside the customer's own VPC, but it still ships telemetry or inference calls out to vendor-managed infrastructure. The data collection point may be local, but the inference still reads the code somewhere the vendor controls. The second is single-tenant SaaS: a dedicated instance, isolated from other customers' data, but the vendor still operates the inference plane and, by extension, still has a technical path to the content passing through it. Only the third, true air-gapping, puts every component, orchestration runtime, memory and index, inference endpoint, on infrastructure the customer owns, with no outbound network call required to complete any task.

That distinction matters because only the third answers a compliance auditor's actual question, which is some version of: could a vendor employee have read our source code or an incident transcript? A contractual promise not to look is not the same as an architecture that cannot look. One is a data-residency promise; the other is a structural guarantee. Auditors, understandably, want the guarantee.

Self-hosted is a broader category than "on-premises."" It includes literal on-prem hardware, but also a customer-owned VPC inside AWS, Azure, or GCP, sovereign-cloud regions like AWS GovCloud or Azure Government, and genuinely air-gapped enclaves with no internet egress. These sit on what's useful to think of as a sovereignty spectrum, running from T1 (public SaaS) to T5 (fully air-gapped). A team's actual tier isn't set by its average requirement, it's set by its strictest one. A single regulator like FINMA, or a GDPR Article 28 clause without an approved processor agreement, or a classified-environment policy, collapses the whole decision down to T5. There's no averaging your way out of the strictest constraint in the room.

The three stacks an air-gapped code intelligence environment must run locally

Running an LLM on internal hardware is necessary but nowhere near sufficient. A genuinely air-gapped code intelligence environment needs three independent stacks running locally, each with zero outbound calls required to finish a task.

Orchestration is the agent loop itself, the logic (built on frameworks like LangGraph or a ReAct pattern) that decides what the agent does next. If that coordination layer phones home to a vendor's servers to figure out its next step, the air gap is already broken, regardless of where the model weights live. Memory is the dependency graph and the retrieval corpus, the indexed representation of the codebase (stored in something like Memgraph or Weaviate) that gives an agent or a search interface its actual context. The embeddings that make semantic search work have to be generated and stored locally; sending code out to an external embedding API is, functionally, the same data leak as sending it to an external chat completion API. Inference is the model itself, run through a local runner like Ollama or vLLM, or through a sovereign endpoint the customer controls. Routing that call to an external API collapses the whole exercise, no matter how careful the first two stacks were.

Hardware planning for this is not trivial. NVIDIA GPUs with 20GB or more of VRAM, the A100, H100, and RTX 6000/8000 class, are roughly the floor for running a modest tens-of-billions-of-parameters code model at a speed developers will tolerate. Pushing into a much larger parameter range, where a lot of the stronger open-weight code models live, means teams are usually looking at multiple GPUs or node-splitting, which adds real operational overhead. Larger team configurations can require multiple H100 or even next-generation flagship-class GPUs just to keep latency reasonable across concurrent users. On the control-plane side, a Kubernetes setup built for high availability needs roughly three nodes at four CPUs and 16GB of RAM each, a modest number next to the GPU bill, but a real one.

Networking and storage get less attention than the GPUs, and they shouldn't. Internal networks between AI servers and developer machines need to run at 10 Gbps or better, and storage requirements are in the multiple-terabyte range, preferably SSD, once model weights, embedding indexes, and logs are all accounted for. All of it has to be sitting on the internal network before deployment starts, not provisioned afterward.

Then there's image provisioning, which sounds mundane and turns out to be one of the biggest practical blockers. In a true air gap, there's no live pull from a public container registry. Docker images have to be side-loaded from an internal registry, or physically transferred via approved media. This isn't a shopping decision, it's an operational discipline problem: someone has to own the process of getting every image, and every update to every image, across the gap correctly and on schedule.

Air-gap requirements for code search and indexing

Running the LLM locally is what everyone thinks about first. It's also the easy half. Code search in an air-gapped environment demands that the entire indexing layer operate inside the perimeter, along with the model. Every repository clone, every trigram or vector index build, every cross-reference graph computation has to happen on internal compute. And embeddings for semantic or AI-assisted search have to come from a locally hosted embedding model; handing that job to an external API is a data egress event, full stop, even if the chat model itself is running on-prem.

Code context, in this framing, is a compliance surface in its own right. When an AI coding agent queries a code search index to build its prompt, the context it pulls back, which can include proprietary algorithms, embedded credentials, or regulated data fields, travels from the index to the inference endpoint. If either hop in that trip crosses outside the perimeter, the air gap is broken, even if every other component in the system is compliant.

This is where the Model Context Protocol, or MCP, has become the emerging standard worth watching. Anthropic released it in November 2024, and it's now governed as a vendor-neutral specification under the Linux Foundation's Agentic AI Foundation, following a donation in December 2025. MCP defines how AI agents talk to tool servers, so a code search platform that exposes an MCP server lets an agent query the indexed codebase without needing direct access to the repository itself. In an air-gapped deployment, that MCP server has to run locally too; a cloud-hosted MCP endpoint is just another egress path with a newer name. The ecosystem around it has grown fast, from a handful of reference implementations in late 2024 to a large and rapidly expanding number of public servers across major registries by mid-2026.

None of this is academic. Agents that can only see code sitting on a single developer's laptop produce output that misses organization-wide patterns, cross-repo dependencies, and implementations that already exist somewhere else in the company. Full codebase indexing inside the perimeter is what makes an agent's output trustworthy for a regulated engineering team, not merely what makes it compliant. Compliance gets you through procurement. Indexing gets you output worth using.

The code search and intelligence tool landscape for air-gapped environments

Of the tools most cited in the broader self-hosted AI coding landscape in 2026, only a small number credibly reach T4 or T5 on the sovereignty spectrum. On-prem or fully air-gapped, in other words. Most stop at T1 or T2, private VPC at best, and that same pattern repeats itself specifically in code search: plenty of tools claim "self-hosted," far fewer can survive an auditor asking where the embeddings actually get generated.

Zoekt sits at the raw-search end of the spectrum, and it deserves understanding on its own terms. It's an open-source engine, written in Go and licensed under Apache-2.0, built around trigram-based substring and regex search, with symbol-aware ranking and both a web UI and JSON/gRPC APIs. It returns results in well under 50 milliseconds on corpora around the size of a large mobile operating system codebase, roughly 2GB of text. It carries a modest number of GitHub stars as of mid-2026. By design, though, it's search-only: no cross-reference graph, no callers-and-usages analysis, no AI layer sitting on top. That's not a flaw so much as a scope decision, and it makes Zoekt a strong building block inside a larger air-gapped stack rather than a complete code intelligence platform by itself. Its core design has no external dependencies or cloud callbacks, which makes running it fully offline fairly straightforward.

Continue occupies a different spot: an open-source AI assistant, Apache-2.0 licensed, built as a VS Code and JetBrains extension, supporting Chat, Autocomplete, Edit, and Agent modes. It connects to essentially any model backend, Ollama, the OpenAI API, Anthropic's API, Azure OpenAI, Mistral, LM Studio, among others. An air-gapped deployment just means pointing it exclusively at a local Ollama or vLLM endpoint and nowhere else. Pricing for teams runs $10 per developer per month, and it's free for solo use. It's a viable open-source path toward air-gapped AI assistance, though it asks more of the engineering team setting it up, and the license terms are worth a careful read before committing. Continue doesn't ship its own code search or indexing layer, so it needs to be paired with something like Zoekt, or an equivalent internal index, to be useful across anything larger than a single small repository.

Taken together, these tools point at the actual shape of the problem rather than a single finished answer to it. Search, indexing, orchestration, and inference are four separate jobs, and the vendors that talk about "air-gapped AI coding" as one product usually mean they've solved one of the four convincingly and are hoping nobody checks the other three too closely. For a regulated engineering team, checking all four closely is required. It's the whole exercise.