Noctrodex SAST

Sovereign, air-gapped Static Application Security Testing for 16 GB local hardware — deterministic vulnerability analysis, taint tracking, and fully offline local scanning.

// What it is

Noctrodex SAST reads your source code and finds security-relevant defects before anything ships — without your code ever leaving the machine. It runs locally, air-gapped, on modest hardware (16 GB), so proprietary and regulated codebases are analysed on infrastructure you control. No cloud upload, no per-query metering, no phone-home.

// Key capabilities

• Deterministic vulnerability analysis — repeatable results you can gate a pipeline on, not a black-box score that changes run to run.
• Taint tracking — follows untrusted input from source to sink to surface injection, traversal, and unsafe-flow classes with the path that proves them.
• Offline local scanning — point it at a project directory and scan; the engine and its rule corpus are on-device.
• Multi-language — parses Python, JavaScript/TypeScript, Go, Java, C/C++, Bash, PHP and more via bundled grammars.
• War Room GUI + CLI — a desktop War Room for interactive review, and a scriptable CLI for CI and batch runs.

// How it runs

The product installs from npm — npm install -g @noctrodex/sast — which brings down the readable War Room interface plus a compiled engine binary for your platform. The engine is compiled, not source; the interface is readable so you can audit what talks to us. Run noctrodex-sast and a browser opens to approve the device: no licence file to download, no device code to copy. Everything executes on your perimeter, and scans leave from your own IP address. The optional Helix σ model is a separate on-device download tied to your account.

// Hardware and the GPU budget

The engine is built to run on ordinary 16 GB hardware, CPU-only, with no GPU at all. Where a GPU is present, the optional Helix σ model can offload part of its work to it — and it takes a deliberately small, fixed slice: 3 GB of video memory. The remaining layers stay on the CPU.

The budget is a hard ceiling rather than a guess. NOCTRODEX does not read your free VRAM and take what it finds; it asks for 3 GB and fits as many model layers as actually fit in that. This matters because customers run very different machines:

• Any driver. NVIDIA, AMD, Intel or a plain Vulkan driver all behave the same way, because the allocation is a number we set, not something inferred from a vendor tool.
• Shared and unified memory. On laptops and Apple-style unified memory, "free VRAM" is really system RAM. A fixed budget cannot over-commit it.
• Two GPUs. Machines with an integrated and a discrete card are common; you choose which one is used rather than getting whichever the driver enumerates first.
• No GPU, or an unusable one. If there is no GPU, no driver, or the runtime was built without GPU support, the model runs entirely on the CPU. Nothing fails and no scan is lost — it is simply slower.

Raise or lower the slice per machine with NOCTRODEX_SAST_GPU_BUDGET_MIB (in MiB), or pick the card with NOCTRODEX_SAST_GPU_INDEX. Set the budget to 0 to let the engine size itself from detected free VRAM instead.

// Licensing

Noctrodex SAST is a commercial release under account-based licensing: you create an account, buy a licence, and activate it by approving a short code in your browser. Your licence runs on as many machines as you own — approve each one in the browser — for as long as your account is active. Choose a monthly or yearly term.