Use AI coding help and keep your source code on your machine

You can use AI coding help without moving your repository off your laptop. Run the agent locally rather than in a hosted VM, decide which model receives your prompts, turn off the side channels you do not need, and scan with a local runner. The Safeguard CLI runner scans on your machine and uploads only SBOMs and findings, never source.

You also do not have to drop the tools you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. Or connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already have open.

"Keep code local" means different things in different tools, so we start with what can leave a machine, then go tool by tool using each vendor's own docs.

Three ways code can leave your machine

When people say they want source code to stay local, they usually mean one of three different things. It helps to separate them, because each tool handles them differently.

1. Where the work runs. A local agent reads and edits files on your disk and runs commands in your shell. A cloud agent clones your repository into a virtual machine or container somewhere else and works there. If you never want a copy of the repository on someone else's infrastructure, this is the first question to ask.

2. What the model sees. Every assistant backed by a hosted model has to send that model the text it reasons about: your prompt, the files or snippets it reads, command output it looked at, and its own replies. A local agent with a hosted model still sends that context over the network. The only way to keep it entirely on your machine is to run the model locally too.

3. Side channels. Telemetry, error reports, feedback commands, transcript sharing and local caches are separate from the main conversation. Some carry code, some do not, and most can be switched off.

So running an agent in your own terminal keeps the repository on your disk and commands where you can see them. It does not, by itself, stop context reaching a model. That depends on which model you choose and under whose terms.

What popular tools send where

The facts below come from each product's own documentation, fetched on 21 October 2026. Terms change, so check the linked pages before relying on them.

Claude Code

Claude Code runs locally. Its data usage page says that to interact with the model it sends "all user prompts and model outputs" over the network, encrypted with TLS 1.2 or later. Cloud sessions are different: they run in Anthropic-managed virtual machines, your repository is cloned into an isolated VM, and GitHub credentials stay on Anthropic's servers rather than entering the VM.

On training, the docs separate consumer accounts (Free, Pro and Max), where you choose whether your data can improve future models, from commercial accounts (Team, Enterprise, API and third-party platforms), where Anthropic does not train on code or prompts sent to Claude Code unless the customer opts in. Retention is 30 days by default for commercial users, and zero data retention is available to qualified Claude for Enterprise accounts. Locally, session transcripts are stored in plain text under ~/.claude/projects/ for 30 days by default, adjustable with cleanupPeriodDays.

On side channels, metrics "never include your code, prompts, or file paths" and can be turned off with DISABLE_TELEMETRY=1. The /feedback command does send conversation history including code; DISABLE_FEEDBACK_COMMAND=1 turns it off, and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC disables non-essential traffic at once.

Codex CLI

The Codex README describes it as "a coding agent from OpenAI that runs locally on your computer", licensed Apache-2.0. You sign in with a ChatGPT account on the Plus, Pro, Business, Edu or Enterprise plans, or use an API key.

Local commands run inside an OS sandbox: Seatbelt on macOS, bubblewrap on Linux and WSL2, and the Windows sandbox on native Windows. The sandbox modes are read-only, workspace-write and danger-full-access, and the approvals page says the agent runs with network access turned off by default. Codex cloud is the other side: it "runs in isolated OpenAI-managed containers", checks out your repository at a branch or commit, and keeps agent internet access off by default, with secrets available only during setup.

GitHub Copilot

For inline suggestions, GitHub's documentation says the code around your cursor is pre-processed and sent with other context such as snippets from open tabs. Content exclusion lets an admin mark paths Copilot should ignore at repository, organisation or enterprise level. One thing to know before relying on it: the docs state that Copilot CLI and agent mode in Copilot Chat in IDEs do not support content exclusion. The Copilot cloud agent works in "an ephemeral cloud development environment" on repositories hosted on GitHub and opens one pull request per task.

Cursor

Cursor's data use page is direct about routing: "Even if you use your API key, your requests will still go through our backend", which is where it builds the final prompt. With Privacy Mode on, Cursor says customer data will not be used for training and that it has zero data retention agreements with its model providers. File contents are cached temporarily for a request and, per the page, never permanently stored.

OpenCode

OpenCode is an open source coding agent under the MIT licence, run from the terminal, with a desktop app in beta. Its providers docs list support for 75+ LLM providers and local models through Ollama, LM Studio and llama.cpp, which makes it one way to keep both the agent and the model on your machine. The same docs note that Anthropic prohibits using Claude Pro or Max plans through plugins in tools like this, and that OpenCode stopped bundling those plugins in version 1.3.0. We compare options in open source OpenCode alternatives.

Ollama

Ollama runs open models on macOS, Windows and Linux under the MIT licence and exposes a REST API on localhost:11434. Paired with a client that can talk to it, prompts and model replies stay on your hardware. Its README also mentions cloud access, so check that the model you are running is a local one if that is your requirement.

The Safeguard local runner

The Safeguard runner is not a separate product. It is built into the Safeguard CLI: open the interactive terminal, sign in, and the machine starts polling the platform for work assigned to it. The runner docs describe three situations it was built for:

• Your repository is private and you cannot, or will not, give a cloud service OAuth access.
• You work on a restricted network where only outbound HTTPS is allowed.
• You want the assistant to fix vulnerabilities in code you have not pushed yet.

How the runner handles your code

The runner sends a heartbeat and polls for jobs assigned to that machine. All traffic is outbound HTTPS that the runner opens; nothing connects to it. It runs each claimed job with its own local scan server, then uploads the result files, the SBOM and findings, and reports the job status. Source code stays on the machine.

The platform never needs a copy of your code to know what is in it. It needs the bill of materials and the findings, and those are what it receives.

Running it without the terminal UI

On a build box or a shared workstation you may want the runner without an interactive session. The runner docs give these commands:

# Start without the terminal UI and serve assistant turns for this workspace
safeguard runner start --workspace ./path/to/repo

# Is it running, and what is it doing
safeguard runner status

# Drain in-flight work and stop
safeguard runner stop

runner start long-polls by default. On a network that forbids held connections, --poll-wait 0 switches to polling at a fixed interval set by SAFEGUARD_POLL_INTERVAL (10 seconds by default). --permission-mode sets how much the assistant may do without asking, from supervised to autonomous.

Choosing which model sees your questions

The runner keeps source local for scans. For conversations, the deciding factor is the model. This walkthrough shows how model choice works in Safeguard: you choose the model for each conversation, Zero z20 answers with no language model at all by turning the question into a platform query, Griffin, Eagle and Lion are Safeguard's own models, a tenant admin chooses which model families people may use, and you can bring your own model on your own provider account and route jobs such as chat or summaries to it.

Click through it at your own pace, or open it full screen.

Do the work properly with the Safeguard CLI

The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. Your source code never leaves the machine when the local runner runs platform scan jobs; only SBOMs and findings are uploaded.

Install

On macOS and Linux:

curl -fsSL https://cli.safeguard.sh/install | bash

On Windows, in PowerShell:

irm https://cli.safeguard.sh/install.ps1 | iex

It is a single static binary, with no Node, Python or JVM needed. It runs on macOS, Linux and Windows, on x86_64 or arm64; Windows is x86_64 only.

First session

cd ~/projects/payments-api
safeguard

Running safeguard with no arguments opens the interactive terminal. /login signs you in through the browser, and /scan . scans the current folder. Then ask in plain language: "how many critical vulns do we have", or "fix the lodash CVE in this repo".

Writing and fixing code on your machine

The Safeguard CLI writes code, not only scans it. The assistant has tools for your local files and for your Safeguard data, and it picks whichever the question needs. With your approval it can find and read files, edit code and run commands. A docs example shows the range: "what's the latest file in ~/Downloads" is a plain question about your machine, answered there.

Type @ to attach a file from the folder you started in. The file you pick is attached to your message so the assistant can read it, so attach what the question needs and nothing more. /resume picks up the last session in that folder.

This walkthrough shows the loop on a real machine: attach a computer running the Safeguard CLI and a folder, ask for a fix, review the diff and approve the command before it runs. The demo itself notes that computer work from Search is available and expanding.

Click through it at your own pace, or open it full screen.

Use your Claude, ChatGPT or Codex plan

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. That last clause matters for this topic: the provider's data terms for your plan still govern what the provider keeps. /model shows or switches the model; for connecting one, see the CLI docs.

Approvals

Tools that change things ask before they act. /permissions sets the mode: Ask prompts before every action, Auto approves known actions and asks about anything new (the default), and Yolo approves everything. On sensitive repositories, use Ask.

CI with safeguard exec

safeguard exec "summarise the critical findings in this repository"

safeguard exec runs one non-interactive assistant turn. It defaults to strict permissions, so nothing is asked and anything the policy file has not pre-approved is denied. Policies and gates themselves are evaluated in the platform, not by the CLI.

One platform, every surface

The download page lists the rest: a desktop app (3.2.2) for Windows, macOS and Linux where you ask your supply chain anything in plain English, iOS and Android apps, IDE extensions for VS Code, JetBrains and Open VSX editors, and a browser extension. Start in the terminal, continue on the desktop, check findings on your phone. To try it with nothing installed, the cloud sandbox gives you a seeded demo tenant free for seven days with no card. More on the assistant is in Safeguard CLI as an AI assistant on your machine.

A setup walkthrough for three levels of "local"

Pick the level your policy requires. Each step comes from the tools' own docs.

Level 1: the repository never leaves, scans stay local

This is the requirement the Safeguard runner was built for.

1. Install the Safeguard CLI and run safeguard, then /login.
2. Run /scan . in the project. Only the SBOM and findings are uploaded.
3. For headless machines, start the runner with safeguard runner start --workspace . so platform scan jobs run there.
4. Do not connect the repository through a cloud OAuth integration if your policy forbids it. The runner covers scanning without it.

Level 2: local agent, hosted model, side channels off

Here the agent runs on your machine, but prompts and the context it reads go to a hosted model.

1. Run the agent locally rather than in a cloud session. For Claude Code that means the terminal or IDE rather than a web session; for Codex, the CLI rather than a cloud task.
2. Check the training and retention terms for your account type. Claude Code's docs, for example, treat consumer and commercial accounts differently.
3. Turn off side channels you do not need. In Claude Code, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC disables non-essential traffic in one setting.
4. Limit context. Attach only the files the question needs. In Copilot, set content exclusion for sensitive paths, knowing the docs say it does not apply to Copilot CLI or agent mode.
5. Keep commands sandboxed: Codex's workspace-write mode, or Claude Code's /sandbox.

Level 3: nothing leaves, including prompts

1. Install Ollama and pull an open model.
2. Point an agent that supports local models at it. OpenCode's providers docs show configuration for Ollama on localhost:11434, LM Studio and llama.cpp.
3. Disable any telemetry the client sends.
4. Keep using the Safeguard runner for scans, which uploads only SBOMs and findings. If even that is too much, safeguard scan --dir . writes its results locally under ./output, and safeguard update --import loads a vulnerability database downloaded on another machine.

Before any agent's changes reach your main branch, scan them. We walk through that in checking coding agent changes with the Safeguard CLI.

Common mistakes

Assuming "runs locally" means "nothing is sent". A local agent with a hosted model still sends prompts and context.

Starting a cloud session by accident. Several tools offer local and cloud modes side by side. A cloud session clones the repository elsewhere. Check where a session runs before you start it on a sensitive codebase.

Forgetting local caches. Claude Code keeps plain text transcripts under ~/.claude/projects/ for 30 days by default. That is on your machine, but it is still a copy. Adjust the period if your policy requires it, and know what other tools cache.

Sending feedback with code in it. Feedback and bug report commands can include your conversation. In Claude Code, /feedback sends conversation history including code. Disable the command on sensitive machines.

Relying on exclusion lists everywhere. Copilot content exclusion does not apply to Copilot CLI or agent mode in IDEs, per GitHub's docs.

Granting OAuth repository access when a runner would do. If the requirement is scanning, a local runner that uploads only results avoids giving a cloud service a copy of the repository.

FAQ

Does my source code leave my machine with the Safeguard CLI?

When the local runner runs platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded. All runner traffic is outbound HTTPS that the runner opens, and nothing connects to it. When you chat with the assistant, the file you attach with @ is attached to your message so the assistant can read it, so choose the model you are comfortable sending it to.

Can I keep my Claude, ChatGPT or Codex plan?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use. See the CLI docs or /model for connecting a model.

Is a local agent enough to keep code private?

It keeps the repository on your disk and commands in your shell. It does not stop prompts and context from going to a hosted model. For that you need a local model, such as one served by Ollama, with an agent that supports it.

Does Claude Code train on my code?

It depends on the account. Per Anthropic's data usage page, consumer accounts (Free, Pro and Max) can choose whether data is used to improve models, and commercial accounts (Team, Enterprise and API) are not trained on unless the customer opts in.

Where does Codex run my code?

The Codex CLI runs locally in an OS sandbox with network access off by default. Codex cloud runs in isolated OpenAI-managed containers that check out your repository.

What is the safest approval mode?

In the Safeguard CLI, Ask, which prompts before every action. Auto is the default and suits daily work in code you own. Yolo approves everything and belongs only in disposable environments.

Can I scan without giving Safeguard access to my repository?

Yes. That is the first use case the runner docs list: a private repository where you cannot or will not grant a cloud service OAuth access. The runner scans locally and uploads results.

Try it yourself

This walkthrough sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Download the Safeguard CLI, run safeguard, type /login, and scan with /scan .. The full reference is in the CLI docs.

Quick check

Sources

• Safeguard CLI overview
• Safeguard Local Runner
• Safeguard CLI interactive terminal
• Safeguard CLI slash commands
• Safeguard CLI usage guide
• Safeguard downloads
• Claude Code data usage
• Claude Code security
• Codex repository and README
• Codex sandboxing
• Codex agent approvals and security
• Codex cloud environments
• GitHub Copilot code completion, responsible use
• GitHub Copilot content exclusion
• About GitHub Copilot cloud agent
• Cursor data use
• OpenCode providers
• OpenCode repository
• Ollama repository

Last reviewed: 21 October 2026.