Running AI code security review with local or self-hosted models

Key takeaways

• In Dokima, the AI runner and model you configure determine where source code is processed; Northloom never receives your raw repository source.
• Through OpenCode, Dokima can run against privately hosted local models on an internal OpenAI-compatible endpoint as well as commercial providers.
• Combining local inference with local-only HTML report output keeps source code, prompts and vulnerability findings entirely inside your network.
• Strong open-weights coding and reasoning models work best when paired with Dokima's bounded stages rather than open-ended repository prompts.

Can you run AI security review without sending code to an external cloud?

For many engineering organisations, defence contractors, regulated financial teams and infrastructure vendors, sending proprietary source code to an external model provider requires legal review or is ruled out by customer contracts.

When evaluating AI security tools, the first question to ask is architectural: is the vendor a hosted scanning platform that ingests your repository, or is it a local orchestrator that runs on your machine?

Dokima is built as a local orchestrator. You install the binary on your own Linux or macOS machine, point it at a local workspace containing your Git repositories, and choose which AI runner executes the analysis. Northloom’s servers handle licence activation and, only if you explicitly enable it, encrypted team report publishing. Your source code is never uploaded to Northloom.

That leaves one external boundary under your control: the AI model itself.

How does Dokima work with OpenCode and self-hosted endpoints?

Alongside direct support for Claude and Codex, Dokima includes a first-class runner integration for OpenCode. During each review stage, Dokima invokes opencode run with read-only tool permissions and structured JSON output requirements.

Because OpenCode supports custom OpenAI-compatible endpoints (such as vLLM, llama.cpp, SGLang or internal inference gateways), you can point OpenCode at:

• A dedicated GPU workstation or on-premises inference server on your private LAN.
• A private VPC model deployment inside your own cloud account with zero data retention.
• Local open-weights coding and reasoning models hosted on high-memory Apple silicon or Linux hardware.

If you also have codex or claude installed on the same workstation, you can explicitly enable OpenCode and disable the cloud runners in Dokima’s Settings screen (or in .dokima/config.json) so every stage uses your local endpoint.

Why bounded stages matter even more for local and open-weights models

A frequent pitfall when running local models on code audits is handing them an open-ended agent loop over a large repository. Local models often have smaller effective context windows or less margin for meandering tool calls than frontier cloud deployments, and can lose track of instructions mid-way through a long exploration.

Dokima’s staged scheduler helps local models perform reliably by decomposing the review into bounded, verifiable tasks:

1. Component-scoped prompts: After decomposing the repository into logical components, Dokima scopes hunting and verification passes to one component and one security lens at a time.
2. Strict schema validation: Every stage must return a valid, schema-checked JSON result before the scheduler records progress and advances. If a model run fails validation, Dokima records the rejected run rather than polluting the workspace state.
3. Separate verification passes: Because the Candidate Finding Peer Reviewer and Finding Validator run as independent turns with narrow questions, a local model can focus all of its reasoning budget on checking one concrete claim and its cited files.

Keeping vulnerability reports on your internal network

If your security policy forbids sending code to third-party model APIs, you may also prefer to keep vulnerability reports off external hosts.

When you first run Dokima, it asks how your team wants to read reports. Selecting Local HTML reports only disables hosted publishing completely:

• Dokima writes a self-contained static HTML report to dokima-report/ inside your workspace.
• You can inspect findings in the terminal dashboard, open dokima-report/index.html in a local browser, or serve the folder over an internal intranet web server gated by your corporate VPN or SSO.
• If you copy or symlink the whole dokima-report/ folder to an internal web server, team members also get live stage progress via live-status.json while the worker is active.

See our guide to sharing status and results for details on local vs private hosted sharing.

Checklist for a fully local review environment

To run an end-to-end air-gapped or private-network code review (requiring only initial licence activation):

1. Serve your chosen coding/reasoning model on an internal OpenAI-compatible server with sufficient context length (32k to 128k tokens recommended) and configure it as the default model in OpenCode.
2. Verify opencode --version and test a simple opencode run command from your review machine.
3. Install and activate Dokima following the Getting Started guide, then select Local HTML reports only when prompted.
4. In the Dokima dashboard, open Settings, enable the OpenCode runner, and disable any cloud runners.
5. Run a single step or a full sweep and inspect the generated report in dokima-report/index.html.

Ready to test Dokima against your internal model infrastructure? Start a 21-day free trial with no payment card required.