A local-first trading-card-game scanner and collection manager.
Binderbase identifies cards from scans or manual lookups, tracks your collection with quantities and conditions, and fetches current market prices — all stored in a local SQLite database on your machine.
Collectors and players who want to catalog their cards without creating cloud accounts or paying for a subscription. If you want your data under your control, this is for you.
Your collection data, scans, and lookups stay on your machine. No cloud account, no hosted database, no ongoing subscription. Card catalogs and pricing refresh from public sources (Scryfall, Pokémon TCG API) and are cached locally.
- Magic: The Gathering
- Pokémon TCG
Stable release. Download the latest build from Releases.
git clone https://github.com/aecyx/Binderbase.git
cd Binderbase
npm install
npm run tauri devRequires Node.js 22+, Rust (via rustup), and the
Tauri prerequisites for your OS. See
CONTRIBUTING.md for the full development setup.
- OS: Windows 10+, macOS 12+, or a Linux desktop with WebKitGTK 4.1
- RAM: 4 GB minimum. The MTG catalog import temporarily holds ~200 MB of card data in memory; peak RSS may reach ~1 GB during import.
- Disk: ~2 GB free if you build the full scan index (thumbnail downloads for ~42 k cards across both games).
- Network: Catalog import and scan-index builds make many HTTP requests to Scryfall / Pokémon TCG API. A stable connection is recommended; there is no resume — if the connection drops, you'll need to restart the operation.
Binderbase is not currently code-signed. On first launch your OS may show a warning:
- Windows SmartScreen: Click More info → Run anyway.
- macOS Gatekeeper: Right-click the app → Open → confirm.
- Linux: No extra step needed for AppImage/deb packages.
You can verify the download using the SHA256SUMS.txt file attached to each
release.
Release artifacts are signed using keyless signing via GitHub OIDC +
Sigstore Fulcio — no private key management on our side. Every signature is
publicly auditable in the Rekor transparency
log. Each release asset has a corresponding .bundle file containing the
signature and certificate.
To verify a download (requires cosign v3+):
cosign verify-blob \
--bundle Binderbase_1.0.0-rc.1_x64.msi.bundle \
--certificate-identity-regexp 'https://github.com/aecyx/Binderbase/\.github/workflows/release\.yml@refs/tags/v.+' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
Binderbase_1.0.0-rc.1_x64.msiReplace the file names with the actual artifact you downloaded.
A worked example of the full verification is in docs/release/cosign-verification.md.
The card scanner currently works best with cleanly cropped card images (single card filling most of the frame). Full phone-photo support with automatic card detection, perspective correction, and deskew is planned for a future release.
- Magic: The Gathering card data from Scryfall. Binderbase is not produced by or endorsed by Scryfall.
- Pokémon TCG card data from the Pokémon TCG API. Binderbase is not produced by or endorsed by Pokémon TCG API.
Binderbase does not collect or transmit any user data. There is no telemetry, analytics, or crash reporting. The only network calls are to the Scryfall and Pokémon TCG API servers to fetch card data and prices. All collection data stays on your machine.
Mobile targets (iOS, Android) are planned but not part of the 1.0 scope. The Tauri 2 shell supports them when we are ready.
- Contributing — development setup and PR expectations
- Security — vulnerability reporting
- Code of Conduct — community standards
- Governance — project decision-making
- Architecture — codebase structure
- Operations — CI, release, and repo configuration
AGPL-3.0-or-later. If you modify and distribute Binderbase — or run a modified version that users interact with over a network — you must make the corresponding source available under the same terms.