v0.1.0 — Offline (--network none), Telemetry & Secret Auditor for AI Repositories

airgap-check v0.1.0

Initial release of airgap-check — a zero-dependency Go CLI to audit Python & TypeScript AI repositories for offline (--network none) runtime crashes, hidden SDK telemetry, and .env credential routing.

Highlights

• Static + AST Audit: Inspects requirements.txt, pyproject.toml, package.json (dependencies separated from devDependencies), Cargo.toml, source-level runtime download calls (nltk.download(), from_pretrained(), tiktoken.get_encoding(), whisper.load_model(), next/font/google), and .env credential usage classifications (secret values are never read or logged).
• Dynamic --network none Verification (--run): Runs your repository inside docker run --rm --network none with an in-container UDP:53 DNS sinkhole (127.0.0.1:53) + Python/Node socket hooks, capturing outbound DNS lookups from any language or native C/C++/Rust extension (onnxruntime, tokenizers, libcurl, getent).
• Standalone Dockerfile Remediation (--fix): Generates a ready-to-paste Dockerfile snippet (ENV flags + build-time RUN pre-warming commands for tiktoken, chromadb ONNX all-MiniLM-L6-v2, fastembed, huggingface_hub, nltk, spacy, whisper, playwright) that works in any standard Docker or Kubernetes pipeline.

Prebuilt Binaries

Download the archive for your platform below and verify against SHA256SUMS.txt, or install via Go:

go install github.com/humanethq/airgap-check/cmd/airgap-check@v0.1.0