Fast secret blocking
Catches hardcoded secrets with 26 regex patterns across 13 providers, compiled at startup and matched against the staged diff in under 1 ms.
LocalForge
LocalForge is a local pre-commit code review tool for Apple Silicon Macs. Scans staged changes on-device with regex checks, CoreML scoring, and a local Qwen model—no cloud.
On-device AI code review for commits
LocalForge is a local code review gate for Apple Silicon Macs. It runs as a pre-commit hook, scans the staged diff, and checks each commit through three layers: Rust regex secret detection, a CoreML classifier on the Apple Neural Engine, and a local Qwen2.5-Coder review.
The product is designed to keep review data on the machine. The site describes it as running entirely offline with no cloud and no API keys, while also providing a macOS app, CLI commands, and an MCP server for working across individual repos or team setups.
Core capabilities
On-device risk scoring
Uses a CoreML classifier on Apple Neural Engine hardware to assign a risk score to code changes and hard-block likely issues before commit.
Local semantic review
Runs Qwen2.5-Coder locally via MLX for semantic review of SQL injection, XSS, command injection, dead code, unhandled errors, and logic bugs.
macOS app for live monitoring
Includes a SwiftUI app with live scan events, monitor and repos views, and one-click repo protection or upgrades.
Command-line and MCP workflows
Supports one-command repo setup, a team install script generator, compliance exports, and a JSON-RPC 2.0 MCP server for editor integrations.
Practical ways to use LocalForge
Protect day-to-day commits
Use LocalForge as a local guardrail before commits when you want secrets and risky patterns checked automatically in the same command you already use to commit.
Standardize team onboarding
Run it in a team setup when you need a shared install script that developers can execute once on their own machines without central infrastructure.
Review commits from the desktop and editor
Use the monitor app and MCP server when you want scan results visible inside a Mac app or queryable from editor tools such as Cursor or VS Code.
Collect review evidence for audits
Generate compliance exports from advisory logs when you need a single bundle of review output for internal security review or audit trails.
Audit a repo outside the commit path
Scan existing repositories without committing when you want to check code with `localforge --scan` before a change lands.
Pros and Cons
Pros
- Runs locally with no cloud dependency and no API keys required.
- Blocks secrets and other high-risk patterns before commits land in git history.
- Combines deterministic rules, CoreML scoring, and semantic review instead of relying on a single checker.
- Offers both CLI and macOS app workflows, plus MCP access for editor tools.
- Supports team setup and compliance exports for shared use cases.
Cons
- The setup and core review flow are limited to macOS 14+ on Apple Silicon machines.
- Layer 3 depends on a local Qwen model; if one is not available, that layer is skipped.
- The semantic review layer is advisory only, so it does not block commits.
FAQ
How does LocalForge fit into the commit workflow?
LocalForge runs as a pre-commit hook. When you run `git commit`, it scans the staged diff locally and holds the commit until Layers 1 and 2 finish or raise a blocking issue. Layer 3 produces an advisory report after the clean pass.
What platform does LocalForge require?
The docs say LocalForge supports macOS 14 or later on Apple Silicon machines such as M1, M2, M3, and M4.
Can teams deploy LocalForge to everyone on the team?
Yes. The documentation says `localforge --install-org` generates a shareable setup script that each teammate runs once on their own machine, which makes it suitable for team-wide setup without per-user manual configuration.
Does LocalForge produce reports for review or auditing?
LocalForge can export advisory reports from `~/.localforge/advisory_log/` into a single compliance bundle with `localforge --export-report`. The docs describe the output as suitable for security review and audit trails.
What are the main limitations of the review pipeline?
The third layer is advisory-only and never blocks commits. If no Qwen model is found during installation, Layer 3 is skipped and commits still go through Layers 1 and 2.
Quick Facts
- Category
- Developer Tool
- Platform
- macOS 14+ on Apple Silicon
- License
- MIT License
- Workflow
- Runs as a pre-commit hook on staged diffs
- Integrations
- JSON-RPC 2.0 MCP server for Cursor, VS Code, and other MCP clients
- Source domain
- local-forge-web.vercel.app
LocalForge Alternatives
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repos and verifies changes with compilers, debuggers, sanitizers, and tests.
Ghost
Ghost is a terminal-based AI assistant for chatting, code generation, and CLI tasks. Includes free models, supports Linux, macOS, Windows, and is open source.
CreateOS Sandbox
CreateOS Sandbox is an isolated compute environment for running code and agent workloads in Firecracker micro-VMs with private networking and SDK, CLI, or MCP control.
hob
hob is an independent workspace for coding agents, with local control over sessions, terminals, history, routing, and follow-up work.
Manta AI
Manta AI is an autonomous web app testing tool that maps app behavior, catches regressions, and generates tests from a URL, no scripts or selectors needed.
SonOf
SonOf connects to your repo and PM tool, audits your codebase, and turns approved work into shipped tickets with senior engineering review.