CodeWarden AI

Local-first AI code review for VS Code. CodeWarden builds a deep map of your codebase, hunts for defects, and backs every finding with a verbatim source quote, a file hash and its assumptions — then drafts fixes you review and can undo. All inference runs on a local Ollama model: no cloud, no account, no telemetry.

Why CodeWarden AI?

It runs entirely on your machine and shows its work. Not a chat box that sounds confident — an investigation engine that hands you a case file.

What it does

Runs 100% local. Ollama discovery + streaming NDJSON chat; strict mode blocks cloud or unverifiable models by checking their metadata, not just the URL.

Maps every language, deeply. ts-morph for TS/JS; dedicated adapters for React, Angular, Java/Spring, C#/ASP.NET, Python/FastAPI/Django and SQL; generic Tree-sitter structure for Go, Rust, Ruby, PHP, C/C++, Kotlin, Scala, Swift, Lua and shell; and resolved symbols + call/reference edges pulled from your installed language servers (gopls, rust-analyzer, Pylance, JDT…). Every edge is labelled resolved, inferred or unresolved.

Scales. The map persists to SQLite one file at a time; saving a file re-parses only that file; a thin memory mode keeps just a manifest in RAM for very large repositories.

Findings are evidence, not vibes. Each is schema-validated, carries the exact quoted source (checked against the file), the conditions it fails under, its assumptions, and a confidence label with a reason. Duplicates are fingerprinted; false positives you dismiss stay dismissed until that code changes.

Security scan built in. Language-agnostic pattern rules for SQL / command / XSS / template injection, unsafe deserialization, path traversal, dynamic eval, weak crypto & RNG, insecure TLS / CORS / JWT — each with a CWE id — followed by a focused local-model review of the files that matched. Runs as a pipeline stage or on its own; results land in a dedicated Security panel grouped by CWE.

Export the map for other tools. "Full codebase scan → graph" writes a self-describing graph (codebase-graph.json + Graphviz .dot): nodes, edges, and every edge tagged resolved / inferred / unresolved. Other tools and AI agents can read it directly. Findings also export to SARIF 2.1.0 for GitHub code scanning and CI dashboards.

A risk score at a glance. One 0–100 number, security-weighted, with the top drivers spelled out — plus a "Review my changes" button that scopes a scan to your git diff for a fast pre-commit pass.

The investigation is auditable. snapshot → map → provider diagnostics → approved analyzers (ESLint / tsc / Ruff, run sandboxed with a timeout) → security → chunk review → cross-file relationship review → validate → report. Pause, resume or stop with resumable checkpoints.

Chat that cites its sources. Ask / Investigate / Suggest-fix / Implement modes; @file @symbol @changes references; a bounded tool loop where the model may request a project check behind a one-click approval. A priority queue keeps your chat ahead of any background scan.

Fixes are reviewable and reversible. Every change is a staged proposal — precondition-rechecked, applied as an unsaved WorkspaceEdit, with a conflict-aware inverse. An opt-in deterministic minor-fix policy (JSON whitespace, final newline) is allowlist-gated.

Also: BM25 + code-graph retrieval with optional local embeddings; .txt + .json case export with a coverage ledger; a fixture precision/recall harness and a per-model evaluation history; optional inline completion; a React + Vite sidebar (Casebook, Ask, Evidence Board, Code Map, Patch Review, Settings) that is fully theme-aware, keyboard-navigable and reduced-motion aware.

CodeWarden reports what it inspected and how confident it is. It does not promise to find every bug or that a change preserves all behaviour — those are shown as separate claims.

Get started

1. Install Ollama and pull a code model, e.g. ollama pull qwen2.5-coder:7b (any local code model works).
2. Install this extension. A shield icon appears in the Activity Bar — click it to open the Casebook.
3. Pick your model in the Connection card, then hit ▶ Full codebase scan → graph or Investigate workspace.

Needs VS Code 1.90+. No account, no configuration, nothing to sign up for.

Privacy & safety

• Your source never leaves your machine. Inference runs on your local Ollama; strict mode verifies the model's metadata is local before any code is sent — a localhost URL alone is not accepted as proof.
• No telemetry, no analytics, no external requests. No fonts or scripts are loaded from the network.
• Source comments and retrieved code are treated as evidence, never instructions to the model.
• File access is confined to the workspace root; path traversal and symlink escapes are rejected.
• Applied fixes stay unsaved by default and keep a conflict-aware inverse. Git is never used to roll back.

License

MIT. The full text is on the License tab of this listing.