What is the best air-gapped code analysis tool?

There is no single winner. SonarQube Server and CodeScene on-prem are the established self-managed choices, Semgrep CE works offline with local rules, and repowise covers codebase intelligence with no model call.

Can SonarQube run in an air-gapped environment?

Replies in the SonarSource community forum say the license does not need internet and the update check can be turned off. We could not find an explicit air-gap guide in the installation docs, so confirm with Sonar.

Does repowise work offline?

Yes for analysis: all layers make zero LLM calls and `repowise init --yes --no-prose` needs no key. COBOL and Apex grammars and the dashboard UI download on first use, so stage them once for a closed network. Fully offline prose uses Ollama for the model and embeddings.

Can I use a local LLM for code analysis?

With repowise, Ollama works as both the model and the embedder for prose generation. The analysis layers do not use a model.

What does repowise need to run in an air-gapped site?

After a one-time staging step, nothing. Fetch the COBOL and Apex grammars with `repowise grammars fetch`, point `REPOWISE_GRAMMAR_DIR` at them, cache the web UI, and run Ollama if you want prose. The enterprise license covers on-prem and air-gapped deployment.

Does Semgrep need the internet?

The CLI can scan with local rule files and no login. Registry rule packs need network access, so fetch them beforehand.

Best Air-Gapped Code Analysis Tools (2026)

On this page

How we evaluated
What "air-gapped" needs from a tool
SonarQube Server: the incumbent for quality gates
CodeScene: behavioral analysis on-prem
Semgrep Community Edition: offline if you bring the rules
Sourcegraph and Greptile: search and review, self-hosted
repowise: analysis with no network after install
How to choose
FAQ

For air-gapped code analysis, SonarQube Server and CodeScene on-prem are the established self-managed products, Semgrep Community Edition is the lightest offline scanner, and repowise covers codebase intelligence with no model call and no network after install. Whichever you pick, list what it must download before the network is cut.

Tool	Analysis type	Self-hosted	Air-gap evidence	What to stage first
SonarQube Server	Static analysis, quality gates	Yes	Community forum reply: license does not rely on internet	Updates arrive with new server versions
CodeScene	Behavioral code analysis from git history	On-prem (Docker)	Product page: offline mode on-prem	Confirm license handling with CodeScene
Semgrep CE	Pattern-based security and bug rules	CLI, runs anywhere	Local rule files send no metrics	Your own rules, fetched in advance
Sourcegraph	Code search and navigation	Helm, Docker Compose	Docs page does not mention air-gap	Ask your account team
Greptile	PR review with a repository graph	Docker Compose, Helm	Docs list air-gapped environments	Custom LLM endpoint
repowise	Graph, health, dead code, change risk, ownership, security patterns	Yes, local or server	All analysis layers make zero LLM calls	Grammars via `repowise grammars fetch`, web UI cached on first run

Scroll the table sideways to see every column.

Vendor facts are from each vendor's own pages, read in November 2026; sources are linked below. Where a page says nothing about air-gapped use, we say so instead of guessing.

We build repowise, so weigh our entry accordingly. The measurements we publish about it, with their methods, are on the benchmarks page.

How we evaluated

An air-gapped team asks different questions from a team that only wants to self-host:

What runs with no outbound network. The analysis itself, plus anything fetched at first use.
Whether a model is involved. Analysis that needs a hosted LLM cannot run offline; a local model can.
What leaves the machine. Telemetry, license pings, update checks.
What it analyzes. Security rules, structure, history or documentation.

What "air-gapped" needs from a tool

An air-gapped tool must run its analysis, license check and updates without reaching the internet. Four things commonly break that: rule or grammar downloads at first run, license servers, update checks, and analysis steps that call a hosted model. Ask each vendor for a written answer on all four. If you only need your code kept on your own servers, and not cut off from the network, you need the easier requirement; best self-hosted codebase documentation tools covers that one for documentation.

SonarQube Server: the incumbent for quality gates

SonarQube Server is the self-managed standard for static analysis with quality gates. It comes in Developer, Enterprise and Data Center editions, and the AI features are optional and limited to Enterprise and Data Center (Sonar docs, November 2026).

On air-gap, the installation pages we could read say nothing explicit. Replies in the SonarSource community forum say its license mechanism does not rely on internet connectivity, that the marketplace and update check can be disabled, and that rule updates ship with each server version (SonarSource Community). Treat that as a lead to confirm with Sonar, not a contract.

Pick SonarQube if you need quality gates across many projects and your auditors already know the product.

CodeScene: behavioral analysis on-prem

CodeScene analyzes how code changes over time and offers an on-prem edition. Its deployment page describes on-prem as a self-managed Docker deployment and lists offline mode for very strict security requirements, supported on-prem and not on cloud (CodeScene, November 2026). Its help center describes the official codescene/codescene image, with data under /codescene. Self-hosted GitLab is supported on-prem only, per its support hub. Pricing is in CodeScene pricing, and open source alternatives are in best open source CodeScene alternatives.

Pick CodeScene if you want hotspot and team-coupling analysis with a vendor behind it.

Semgrep Community Edition: offline if you bring the rules

Semgrep CE scans locally with your own rule files, with no login and no metrics for local configs. Per Semgrep's docs, local configs such as --config rules.yaml do not enable metrics, and the --metrics=off flag covers Registry rules (Semgrep docs, November 2026). Registry packs such as p/javascript need the network, so an air-gapped site fetches and vets rules beforehand.

bash

semgrep scan --config ./vetted-rules --metrics=off

Pick Semgrep if the job is custom security or bug-pattern rules and your team will maintain the ruleset.

Sourcegraph and Greptile: search and review, self-hosted

Sourcegraph self-hosts through Helm, preferred, or Docker Compose for single-node installs. Its deployment page states no air-gap guidance and says ARM images are not supported for production (Sourcegraph docs, November 2026). Its MCP server for agents requires an Enterprise plan. See Sourcegraph alternatives.

Greptile's introduction page lists cloud or self-hosted deployment, including air-gapped environments, with Docker Compose, Kubernetes and custom LLMs (Greptile docs, November 2026). It reviews pull requests, so it solves a different problem from repository analysis.

Tabby, which calls itself an open-source, self-hosted AI coding assistant (Tabby docs), belongs on the list for completions, not analysis.

repowise: analysis with no network after install

repowise's analysis layers make zero LLM calls, so they run with no key and no network. repowise init --yes --no-prose indexes a repo into a dependency graph, ownership and bug history from git, code health with 59 deterministic detectors, dead code, change risk, security patterns, doc drift and a documentation wiki rendered from code structure. The PR bot's deterministic review also makes no LLM calls, and the bot runs on GitHub, while indexing and CI gates work on GitLab, Azure DevOps and Bitbucket.

bash

uv tool install repowise      # or pipx install repowise, pip install repowise
cd your-repo
repowise init --yes --no-prose

Staging for a closed network:

Grammars. COBOL and Apex parsers download on first use. Stage them with repowise grammars fetch and point REPOWISE_GRAMMAR_DIR at the folder.
Dashboard. repowise serve needs Node 20 or newer and downloads the web UI on first run.
Telemetry. Anonymous and opt-out, so a closed network stays closed: repowise telemetry disable or DO_NOT_TRACK=1.
Prose. LLM-written documentation is optional. For it to run fully offline, use Ollama for both the model and embeddings. Other providers are Anthropic, OpenAI, Gemini, OpenRouter, DeepSeek, Kimi, Eden AI and LiteLLM.
Decisions. Six of the seven decision sources need no provider.

The commercial license covers enterprise needs such as SSO, RBAC and audit, on-prem and air-gapped deployment, custom language extensions and an SLA. The CLI is AGPL-3.0 with a commercial license, free for internal use, and the setup is covered in self-hosting with Docker.

Pick repowise if you want codebase intelligence for engineers and agents with no data leaving the building.

How to choose

Quality gates and compliance reports: SonarQube Server, confirmed in writing for your air-gap.
Custom security rules you maintain: Semgrep CE with a local ruleset.
Hotspots and team coupling from git history: CodeScene on-prem, or repowise for the open source route.
Codebase map, dead code, change risk and agent context with no model: repowise, with grammars and the UI staged.
Mainframe or legacy code: repowise parses COBOL, including JCL, BMS and CICS edges; stage the grammar first.
Regulated enterprise: use two layers, a rules engine for policy and an intelligence layer for understanding, and run the vendor's air-gap questionnaire on each.

FAQ

What is the best air-gapped code analysis tool?: There is no single winner. SonarQube Server and CodeScene on-prem are the established self-managed choices, Semgrep CE works offline with local rules, and repowise covers codebase intelligence with no model call.
Can SonarQube run in an air-gapped environment?: Replies in the SonarSource community forum say the license does not need internet and the update check can be turned off. We could not find an explicit air-gap guide in the installation docs, so confirm with Sonar.
Does repowise work offline?: Yes for analysis: all layers make zero LLM calls and repowise init --yes --no-prose needs no key. COBOL and Apex grammars and the dashboard UI download on first use, so stage them once for a closed network. Fully offline prose uses Ollama for the model and embeddings.
Can I use a local LLM for code analysis?: With repowise, Ollama works as both the model and the embedder for prose generation. The analysis layers do not use a model.
What does repowise need to run in an air-gapped site?: After a one-time staging step, nothing. Fetch the COBOL and Apex grammars with repowise grammars fetch, point REPOWISE_GRAMMAR_DIR at them, cache the web UI, and run Ollama if you want prose. The enterprise license covers on-prem and air-gapped deployment.
Does Semgrep need the internet?: The CLI can scan with local rule files and no login. Registry rule packs need network access, so fetch them beforehand.