Dvalincode

English · 中文

The approvable coding agent for regulated teams. Built for finance, healthcare, and security-sensitive engineering where AI coding must be controllable, transparent, and auditable.

🔑 Any model · local-first · policy-bound · audit-ready — the agent your security team can actually approve.

Bring your own model — DeepSeek, OpenAI, Claude (via OpenRouter), Groq, Ollama, or any OpenAI-compatible endpoint. Switch with one click, no code changes, no lock-in.

---

⏱️ 60 seconds to proof

Don't take the claims on trust — verify them on your own machine:

curl -fsSL https://raw.githubusercontent.com/arthurpanhku/dvalincode/main/scripts/install.sh | bash
dvalincode trust

trust prints this install's live security posture: the resolved org policy and its hash, per-boundary network enforcement (provider · shell · MCP), and the tamper-evident audit status — the exact evidence a security reviewer needs, straight from the tool itself.

Then let the agent work, and prove what it did after the fact:

dvalincode report verify    # re-derive the hash chain of the last run's audit log

---

🗨️ Chat modeRead-only Q&A with one-click prompt templates — explain a codebase, find TODOs, review changes, write tests. The agent can read files and search, but never writes. 👥 Cowork modePlan-then-execute. The agent drafts a numbered plan, you click Proceed, and every file write asks for explicit approval — with an inline red/green diff before you say yes. ⚡ Code modeAutonomous agent with full tool access. Run tests, type-check, build, lint — one click via the Routines panel. macOS shell calls run inside a sandbox-exec profile with network denied. 🏦 Regulated teamsDesigned for finance, healthcare, security-sensitive SaaS, and internal platform teams that need AI coding under policy, audit, data minimization, and supply-chain review — not just developer convenience. 🛡️ Secure remediationRun a local security scan or import SARIF from CodeQL, GitHub Code Scanning, Semgrep, or compatible scanners, then create an isolated remediation worktree and turn findings into focused repair tasks with source context and PR-ready reporting. Workflow → 📚 SkillsUpload, download, and inspect local skill bundles. DvalinCode ships built-in secure-code-scan and secure-code-remediation skills, plus agent tools for listing skills, reading skill instructions, scanning, listing cases, and preparing remediation worktrees. Format → 🛡️ Audit trailEvery run emits a tamper-evident, hash-chained JSONL log — every file read/written, every command, every approval. A Run Report renders it as Markdown; dvalincode report verify proves the chain is intact. Threat model → 🔒 Org policy & trustA company — not the developer — bounds the agent. A dvalin.policy.json constrains modes, shell commands, file paths, tools, and models; a repo policy can only ever narrow the machine-level one, never widen it. Each run records the governing policy's hash. dvalincode trust prints the install's live security posture — active policy + hashes, audit status, runtime — so a reviewer can verify it directly. Policy reference → · Approvability plan → 🏛️ Governance evidenceOpenSSF Scorecard, CodeQL, Dependabot, pinned GitHub Actions, CODEOWNERS, and ISO/IEC 42001 AIMS alignment docs are maintained as reviewable project evidence. Scorecard map → · ISO 42001 alignment → 🖥️ First-class GUIModern web UI with code highlighting, file @-references, / slash commands, Git branch indicator, live token + cost counter, multi-profile LLM config, and a dark / light / system theme switcher. 🖥️ Terminal or web — one binaryRun it bare for an interactive terminal agent with streaming output, inline approvals, and red/green diffs, or dvalincode serve to host the web GUI for browser/remote use. Both frontends drive the same agent core. 🪶 Zero-dependency binarySingle ~25MB executable per platform. No Node, no Python, no Docker. 🔐 Local-firstSessions, config, profiles, and audit logs live in ~/.dvalincode/. .dvalincodeignore blocks the agent from reading sensitive files. AGENTS.md in your repo becomes persistent project instructions. 💾 Portable & exportableExport all local data (memory, sessions, config, audit) to one file and import it on another machine — your setup moves with you. Any conversation downloads as a clean Markdown transcript.

---

🎯 Core Goal

> Make AI coding approvable for regulated and security-sensitive teams.

DvalinCode is built as an approvable agent runtime, not just another coding agent app. The core product is not only "AI writes code"; it is the evidence a security, compliance, or platform team needs to safely allow AI coding in financial services, healthcare, internal enterprise platforms, and other confidential codebases.

• Any model — every OpenAI-compatible endpoint is a first-class citizen, local models included. Your workflow should never be hostage to one vendor's pricing, rate limits, or quality swings.
• Safe by default — three-tier approvals with diff preview, an undo stack, and sandboxed shell execution. An agent you can trust on full-auto.
• Small enough to audit — one ~25MB binary, a handful of runtime dependencies, a codebase you can read in a weekend. Trust through inspection, not promises. As of v0.5, every agent run is auditable too: a tamper-evident, hash-chained log of every action, verifiable after the fact.
• Open enough to embed — the agent core speaks a clean REST + WebSocket API, ready to be wired into your own product, CI, or internal tools.
• Approvable by any company — governance is built in, not bolted on. An org policy bounds the blast radius (controllable), dvalincode trust makes the posture self-verifiable (transparent), and the hash-chained log proves what every run did (auditable). Those three together are exactly what a security review needs to say yes — and what cloud, closed, mutable-log agents structurally struggle to provide. [Approvability plan →](docs/APPROVABILITY-PLAN.md)

The bundled web GUI is the runtime's reference implementation and showcase — the first consumer of that public API, demonstrating everything the runtime can do.

---

✅ Why Teams Pick DvalinCode

DvalinCode is differentiated by approvability. It is built for teams that need AI coding to pass security, compliance, and data-governance review before it can touch production repositories.

• Closed-loop secure remediation — scan locally or import SARIF from

CodeQL, GitHub Code Scanning, Semgrep, or compatible scanners; persist findings as local remediation cases; create an isolated dvalin/remediate/... worktree; then send a focused repair prompt with source context and verification instructions.

• Skills as governed operating procedures — upload, download, and inspect

local skill bundles. Built-in secure scanning and remediation skills tell agents which tools to use and keep workflows portable across machines.

• Model freedom without policy drift — use DeepSeek, OpenAI, Claude via

OpenRouter, Groq, Ollama, or any OpenAI-compatible endpoint while keeping tool permissions, audit, and workspace policy consistent.

• Security evidence, not just security claims — OpenSSF Scorecard support,

CodeQL, Dependabot, pinned Actions, CODEOWNERS, ISO/IEC 42001 alignment docs, AI change-impact records, and hash-chained run logs are part of the project.

• Local-first by default — sessions, config, profiles, memory, and audit

logs stay under ~/.dvalincode/; .dvalincodeignore and policy controls bound what the agent can read, write, or execute.

---

🛡️ Security & Governance

DvalinCode maintains project-level governance evidence for open-source and enterprise review. This is the differentiator for teams where AI coding must pass security approval before it can reach production repositories:

• Threat model — the full attack surface of an agentic coding runtime

(malicious AGENTS.md, poisoned MCP servers, prompt-injection escalation, egress, audit tampering, supply chain, sandbox escape), each mapped to the control that defends it and the honest residual gap. [Threat model →](docs/THREAT-MODEL.md)

• OpenSSF Scorecard support — scheduled Scorecard workflow, SARIF upload,

CodeQL, Dependabot, CODEOWNERS, least-privilege workflow permissions, and SHA-pinned GitHub Actions. [Control map →](docs/security/OPENSSF-SCORECARD.md)

• ISO/IEC 42001 alignment — an AI management system scope, AI policy, role

map, risk register, AI change classification, required records, and review cadence. [AIMS alignment →](docs/governance/ISO-42001-AIMS.md)

• AI change impact assessment — a reusable template for changes that affect

model/provider behavior, prompts, permissions, tools, audit logs, or release security. [Template →](docs/governance/AI-CHANGE-IMPACT-ASSESSMENT.md)

• Regulated-use posture — local-first data handling, policy-controlled

autonomy, minimized audit records, and release supply-chain evidence for finance, healthcare, security-sensitive SaaS, and internal enterprise use.

• Secure remediation workflow — local scan and SARIF import turn built-in,

CodeQL, GitHub Code Scanning, Semgrep, and compatible scanner findings into local remediation cases and isolated worktree repair tasks with source context and verification/reporting instructions. [Workflow →](docs/SECURE-REMEDIATION.md)

These documents are implementation evidence and operating procedures; they do not claim third-party ISO certification.

---

⭐ What's New in v0.9.0 — 🛡️ Secure remediation · Skills · CodeQL hardening

• 🛡️ Secure remediation workflow — run a built-in local scan or import SARIF

from CodeQL, GitHub Code Scanning, Semgrep, and compatible scanners; findings become local remediation cases with source context, verification guidance, and isolated worktree repair tasks.

• 📚 Skills — upload, download, inspect, and reuse local skill bundles.

DvalinCode now ships built-in secure-code-scan and secure-code-remediation skills, plus agent tools for listing skills, reading instructions, scanning, listing remediation cases, and preparing remediation worktrees.

• 🔐 CodeQL path hardening — user-controlled workspace, remediation, and

skill paths now go through explicit root-containment checks, with regression tests covering traversal-safe resolution and skill import boundaries.

• 🎨 App icons — dark and light theme application icons now ship with the web

bundle and desktop build inputs.

v0.8.0 — 🔒 Governance: controllable · transparent · auditable

• 🔒 Org policy — a dvalin.policy.json lets a company, not the developer, bound the agent: which modes, shell commands, file paths, tools, and models are allowed. Two layers (machine ~/.dvalincode/policy.json + repo) resolve by narrowing — a repo policy can only ever make the machine policy stricter, never widen it. With no policy file, behavior is identical to before. Enforced at a single chokepoint; every denial is an inline ⛔ Blocked by policy plus a policy_violation audit event. [Policy reference →](docs/POLICY-REFERENCE.md)
• 🔎 dvalincode trust — prints this install's live security posture in one command — active policy + source hashes, audit status, runtime, dependencies — so a reviewer can verify what the agent may and may not do directly, instead of taking claims on trust. --json for tooling.
• dvalincode policy check — validates dvalin.policy.json against the schema, prints the resolved policy + canonical hash (after narrowing with the machine layer), and exits non-zero on failure — for CI and policy authoring. [Policy reference →](docs/POLICY-REFERENCE.md)
• 🧾 Policy-aware audit — every run records the hash of the governing policy (and which files contributed) in run_start, so the tamper-evident log proves which rules were in force.
• 📐 Approvability plan — the through-line is documented in [docs/APPROVABILITY-PLAN.md](docs/APPROVABILITY-PLAN.md): make DvalinCode trivially approvable by any company — controllable, transparent, auditable.

v0.7.0 — 🧪 Desktop app (beta)

• 🧠 Portable memory & full data export/import — the upgraded local memory mechanism, plus every session, config, profile, and audit log, can now be bundled into a single file and restored on another machine. Migrate your whole setup in one step: dvalincode export / dvalincode import, or the Export / Import buttons in the GUI Settings panel.
• 📝 Download any AI interaction as Markdown — every conversation can be saved as a clean Markdown transcript (user turns, assistant replies, tool calls + results, decisions — all inline). Use the download icon on any session in the sidebar, dvalincode session md , or GET /api/sessions/:id/markdown.
• 🖥️ Native desktop app — a real application window (not a browser tab) over the same engine: DvalinCode.app on macOS, plus Windows/Linux builds. Built with webview-bun using the OS-native webview (WKWebView / WebView2 / WebKitGTK) — no Electron, stays a small self-contained binary.
• 🧩 A third frontend, one core — the desktop app, terminal UI, and web GUI all drive the same shared turn-runner. The current dvalincode binary is now positioned purely as the CLI (terminal + serve).
• Status: the desktop binaries are experimental / unverified — grab them from the latest pre-release and please report how the window behaves on your OS.

v0.6.0 — terminal agent · serve · shared turn-runner

• 🖥️ Terminal agent — run dvalincode bare for an interactive terminal coding agent, Claude-Code-style: streaming responses, inline [y/N] write approvals with red/green diffs, /mode · /clear · /git · /plan · /compact · /undo · /help, Ctrl-C to interrupt, and a guided first-run provider setup. Defaults to read-only Chat, switchable live.
• 🌐 dvalincode serve — the web GUI now lives behind a command, so the same binary deploys headless on a server: dvalincode serve --host 0.0.0.0 --no-open.
• 🧩 One engine, two frontends — the terminal UI and web GUI both drive a shared, transport-agnostic turn-runner (src/agent/session.ts), keeping them at feature parity.

v0.5.0 — security-grade audit trail · Run Report · theme switcher

• 🛡️ Security-grade audit trail — every Cowork/Code run writes a tamper-evident, hash-chained JSONL log to ~/.dvalincode/audit/ (run_start, every tool_call / file_* / shell_exec / approval, run_end). The hash chain makes any after-the-fact edit detectable. No local coding agent ships verifiable behavior logs. [Format + threat model →](docs/AUDIT-TRAIL.md)
• 📋 Run Report + dvalincode report CLI — a Markdown summary of each run (files read/changed, commands, decisions, test result), rendered as a collapsible card in the GUI and from the CLI:

``sh dvalincode report --last # render the most recent run dvalincode report --format json dvalincode report verify # ✓ chain intact / ✗ broken at seq N ``

• 🎨 Theme switcher — choose dark / light / system in Settings. system follows your OS live; the choice persists across sessions.

v0.4.0 — /compact · dvalin.json team playbook · self-contained binaries

• /compact — LLM-based context compaction: replaces conversation history with a structured five-section summary (Goal / Completed / Decisions / Current State / Pending). A divider in the chat thread shows the token reduction (e.g. 8,412 → 1,203 tokens −85%).
• dvalin.json team playbook — commit a shared set of automation prompts to your repo. The sidebar loads them automatically and lets teammates run the same one-click routines without any manual setup. Export button converts your personal routines to dvalin.json in one click.
• **Se

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: arthurpanhku
• Source: arthurpanhku/dvalincode
• License: MIT

Install and usage instructions live in the source repository linked above.