$ git diff main -- deployment/air-gapped.md
commit a1b2c3d - author: Oliver Wakefield-Smith - verified 21 Jun 2026
True air-gap (no outbound connection for inference) is the rarest deployment shape in this market. Today only Qodosrc, Augment Code (Enterprise tiersrc) and SonarQube Server (rule-based core only) genuinely run air-gapped. Snyk Code and Diffblue Cover have on-prem options that may qualify depending on configuration.
@@ the air-gap tools @@quote-gated
1+Qodo - bring your own inference (vLLM, TGI, Triton) on your GPUs
2+Augment Code - Enterprise VPC tier, customer-owned inference negotiable
3+SonarQube Server - rule-based SAST core only; AI Code Assurance still needs outbound
4+Snyk Code - on-prem broker available; check whether DeepCode AI is in or out of the air-gap perimeter
5+Diffblue Cover - generates JUnit tests, not PR review; on-prem JetBrains plugin path is the closest fit
@@ GPU footprint at 50 devs @@rule of thumb
1A single A100 80GB serves ~150 concurrent PR reviews per hour at Llama 3.3 70B-equivalent quality. For 50 devs at ~10 PRs/dev/wk that is well within capacity.
2Memory budget: a 70B model in 4-bit needs ~40GB VRAM. Pair with KV-cache headroom and you want 80GB.
3Two GPUs for redundancy. One node, one fail-over.
4-Capex caveat: A100s are still ~$10K used / $15K new at mid-2026 pricing. Air-gap inference is not cheaper than SaaS until ~200 devs.
@@ open-weight model options @@2026 anchors
1Llama 3.3 70B / Llama 4 70B - solid generalist for review
2DeepSeek-Coder V3 - strong on code specifically
3Qwen 3 Coder - good multilingual code coverage
@@ when air-gap is the wrong question @@opinion
1-Most teams asking for "air-gapped" really want "VPC-only with audit logs". That is much cheaper to satisfy.
2+If your security team is good faith, walk through the threat model first. Outbound-to-Anthropic with a no-training contract usually clears the bar.
@@ cross-links @@related