Version 1.0.30 · Windows and Linux, signed

Run, fix, and secure
every developer tool.

A desktop AI command station for controlled software-building workflows. Your whole toolbox in one window, with a security gate in front of it.

Download 1.0.30 See how it works

Runs on your machine. Scanners run locally. You choose the AI provider.

The AiCodeStation workspace, every developer tool in one runnable grid

8+Scanner engines built in

4Linux package formats

0Lines of source sent by default

GPGEvery release signed

Why it exists

Most AI coding tools ask you to trust them. This one is built to be checked.

Three commitments the product is designed around, not marketing lines bolted on afterwards.

Nothing runs unchecked

A command blacklist, input sanitization, role gates, zero-trust egress, and source-read authorization all run before execution, not after the damage.

Your code stays yours

The bundled scanners run on your machine. Secure code review sends only scrubbed changed lines to the AI, and only if you widen that yourself.

Built to be audited

An append-only, tamper-evident audit chain with SIEM export. Signed releases. Secrets held by your OS keyring or your own vault.

The workspace

One window for building, running, scanning, and reviewing

Every tool you own becomes a card you can run, inspect, scan, and share.

Governed workflows

Chain tools from the palette or start from a pattern: CI build, container release, Kubernetes rollout, security gate.

Preflight runs before execution, not after
Retry, timeout, and on-failure policy per node
Approval gates and a full run log
Cycle check and tool registry resolution

The governed workflow builder with its tool palette and inspector

Secure code review, scoped to what changed

Review local changes and detect security risks without shipping your repository anywhere.

Read-only, the bundled scanners run locally
Redacted by default: scrubbed changed lines only
Findings ranked critical, high, and new
Export a report, or open the finding in Code Atlas

Secure code review scoped to local changes

Bring your own model, repos, and tools

Nothing about the stack is locked. Point it at the provider and the remotes you already use.

Any OpenAI-compatible provider, cloud or local
Keys held in the OS secret vault, never in plain settings
GitHub, GitLab, and Codeberg connections
Import a tool from any public repository or URL

AI provider settings with the API key held in the OS vault

The security engine

An industry-grade security engine on every tool

Scan, rank, and map every finding to the tactics an attacker could actually use.

Threat overview

Security posture, scan coverage, open findings, and secret leaks, with the MITRE ATT&CK kill-chain those findings map to.

SAST, SCA, SBOM, and dependency watch
Secret detection and YARA / IOC matching
IaC and container config posture
License compliance and AI/ML model security

Threat overview with posture, findings, and attacker tactics

Every run clears a pre-execution gate

The offensive tooling is gated hardest. Nothing probes a target without an explicit, recorded authorization from you.

Explicit ownership confirmation before any active test
Link-local and cloud-metadata targets blocked outright
Adversary work produces an auditable plan, never a live C2
Server-brokered, per-operation approval

Check

Command blacklist, input sanitization, and role or corporate gates evaluate the request.

Authorize

Source-read authorization and zero-trust egress decide what the run may touch and reach.

Record

The run lands in an append-only, tamper-evident audit chain, exportable to your SIEM.

Inside the app

Real screens, not mockups

Every image on this page is a capture of the shipping build.

Security tooling and scanner engines — **Security tooling**Every scanner engine in one panel, with what is installed and what still needs a report.

Import a tool and cloud sync — **Import and sync**Pull a tool from any public repository, and back the workspace up to AWS, Azure, or GCP.

Security settings — **Hardened by default**Passkeys, encrypted anti-rollback backup, execution control policy.

Secrets management providers — **Secrets stay outside**OS keyring, Vault, AWS, Azure, or GCP secret managers.

Git integrations — **Your remotes**GitHub, GitLab, and Codeberg, with CI/CD run history.

Sealed team sharing with per-role permissions — **Sealed sharing**Share a tool run-only, so teammates execute it without receiving the source.

**Dependency watch**Installed against latest, per source file, for every tool you own.

Voice settings — **Voice control**Drive the workspace by voice, offline and private.

Adversary lab engagement plan — **Adversary lab**Produces an auditable engagement plan for your own isolated, egress-denied VM. The frameworks are never bundled in the client.

Enterprise settings — **Enterprise controls**A corporate tools registry, enforced tool approval, and your own authentication method.

Download

Release 1.0.30

Every file is GPG signed and its SHA-256 is published below.

Platform	File	SHA-256
Windows10 / 11, 64-bit	`AiCodeStation-Setup-1.0.30.exe`	e795b70ae550d585c6b95eacb4a6bfdb0c87bf7c571dbe076eb20655f0c42e70
DebianUbuntu, Mint	`aicodestation_1.0.30_amd64.deb`	a05f7ee5dcd06455c2c141d15bd08b92eaac68655fa6fc8e8433d15074f33371
RPMFedora, RHEL, openSUSE	`aicodestation-1.0.30-1.x86_64.rpm`	bf633f769b67331f952f5b84a6285a6335c34d5eb0c77d34408363dddf35d3bf
AppImageany modern Linux	`AiCodeStation-1.0.30-x86_64.AppImage`	4430203b37e8120ec0cdb3d92e5da5f4bff1c8ce156a6d7bc7adbd250e0f8fbd
Archiveportable	`AiCodeStation-1.0.30-linux-x86_64.tar.gz`	bb48690618b6e54a18e0c61829c51ce757c8ce0fc569ccd114c943194f4bd9ba
macOSApple Silicon and Intel	Coming soon

Verify what you downloaded

A checksum proves the file did not arrive corrupted. It cannot prove the page it came from was not changed. So every release file is also GPG signed, and the signing key lives on neither the website server nor the download server.

Release key fingerprint
E779 76A5 D8A6 1752 8244  D939 E4E6 5E94 12CD 53CA

gpg --import aicodestation-release-key.asc
gpg --fingerprint
gpg --verify aicodestation_1.0.30_amd64.deb.asc aicodestation_1.0.30_amd64.deb

Or install from the repository, Debian and Ubuntu

The package manager then checks the signature on every update, not only the first time.

curl -fsSL https://acsdownloads.blob.core.windows.net/releases/aicodestation-release-key.asc \
  | sudo gpg --dearmor -o /usr/share/keyrings/aicodestation.gpg

echo "deb [arch=amd64 signed-by=/usr/share/keyrings/aicodestation.gpg] \
https://acsdownloads.blob.core.windows.net/releases stable main" \
  | sudo tee /etc/apt/sources.list.d/aicodestation.list

sudo apt update && sudo apt install aicodestation

Plans

Start free, upgrade when the engine earns it

The full capability matrix is compared line by line on the pricing page.

Free

The workspace, signed builds, and the core tooling.

Pro

For developers who want the full engine. Free for verified students with a .edu address.

Enterprise

Dual control, JIT elevation, SIEM export, corporate gates, and support.

Compare every capability

Put a gate in front of your toolbox

Windows and Linux builds are signed and published with their checksums. macOS is coming.

Download 1.0.30 Read the Trust Center

Run, fix, and secureevery developer tool.