Local-first code scanner for Windows
Your code has problems.
Here they are.
Eleven analyzers. One honest report. Zero uploads. Blunt Code runs Ruff, Biome, Semgrep and SonarQube — plus gitleaks, Trivy, OSV, Checkov, license, secrets and TODO checks — on your machine, and tells you exactly what's wrong, to your face.
free · MIT · no admin · Windows 10/11 · 726 automated tests
- No cloud
- No account
- No telemetry
- No mercy
How it scans
Every analyzer runs sandboxed under %LOCALAPPDATA%\BluntCode\tools — your PATH is never touched, and nothing is ever uploaded.
Every finding, weighed
weighted score → one letter grade per workspace, tracked over time trend arrows on the dashboard show whether you're fixing things or breaking them
Coverage wall
- Python
- JavaScript
- TypeScript
- React JSX and TSX
- Go, Java, Kotlin, C#, C, C++, Ruby, PHP, Rust, Swift, Scala, Shell, PowerShell, YAML, TOML, JSON, Dockerfile, .env and more — 39 classified languages
Deep scans: Python · JavaScript · TypeScript. Secrets & TODO: all 39 classified languages — .env files, Dockerfiles, even committed PEM keys.
What you get
/01 Nothing leaves
Loopback-only server. SQLite, reports and logs stay in %LOCALAPPDATA%. No account, no telemetry, works offline after first run.
/02 Ignore at source
Suppress a finding where it lives, with a reason. Or fingerprint-suppress, or commit a .bluntcodeignore — your team's calls, in the repo.
/03 Baseline CI gates
Exit codes your pipeline understands: 0 clean, 1 gate tripped, 2 usage, 130 Ctrl+C. --format github writes PR annotations.
/04 Self-healing
Stale rulepacks, interrupted tool downloads, locked data dir — doctor diagnoses and fixes them before you file an issue.
/05 Reports that ship
Every export honors your active filters. --save-baseline snapshots this scan, so the next one flags only what's new — not what you already know.
/06 Keyboard fast
Navigate, add workspaces, search findings, open the command palette — without touching the mouse.
Install in 30 seconds
PS> irm https://github.com/sanketpatel32/Blunt-code/releases/latest/download/install-latest.ps1 | iex
C:\> curl -fsSL -o "%TEMP%\install-bluntcode.cmd" https://github.com/sanketpatel32/Blunt-code/releases/latest/download/install.cmd && "%TEMP%\install-bluntcode.cmd"
Installs to %LOCALAPPDATA%\Programs\BluntCode. The app opens http://127.0.0.1:<port> automatically — add a folder, hit scan.
The blunt CLI
exit 0 clean · 1 gate tripped · 2 usage error · 130 ctrl+c — plus llm.txt and bluntcode agent helpers, so your AI pair can read findings without a browser.
Why not a cloud scanner
Cloud scanners are good tools — as long as "scan" means "upload the repo to someone else's server." Blunt Code takes the other deal.
Scan everything.
Send nothing.
Get Blunt Code — free ↓
MIT · Windows 10/11 · v0.16.21 · your code never leaves the machine