Show HN: Airgap-check – find what your AI app silently downloads offline

Airgap-check is a Go utility for finding why AI applications may fail or make unexpected network requests in air-gapped environments. It scans dependency manifests and code for known first-use downloads, checks .env key names without reading secret values, and can run an application in a Docker container with networking disabled. A DNS sinkhole and Python and Node hooks record lookup and connection attempts. The tool also suggests Dockerfile settings and build-time commands to disable telemetry and pre-warm assets such as tokenizer data, embedding models, and browser binaries. Its motivation is that pointing an app at a local model server does not prevent other libraries from downloading assets or sending telemetry.

A benchmark tested probes - not full application launches - in 20 Python and TypeScript repositories, with rules frozen before the 10-repository held-out phase. In that phase, checks identified offline downloads in all nine repositories that had them, while correctly finding one clean repository. Across individual components, results were 35 true positives, four false positives, and five false negatives, or 89.7% precision and 87.5% recall; the small sample makes these rough estimates. Examples include ChromaDB downloading an ONNX model and tiktoken fetching encoding data, while Hugging Face retries can delay failure. Coverage is limited: only exercised code paths are tested, Python and Node were validated, and hardcoded IP connections and DNS-over-HTTPS may escape detection.