• Technical details

How Speedwave controls AI-assisted development.

Speedwave adds a security and governance layer around AI coding assistants, limiting what they can see, access and do while keeping developer workflows usable.

Built around isolated runtimes, scoped tool access, credential separation, PII tokenisation, local LLM options and audit logging.

• Architecture at a glance

Layers that keep the assistant inside defined boundaries.

Speedwave separates the AI assistant, project workspace, external tools, credentials and audit layer so that AI-assisted work can happen inside defined security boundaries.

AI assistant

Claude Code or a local LLM used by the developer. Runs inside the controlled runtime - it cannot reach the host directly.

Controlled runtime

A hardened local environment that limits project and workstation access. Lima on macOS, rootless nerdctl on Linux, WSL2 on Windows.

Scoped tool gateway

Approved tool integrations exposed through controlled interfaces. The assistant sees two tools: search for the right tool, and execute code.

Credential isolation

Service credentials stay outside the assistant and are only used by approved workers. API keys go directly to Anthropic - never to Speednet.

Data protection layer

Sensitive values can be detected, tokenised and restored locally. PESEL, IBAN, card numbers, email and phone numbers never reach the model as-is.

Audit trail

AI-assisted activity is logged for security, governance and review. Every READ/WRITE/DELETE with timestamp and attribution, from the first session.

• Core technical capabilities

What runs on every engineer workstation.

One installer. No Docker, no Kubernetes, no IT ticket.

Hardened local runtime

Run AI coding assistants inside isolated project environments instead of exposing the whole workstation. One package (.dmg, .exe, .deb) - Lima or WSL2 bundled. No Docker Desktop, no Kubernetes, no IT setup ticket.

Scoped tool gateway

MCP gateway exposes only two tools to the assistant: search for the right tool, and execute code. Context window stays constant no matter how many integrations are connected. SecurityCheck gate is fail-closed on every request.

PII tokenisation

PESEL, NIP, IBAN, phone, email, card numbers tokenised before reaching the model. Tokens are stable within a session and reversed locally. The model never sees real data.

Credential isolation

API keys and service credentials are stored locally on the engineer workstation. Direct calls to Anthropic - no Speednet server in the data path. Credentials are never visible to the assistant.

13-agent code review pipeline

Every commit goes through 13 agents in parallel: security, test coverage, SOLID, KISS, YAGNI, DRY, duplications, silent failures, comments, documentation, type design, simplifications, project conventions.

Full audit log

Every AI action logged from minute one - READ, WRITE, DELETE, with timestamp and attribution. No configuration required. Optional OTLP/HTTP export to Splunk, QRadar, Datadog or any OTEL-compatible SIEM.

Local LLM support

Speedwave supports local LLM backends (Ollama, LM Studio) as a drop-in alternative to cloud APIs. Recommended for teams with network policy restrictions or strict data classification requirements.

Trusted integrations

Maintained integrations for Jira, Redmine, GitLab, GitHub, Slack and more. Each runs in its own container, centrally logged, and updated with every Speedwave release.

• Defense in depth

11 independent defense layers.

01 Kernel-level isolation (Lima / nerdctl / WSL2)

02 Container hardening, OWASP-aligned

03 Network isolation per project

04 Credential isolation

05 JavaScript sandbox - 22 escape patterns blocked

06 PII tokenisation

07 Routing validation

08 SecurityCheck (fail-closed gate)

09 Secret file permissions (0o600)

10 Authentication gateway

11 Log sanitiser

Apache 2.0

Your security team can read every line.

Apache 2.0 with explicit patent grant. No NDA required for a security audit. Perpetual access to the codebase even if Speednet disappears - your DORA exit strategy.

See on GitHub → Book a scoping call →