Installation & Quick Start
Download and run Nadhi Audit locally on your Mac with Apple Silicon or Intel chips.
1. Download and Install
Download the notarized macOS disk image (.dmg) and drag Nadhi Audit into your Applications folder.
2. Launch and License Activation
Open Nadhi Audit. On first launch, enter your license key. You can purchase or manage your commercial license key from your dashboard.
3. Local Model Verification
Nadhi Audit bundles the fine-tuned local model (Nadhi_Audit_FT.gguf) and starts llama-server automatically on Apple Silicon Metal GPU. Zero configuration required.
Replit Agent MCP Integration
Connect Nadhi Audit to Replit Agent and cloud workspaces via our secure MCP Gateway.
1. Navigate to Replit Integrations
In Replit, click on your profile picture in the bottom-left/top-right, go to Settings, select Integrations from the menu, and under Your Integrations click Add MCP Server.
2. Configure MCP Server Details
Enter the following connection settings and click Test & Save:
3. Auditing with Replit Agent
Once connected, prompt Replit Agent directly in your Repl chat:
Commands, MCP Tools & Workflows
Drive compliance audits, code fixes, and pull requests directly inside the Desktop app, Cursor, Claude Code, and Replit.
1. Primary Slash Commands (Chat & Terminal)
You can run these commands directly in the Nadhi Audit chat window or pass them via coding agents:
| Command or Tool | Description |
|---|---|
| /audit [path|url] [regime] | Run on-device audit directly on a local directory or remote GitHub repository URL. |
| /audit_fix [path|url] | Audit, filter false positives, and commit verified fixes on branch nadhi without pushing to remote. |
| /full_audit [path|url] | All-in-one pipeline: audit code, commit fixes on branch nadhi, verify build, and push PR to GitHub. |
| /fix [path] | Apply automated AST-verified fixes for findings from the most recent audit. |
| /push-pr [path] | Push the verified nadhi remediation branch to GitHub with DCO sign-off. |
2. Cursor IDE Setup (Local Daemon)
In Cursor, navigate to Cursor Settings -> Features -> MCP -> Add New MCP Server, or create a configuration file in your project root at .cursor/mcp.json:
3. Claude Code CLI Setup (Local Daemon)
Run this command in your terminal to connect Claude Code to your local Nadhi Audit daemon on Metal GPU:
4. Remote MCP Connection (Cloud Gateway Relay)
If running in a remote container or cloud IDE (like Replit), connect via the Cloud Gateway relay:
5. Available MCP Tool Suite
Nadhi Audit exposes structured tools across local and remote transports:
| Command or Tool | Description |
|---|---|
| audit_repository | Run compliance and security audit over the active repository or file dictionary. |
| audit_lovable_project | Authorize and audit a Lovable project using delegated read-only access. |
| audit_changes | Fast incremental audit checking only modified files and diffs. |
| audit_ref | Audit a remote Git commit or branch without cloning source to disk (for CI). |
| fix_finding | Apply automated AST-verified fixes on an isolated git branch. |
| validate_fix | Re-audit changed scope and verify that compiler syntax gates pass. |
| full_audit | All-in-one: Audits code, evaluates false positives, fixes bugs, and validates. |
| create_pr | Push the remediation branch to GitHub and create a Pull Request. |
| explain_finding | In-depth security explanation and suggested AST code repair for a CWE. |
| get_last_report | Retrieve the last markdown report and findings summary. |
6. Example Prompts in Cursor & Claude Code
You can prompt your editor agent naturally with tool calling:
GitHub Authentication & CLI Setup
Configure GitHub CLI and Personal Access Tokens for private repository auditing and 1-click PR creation.
1. GitHub CLI Setup (Recommended)
Install and authenticate the official GitHub CLI to allow Nadhi Audit to create forks and pull requests automatically:
2. Connecting Private Repositories via PAT
If you do not use GitHub CLI, generate a Read-Only Personal Access Token (repo scope) and authenticate via chat or Settings:
Compliance Frameworks & Toggles
Switch between global software security standards and regional privacy compliance mandates in one click.
1. Vibe Audit — OWASP Top 10:2025 / CWE (Global Default)
The default regime, against the OWASP list finalised in January 2026. Covers the classic vulnerability set — SQL injection (CWE-89), OS command injection (CWE-78), XSS (CWE-79), path traversal (CWE-22), disabled TLS verification (CWE-295), hardcoded credentials (CWE-798) — and adds the classes that dominate AI-generated code, where the defect is usually a control that is ABSENT rather than a line that is wrong. Four lanes run over one tree: source patterns; row-level security replayed from your migrations (tables served with no access policy); the dependency manifest against its lockfile (packages that have never resolved, including hallucinated names); and, if you enable it, a read-only check of what your deployed backend actually enforces. Findings that combine across lanes are reported as a single chain. Note the 2025 renumbering: SSRF is no longer its own category (CWE-918 now sits in A01 Broken Access Control), A03 is Software Supply Chain Failures rather than Injection, and A10 Mishandling of Exceptional Conditions is new.
2. India DPDP Act 2023 & Rules 2025
Audits data fiduciary obligations: Section 8(5) reasonable security safeguards, Rule 6 security log retention (minimum 1 year), personal data in logs (CWE-532), and data principal rights.
3. US HIPAA Health Compliance
Audits protected health information (PHI) safeguards: Section 164.312 transmission encryption, access control, audit logging, and cleartext medical identifiers.
4. European Union GDPR
Audits Article 32 security of processing, Article 30 records, and Chapter V cross-border transfer controls.
How to Switch Frameworks
Select your active framework in Nadhi Audit Settings, or pass the framework name directly when running an audit:
Automated AST-Verified Code Fixing
How Nadhi Audit fixes vulnerabilities safely on an isolated branch with compiler and judge verification.
Multi-Strategy Remediation Loop
When you run /fix or full_audit, Nadhi Audit executes a LangGraph state machine with 3 progressive repair strategies:
- ✓Pre-Fix False Positive Filter: Local model evaluates finding context. Skips test fixtures, mocks, and protocol requirements.
- ✓Strategy 1 (Direct Find/Replace): Precise line replacement with line-prefix normalization.
- ✓Strategy 2 (Contextual Block Repair): Expands context window and injects compiler feedback to prevent repeating syntax mistakes.
- ✓Strategy 3 (AST / ReAct Graph): Scoped function-level AST transformation.
Compiler & AST Syntax Gate
Before any code edit is kept, Nadhi Audit re-parses and tests the patched file using language interpreters in check-only mode:
LLM-as-a-Judge Review
The local model compares the original and patched diff. It validates that the vulnerability is removed, program semantics are preserved, and no undefined variables were introduced. Clean edits are committed to the isolated nadhi branch with DCO sign-offs.
Executive Audit Reports (PDF)
Generate formal compliance reports with findings, evidence lines, and methodology.
Report Structure
Every audit generates a markdown summary in the workspace and an executive PDF document containing:
- ✓Report ID and timestamp for audit reproducibility.
- ✓Target repository path and exact files scanned.
- ✓Severity breakdown: Critical, High, Medium, Low.
- ✓Citable clause mappings (e.g. OWASP A01:2025, DPDP Sec 8(5), HIPAA Section 164.312).
- ✓Evidence quotes citing exact file and line numbers.
- ✓Assessor review and approval sign-off block.
Report File Location
Reports are stored in your selected workspace folder under: ~/Desktop/Nadhi-Audit/<repo-name>/security-audit-report-*.pdf
Self-Hosted Ollama Support
Route inference to a central GPU workstation or private server on your local network.
Connecting to a LAN Ollama Server
To use a central server instead of your Mac local model, open Settings in Nadhi Audit and configure:
Airgapped Integrity
In Ollama mode, network egress remains strictly blocked from public internet. Traffic only flows over private RFC1918 loopback and local network addresses.