Desktop app for Windows

Review your code. Vet what you download. On your own machine.

Lintel AI reads a project folder with a local Ollama model, scores every file out of 100, and flags leaks, vulnerabilities and malicious patterns with the exact line. It has no account, no cloud and no upload.

Download for Windows View source on GitHub

Version 1.1.0
Windows, 64-bit
MIT license
Needs Ollama for code review

Lintel AIOllama · 3 models

LintScan

Model

qwen2.5-coder:7b

Project

billing-service

Analyze project

Progress

5 of 5 files

Skips node_modules, .git, bin, obj, dist, build and .env files.

5/5files

7issues

86avg score

refund.ts

src/payments

poller.ts

src/jobs

session.ts

src/auth

format.ts

src/util

router.ts

src/api

100

refund.ts

src/payments/refund.ts · 118 lines

Findings · 3Chat

VulnerabilityHIGHLine 42

The refund id is concatenated into the SQL string, so a crafted value can change the query. Use a parameterized query.

40async function findRefund(id: string) {

41 const sql =

42 "SELECT * FROM refunds WHERE id = '" + id + "'";

43 return db.query(sql);

44}

BugMEDIUMLine 77

The retry timer is started on every call and never cleared, so timers pile up.

Illustration with sample data. The score is 100 minus 20 for the high, 10 for the medium and 5 for the low finding.

Two tools in one window

Review the code you write. Check the code you did not.

The same app, the same folder picker, two different questions. Switch between them with one control at the top of the sidebar.

Lint

Is this code any good?

Memory leaks, runaway loops, dead code, useless logic, bad habits and security flaws
Every finding classified as a vulnerability, a bug or a code smell
A score out of 100 for each file, computed from the findings
Chat with the model about any single file, with history that survives restarts

How Lint works

Scan

Is this project safe to open?

Install scripts, build events and editor tasks that run code on their own
Downloaders, credential stealers, persistence, injection and obfuscated payloads
A clear verdict: no findings, suspicious or dangerous, with the lines behind it
Normal level works offline with no model. Advanced adds a model that judges the alerts

How Scan works

Getting started

Three steps, and nothing to sign up for.

Install Ollama and pull a model
Lintel AI talks to Ollama on your computer. Any model you have pulled appears in the model list. A code-oriented model is a good start.
```
ollama pull qwen2.5-coder:7b
```
Install Lintel AI
Download the Windows installer from the latest release. It installs for your user account and needs no administrator rights. The app is self-contained, so .NET does not need to be installed.
Choose a folder and run
Pick a model, choose a project folder and press F5. Results stream in file by file, so you can start reading before the run ends.

The installer is not code-signed yet, so Windows SmartScreen may warn the first time you run it. The source and every release are public on GitHub.

Features

Everything the app does, in one place.

Each feature below is in the current release. The Lint and Scan pages go through the details and the limits.

Lint · code review

Folder reviewReads source, config and docs files in a project and its subfolders, minus build output, lockfiles, minified bundles and binaries.
Six kinds of problemMemory leaks, infinite loops, dead code, useless logic, bad practices and security issues.
Vulnerability, bug or code smellEvery finding carries a kind and a severity, so you can filter to what matters first.
Findings pinned to real linesA few lines of syntax-coloured context sit under each finding, in the same palette as VS Code.
Project-awareEach file is reviewed knowing what the rest of the project declares and uses, so exported code is not called unused.
Long files in partsUp to four overlapping parts with true line numbers. The app says so when part of a file stays unread.
Deterministic scoreHigh costs 20 points, medium 10, low 5, floor 0. The model never does the arithmetic.
Chat about a fileAsk follow-up questions with the findings and the code already in context. Replies render code blocks with a copy button.

Read the Lint details →

Scan · project security

Check before you trustPoint it at a downloaded project. Nothing is run, built or opened.
Reads everythingBinaries, hidden files and unusual extensions are included, and symbolic links are never followed.
Auto-run detectionnpm lifecycle scripts, setup.py install commands, VS Code tasks that run on folder open, and MSBuild build events.
Known malicious patternsDownload-and-execute, credential and wallet theft, persistence, process injection, reverse shells, miners and more.
Obfuscation signsHidden Unicode controls, encoded blobs, hex and character-code strings, and obfuscator-style names.
Disguised filesExecutables with the wrong extension, double extensions and right-to-left override names.
A verdict, not a scoreNo findings, suspicious or dangerous, with the file and line behind every alert.
Advanced levelA local model judges the alerts. It can clear false alarms and add checked findings, but it can never clear a high alert.

Read the Scan details →

Workspace

Live resultsFiles appear as they finish. Filter by severity or kind, search by name, sort worst-first, and stop at any time.
History and comparisonThe last 30 completed runs are kept with every finding. Compare any of them against the current run, file by file.
Re-run one fileRun a single file again without repeating the project, and open it in your editor or file manager.
ExportSave the current results as JSON or as a Markdown report.
.AIIgnoreA project-root file with .gitignore syntax to leave out folders and files from a review.
Light and dark themesFollows your system by default, or pick one.

Control and privacy

Runs locallyThe model, the scan and the data all stay on your computer. There is no account and no telemetry.
Secrets never read.env, .pem, .key and .pfx files are skipped during review whatever your rules say.
Remote server warningIf the Ollama address is another machine, the sidebar tells you file contents will cross the network.
Tunable limitsSet the Ollama address, the characters read per file and the time limit per file in Settings.
Updates you controlOn start the app only asks GitHub for the latest version number. You choose whether to install, skip or turn the check off.
Keyboard-firstEvery common action has a shortcut. See the table below.

Built for small models

Local models make mistakes. The app is designed around that.

A model small enough to run on a laptop will sometimes invent a problem, point at the wrong line or call something harmless dangerous. Lintel AI treats the model as a reader that has to show its work, and checks that work in code.

The score is arithmetic, not opinion

The model reports findings. The app computes the score from their severities, so the same findings always give the same number.

Claims are checked against the project

An index of what the project declares and uses is built first. A finding that says an exported name is never used is dropped when other files use it.

Line numbers are corrected

When the model is a few lines off, the finding moves to the nearby line that actually contains the name it mentions.

Quotes have to exist

In the advanced scan the model must quote the code it relies on. A quote that is not in the file is treated as no answer at all.

The model cannot clear a high alert

Small models were measured calling real malware harmless, so high-severity alerts are never put in the model's hands. It can lower a medium alert, only after two differently worded checks agree.

Failure falls back to the rules

If the model stops answering, the run keeps what the rules found and tells you the review stopped early. It never fails silently.

Privacy

Your code goes to one place: the model you chose.

What	Where it goes
File contents for a review or chat	Only the Ollama address in Settings. `http://localhost:11434` by default, which is your own computer.
The normal security scan	Nowhere. It uses rules and patterns, with no model and no network.
Settings, history and chats	Your own `%AppData%\LintelAI` folder. Uninstalling leaves them untouched.
The update check	One request to GitHub for the latest release number. No information about your files or machine is sent. It can be turned off.
Analytics and accounts in the app	None. The app has no telemetry and no sign-in.
This website	Cloudflare Web Analytics counts visits and page views. It sets no cookies and does not track individual visitors. The app never contacts it.

Keyboard

Shortcuts

Shortcut	Action
`F5`	Analyze or scan the project
`Ctrl` + `O`	Choose a folder
`Ctrl` + `F`	Search files
`Ctrl` + `H`	History
`Ctrl` + `E`	Export
`Ctrl` + `,`	Settings
`Esc`	Close a dialog

Questions

Frequently asked

Does Lintel AI upload my code?

No. File contents are sent only to the Ollama server you configure, which is on your own computer by default. If you point the app at another machine, the sidebar warns you that contents will travel over the network.

Which models can I use?

Any model you have pulled into Ollama. Code-oriented models such as qwen2.5-coder are a sensible start; the app has been exercised against a 3B model and works on modest hardware. Larger models give fewer false alarms but take longer. The normal security scan needs no model.

Can the scan prove a project is safe?

No, and the app says so. It is a pattern check: a clean result means no known malicious patterns matched. A careful attacker can avoid known patterns. Treat a clean result as one signal, not a certificate.

Which languages does the review cover?

JavaScript and TypeScript, Python, Java, Go, Rust, C and C++, C#, PHP, Ruby, Swift, Kotlin, Dart, Lua, Scala, SQL, PowerShell, shell and batch scripts, plus web files, XAML, JSON, YAML, TOML and Markdown. The security scan reads every file regardless of type.

Does it need an internet connection?

Not for reviewing or scanning. The only network request the app makes by itself is the optional check for a newer version, and you can turn it off in Settings.

Is it free? Can I read the source?

Yes to both. Lintel AI is released under the MIT license and the source is on GitHub.

Does it run on macOS or Linux?

Only Windows has been tested. The app is built with .NET 8 and Avalonia, so it can be built for other platforms from source, but those builds are not verified.

Why does the installer show a SmartScreen warning?

The executable and installer are not code-signed yet, and Windows warns about unsigned programs it has not seen often. You can inspect the source and build it yourself.

Run it on a project you have open right now.

Free, open source, and nothing leaves your computer.

Download for Windows Source on GitHub

Review your code. Vet what you download. On your own machine.

refund.ts

Review the code you write. Check the code you did not.

Lint

Scan

Three steps, and nothing to sign up for.

Install Ollama and pull a model

Install Lintel AI

Choose a folder and run

Everything the app does, in one place.

Lint · code review

Scan · project security

Workspace

Control and privacy

Local models make mistakes. The app is designed around that.

The score is arithmetic, not opinion

Claims are checked against the project

Line numbers are corrected

Quotes have to exist

The model cannot clear a high alert

Failure falls back to the rules

Your code goes to one place: the model you chose.

Shortcuts

Frequently asked

Run it on a project you have open right now.