Installation & Quick Start
Download and run Nadhi Audit locally on your Mac with Apple Silicon or Intel chips.
1. Download and Install
Download the notarized macOS disk image (.dmg) and drag Nadhi Audit into your Applications folder.
2. Launch & License Activation
Open Nadhi Audit. On first launch, enter your license key. You can claim a free 1-year community key from the homepage or use your commercial license key.
3. Local Model Verification
Nadhi Audit bundles the fine-tuned local model (Nadhi_Audit_FT.gguf) and starts llama-server automatically on Apple Silicon Metal GPU. Zero configuration required.
Cursor & Claude Code MCP Integration
Drive compliance audits, code fixes, and pull requests directly inside Cursor, Claude Code, VS Code, and Windsurf.
1. Cursor IDE Setup (GUI or Config)
In Cursor, navigate to Cursor Settings → Features → MCP → Add New MCP Server, or create a configuration file in your project root at .cursor/mcp.json:
2. Claude Code CLI Setup
Run this command in your terminal to connect Claude Code to your local Nadhi Audit daemon:
3. VS Code (Cline / Roo Code) & Windsurf Setup
In VS Code MCP or Windsurf, add Nadhi Audit to your MCP server configuration:
4. Available Tools & Slash Prompts
Once connected, you can invoke these tools in Cursor Composer, Claude Code, and chat:
| Command or Tool | Description |
|---|---|
| /audit | Run compliance and security audit over the active repository. |
| /fix | Apply automated AST-verified fixes on an isolated git branch. |
| /push-pr | Push the remediation branch to GitHub and create a Pull Request. |
| /full_audit | All-in-one: Audits code, evaluates false positives, fixes bugs, and pushes PR. |
| audit_changes | Fast incremental audit checking only modified files. |
| audit_ref | Audit a remote Git commit without cloning source to disk (for CI). |
| get_last_report | Retrieve the last markdown report and PDF path instantly. |
5. Example Prompts in Cursor & Claude Code
You can prompt your editor agent naturally with tool calling:
GitHub Authentication & CLI Setup
Configure GitHub CLI and Personal Access Tokens for private repository auditing and 1-click PR creation.
1. GitHub CLI Setup (Recommended)
Install and authenticate the official GitHub CLI to allow Nadhi Audit to create forks and pull requests automatically:
2. Connecting Private Repositories via PAT
If you do not use GitHub CLI, generate a Read-Only Personal Access Token (repo scope) and authenticate via chat or Settings:
Compliance Frameworks & Toggles
Switch between global software security standards and regional privacy compliance mandates in one click.
1. Security (OWASP Top 10 / CWE) (Global Default)
Evaluates code for critical vulnerabilities: SQL injection (CWE-89), OS command injection (CWE-78), Cross-Site Scripting (CWE-79), Path traversal (CWE-22), Broken access control, Disabled TLS verification (CWE-295), and Hardcoded credentials (CWE-798).
2. India DPDP Act 2023 & Rules 2025
Audits data fiduciary obligations: Section 8(5) reasonable security safeguards, Rule 6 security log retention (minimum 1 year), personal data in logs (CWE-532), and data principal rights.
3. US HIPAA Health Compliance
Audits protected health information (PHI) safeguards: §164.312 transmission encryption, access control, audit logging, and cleartext medical identifiers.
4. European Union GDPR
Audits Article 32 security of processing, Article 30 records, and Chapter V cross-border transfer controls.
How to Switch Frameworks
Select your active framework in Nadhi Audit Settings, or pass the framework name directly when running an audit:
Automated AST-Verified Code Fixing
How Nadhi Audit fixes vulnerabilities safely on an isolated branch with compiler and judge verification.
Multi-Strategy Remediation Loop
When you run /fix or full_audit_fix_and_push, Nadhi Audit executes a LangGraph state machine with 3 progressive repair strategies:
- ✓Pre-Fix False Positive Filter: Local model evaluates finding context. Skips test fixtures, mocks, and protocol requirements.
- ✓Strategy 1 (Direct Find/Replace): Precise line replacement with line-prefix normalization.
- ✓Strategy 2 (Contextual Block Repair): Expands context window and injects compiler feedback to prevent repeating syntax mistakes.
- ✓Strategy 3 (AST / ReAct Graph): Scoped function-level AST transformation.
Compiler & AST Syntax Gate
Before any code edit is kept, Nadhi Audit re-parses and tests the patched file using language interpreters in check-only mode:
LLM-as-a-Judge Review
The local model compares the original and patched diff. It validates that the vulnerability is removed, program semantics are preserved, and no undefined variables were introduced. Clean edits are committed to the isolated nadhi branch with DCO sign-offs.
Executive Audit Reports (PDF)
Generate formal compliance reports with findings, evidence lines, and methodology.
Report Structure
Every audit generates a markdown summary in the workspace and an executive PDF document containing:
- ✓Report ID and timestamp for audit reproducibility.
- ✓Target repository path and exact files scanned.
- ✓Severity breakdown: Critical, High, Medium, Low.
- ✓Citable clause mappings (e.g. OWASP A01:2021, DPDP Sec 8(5), HIPAA §164.312).
- ✓Evidence quotes citing exact file and line numbers.
- ✓Assessor review and approval sign-off block.
Report File Location
Reports are stored in your selected workspace folder under: ~/Desktop/Nadhi-Audit/<repo-name>/security-audit-report-*.pdf
Self-Hosted Ollama Support
Route inference to a central GPU workstation or private server on your local network.
Connecting to a LAN Ollama Server
To use a central server instead of your Mac local model, open Settings in Nadhi Audit and configure:
Airgapped Integrity
In Ollama mode, network egress remains strictly blocked from public internet. Traffic only flows over private RFC1918 loopback and local network addresses.