Local execution / For agencies and engineering teams
Test private applications.
Keep control of the work.
Run QA and security checks from a workstation or CI runner you control. Keep generated tests and evidence in your project, and use an AI provider your team has approved.
Plan your pilotNo NoryBot-hosted scanner or repository connection is required. AI features and licensing use external services, described below.
A practical fit for client work and private staging.
Evaluate the actual data flow against your client's requirements before enabling AI features. Local execution gives your team concrete choices about access, storage and sharing.
- Use your existing network access.
- Run from a machine that can already reach your authorized target. You do not need to make private staging accessible to a NoryBot cloud scanner.
- Keep a separate workspace for each client.
- Store configuration, generated tests, scan evidence and reports with the relevant project. Apply your own filesystem permissions, backups and retention rules.
- Hand over useful files.
- Deliver editable Cypress or Playwright tests and local HTML, JSON or Markdown reports. Clients can keep the generated test code in their own repositories.
- Adopt updates on your schedule.
- Pin a release in your pipeline and review changes before upgrading. There is no silent updater or required hosted dashboard.
What stays local. What connects out.
Use this boundary when reviewing NoryBot for an agency or enterprise pilot. This page describes the CLI; it is not an air-gapped deployment or a compliance certification.
Project files and evidence
Your workstation or CI storage
- Source analysis runs locally. Generated tests, SQLite evidence, scan history and reports are written to project or configured output paths. Decide how to protect, retain and share those files.
Browser and HTTP checks
The target you authorize
- Your runner sends requests to the application under test. Its network access and credentials determine what is reachable. Limit the target, paths and checks to the agreed scope.
QA generation and security AI
Your configured provider accounts
- QA sends selected page and test context; vision can include screenshots. Optional security triage and investigation send selected, redacted findings, code evidence or observations. QA and security providers can differ. Redaction is not a guarantee that context contains no sensitive data.
Knowledge and dependencies
Local guidance; optional external services
- Bundled security guidance works without an AI request. Optional semantic indexing sends indexed content to an embedding provider. Dependency audits send package metadata to registries; browser and package installation also downloads dependencies.
Purchases and Pro access
Polar
- Polar handles checkout, release downloads, licenses and device activations. Pro commands validate their entitlement online. Your provider keys are not NoryBot credits or a shared hosted inference account.
Questions from your security review.
Does our source code have to be uploaded to NoryBot?
NoryBot runs code checks on your machine or CI runner and writes reports locally. It does not require uploading your repository to a NoryBot-hosted scanning service. AI features do send selected context to your configured provider: QA generation uses page and test context, while optional security triage can include redacted findings and code evidence.
Can we test private staging environments?
Run NoryBot on a workstation or CI runner that already has authorized access to the target, including your organization's private network. You do not need to expose staging to a NoryBot-hosted scanner. Your runner still needs outbound access for enabled AI features, dependency audits and Pro license validation.
Is NoryBot completely offline or air-gapped?
No. Tests, evidence and bundled security guidance are stored locally, but AI generation uses your provider, dependency audits contact package registries, and Pro commands validate licenses with Polar online. Optional semantic indexing uses an external embedding provider. Local execution is not a zero-egress or air-gapped mode.
Can we keep our existing CI and choose when to update?
Yes. Generated Cypress and Playwright specs remain editable files in your repository. Install a specific release from your Polar purchase and upgrade deliberately. There is no required hosted dashboard or silent update. Pro includes two device activations; plan activation handling for ephemeral runners.