SnapTrace — Local egress audit for AI coding tools

Audit what your AI coding assistant actually sends to the cloud, with a report your team can review

Problem

Zhipu's ZCode was caught packaging and uploading the entire workspace — including git history — before every prompt, even after users explicitly turned the relevant settings off. One user only confirmed they were hit after decompiling app.asar, finding that the RSA key was server-issued and that an analytics domain was being null-routed by their router. The community is angry, but the deeper fear is that companies will simply ban AI tools outright.

Solution

A fully local self-audit tool: it inventories installed AI coding tools (IDE extensions, CLIs, desktop apps), analyzes their endpoints, update channels, and binary strings, simulates a workspace action while capturing outbound connection domains on the machine, and produces a readable report of what data may leave the device — with one-click blocking suggestions for hosts/firewall. Nothing is uploaded, and the report can be exported for security or compliance colleagues.

Users

Developers, security engineers, and IT managers in regulated or IP-sensitive environments who use AI coding tools

MVP

Inventory and config parsing for mainstream AI coding tools; capture outbound connections and map them to processes; a fingerprint library of known telemetry/upload endpoints; an exportable local HTML report; one-click hosts blocking recommendations

Revenue

One-time purchase for individuals; per-seat annual subscription for teams (includes endpoint fingerprint updates and compliance report templates); bundle with security training or consulting

Why now

Default-on uploads and settings that don't actually disable anything keep surfacing, cracking the trust gap wide open — and vendors won't build the third-party audit of themselves. The tool is purely local, needs no license, and a solo developer can ship a usable version in one to two weeks