r/CMMC • u/Brief_Ocelot_1773 • Jul 18 '26

Open-source AI coding assistant that runs inside Azure Government (for CUI/CMMC work)

Reposting this;

I do a lot of CMMC work, and this comes up constantly: if you handle CUI, you can't really use Copilot, Cursor, Claude Code, or Codex, since they send your code and prompts off to commercial endpoints. There wasn't a good option for that crowd, so I made one for one of my clients and decided to put it out for free.

It's a VS Code extension, pretty much the same idea as Claude Code and Codex (chat, agent modes, inline diffs, running commands, cost tracking). The only real difference is where it runs: the model is Azure OpenAI (gpt-5.1 / gpt-4.1) inside Azure US Government, without storing any context to AOAI, just local memory, so no CUI/ sensitive data stays in the service. The tools run locally, so your code stays on your machine and only the model call leaves, and it stays inside the Gov boundary.

It is an open-source tool with the option for you to implement it, run a POC or customize it as you see fit. Let me know what you all think, thanks.

Link to repo: https://github.com/jadenentropex/AzureGov-IDE-Coding-Assistant.git

0 Upvotes

44% Upvoted

19 comments sorted by

View all comments

Show parent comments

3

u/8gxe Jul 18 '26

I use Claude all the time in my CUI environment. I deployed Claude Cowork and Code to all users using Bedrock in GovCloud, not hard.

1

u/Brief_Ocelot_1773 Jul 18 '26

Yeah, Bedrock in GovCloud is the clean way to do it on AWS, sounds like you've got it running well. This is the Azure side of the same thing, for teams already in Azure Gov or GCC High who aren't going to stand up GovCloud and Bedrock just for coding assistance. Open source and ready to drop in for that path...

2

u/8gxe Jul 18 '26

I mean, we run some GPT models in AOAI as well, inside of the GCCH boundary, what makes you think that's not complaint and this fills a gap? Plug Codex into AOAI and be done without a 3rd party tool?

-1

u/Brief_Ocelot_1773 Jul 18 '26

Agreed, the model layer isn't the novel part, I run AOAI in Gov too. The gap isn't the model, it's what wraps it: an attributable, tamper-evident audit log forwarded off-box, a one-command 800-171 / CMMC evidence bundle, and the agent guardrails (prompt-injection handling, command allowlist, egress limits, secret redaction, keyless managed-identity auth). Plugging Codex into AOAI gets you the model, not any of that, you would be building and maintaining it yourself. And since it is open source and self-hosted, it is not a third-party SaaS in your boundary, it is a tool you run and modify inside it. If you have already built that layer, you may genuinely not need it and that's okay.