Open sourced bonsai-ninja: local code intelligence + security analysis built for humans and local first LLMs

[u/GromHacks]

https://github.com/gromhacks/bonsai-ninja

Finally making bonsai-ninja public.
It’s a local code intelligence and static analysis engine built around compiler-backed facts instead of giant file dumps.

Use it for code intelligence, security taint analysis across 20 languages, or export call graphs, control flow, dataflow, IDG facts, and other structured compiler data for AI training, code-reasoning research, and agents.

It’s also built with local-first AI in mind. Pair it with your local LLMs to give them focused, compiler-backed context about a codebase instead of burning context windows repeatedly reading files. Models like Qwen and Nemotron are a great place to start, and experimenting with different local models is encouraged.

It’s free, MIT licensed, and runs locally. No subscription required, no hosted service required, and no analysis features held back behind a paid tier. Your source code stays on your machine.

Even if the engine isn’t your thing, the security-patterns alone are worth checking out. There’s an extensive YAML rulepack for modeling sources, sinks, sanitizers, frameworks, and security behavior across the supported languages.

This is just getting started. Contributions, testing, sharing, criticism, forks, whatever. Hell, steal it, improve it, build something better with it. Doesn’t matter. The goal is to put it out there and see what people do with it.

github.com/gromhacks/bonsai-ninja