DWG NO. HC-0.5.0 CLI REV. 0.2.0 SCALE LOCAL = CLOUD LICENSE PolyForm Noncommercial 1.0 TELEMETRY ANONYMOUS, OPT-OUT

Your code doesn’t
leave the building.

Heap Code is a model-agnostic AI coding assistant for VS Code and your terminal — chat, completions, inline edit, an autonomous agent, and AI PR review. Point it at Ollama on your own machine, or bring your own key to OpenAI, Groq, or any OpenAI-compatible endpoint. No account. No proprietary backend.

Install from Marketplace → Install the CLI → Source

Extension v0.5.0 · CLI v0.2.0 · free for personal, internal & noncommercial use

Diagram of where your code travels depending on local or cloud mode YOUR MACHINE VS Code Heap Code Ollama / LM Studio OpenAI / Groq / …

Local: prompts, completions, and embeddings run entirely inside the boundary above — nothing crosses the line.

New — the terminal CLI

heapcode — zsh
npm install -g @heaplabs/heapcode-cli
heapcode
 
> add rate limiting to the upload route
 
⏺ read_file src/routes/upload.ts
⏺ edit_file src/routes/upload.ts
⏺ run_tests pnpm test
✓ 48 passed
 
heapcode -p "fix the failing test" --json

Node.js 20+ · macOS, Linux, Windows · no account, no sign-in

  • Same engine as the extension. The agent, permissions, checkpoints, semantic search, and MCP support are shared code — not a reduced second implementation.
  • /pr-review reviews your branch's PR file by file, then posts a real GitHub review with inline comments and one-click suggestions — only after you approve it. /pr-review deep adds a verification pass that drops false positives first.
  • Headless mode. -p "task" runs the whole agent loop with no TTY — plain text or --json events, four permission modes for unattended runs, non-zero exit on failure. Built for CI.
  • Every action gated. Same permission prompts as the editor, plus shadow-git checkpoints you can rewind step by step.
  • Your models. Local Ollama or LM Studio, a box on your LAN, or any OpenAI-compatible endpoint — configured once, per role.

Spec sheet

Telemetry Anonymous usage events only (feature usage, error counts) — never code, prompts, or file contents/paths. Opt-out via a setting.
Account required No. No sign-in, no license server.
Model lock-in None — any OpenAI-compatible endpoint, switch providers per-role (chat / edit / apply / completion / agent / embeddings / rerank).
Local model support Yes — Ollama, LM Studio, vLLM, LocalAI.
Surfaces VS Code extension and a standalone terminal CLI (heapcode) — one shared engine, so behaviour matches.
API key storage Extension: OS keychain via VS Code SecretStorage. CLI: a chmod 600 file in ~/.heapcode — no keychain dependency, so headless and CI machines work. Never in settings files either way.
License / price Free for personal, internal, research, nonprofit, education, and government use (PolyForm Noncommercial 1.0).

Parts list — works with

Localruns on your machine

  • Ollama
  • LM Studio
  • vLLM
  • LocalAI

Cloudbring your own key

  • OpenAI
  • Azure OpenAI
  • OpenRouter
  • Groq
  • Together AI
  • NVIDIA NIM

Features

Chat

Streaming markdown, slash commands, @file/@selection/@workspace context, per-workspace history.

Completions

Ghost-text FIM tuned per model family, debounced and cancellable, repo-aware via the semantic index.

Inline edit

Select code, describe the change, review a native diff, accept from the title bar.

Agent mode

Reads, searches, edits, and runs commands autonomously — every action gated by permission prompts, one-click revert.

Semantic search

AST-aware chunking, hybrid embeddings + keyword search, degrades gracefully with no embedder configured.

MCP & tool interop

Register Model Context Protocol servers; other extensions' language-model tools show up in agent mode too.

Safety guardrails

Untrusted content — files, URLs, MCP output — is tagged and quarantined before it reaches the model; hallucinated package installs are checked against the registry and blocked automatically; and agent web fetches can't reach private, loopback, or cloud-metadata addresses, at any redirect hop.

Granular checkpoints

Every tool call gets its own shadow-git snapshot — rewind any single step, not just the whole turn or the whole session.

Modes & Plan/Act

Architect, Debug, and Reviewer personas restrict which tools the agent is even offered; an optional plan-then-approve gate holds every change until you say go.

Sub-agent delegation

Opt-in delegate_task hands a self-contained piece of work to an isolated sub-agent with its own context — never more permissive than the persona that spawned it.

AI PR review

Reviews a pull request file by file — never a truncated diff — then posts line-anchored comments with one-click suggestions via gh, after an explicit confirm. Deep mode adds a verification pass that drops false positives before you see them.

Terminal CLI

npm i -g @heaplabs/heapcode-cli — the same agent, permissions, and checkpoints in your terminal, plus a headless -p mode with JSON output for CI.

Team bundles

Export or import a project's memory, instructions, and skills as a single file, so a team shares one setup.

Local audit dashboard

See exactly what ran, what was approved or denied, and what got reverted — computed entirely on your machine, nothing sent anywhere to produce it.