All signal. No feed.
4DA knows every dependency on your machine and tells you — and your coding agent — what changed and exactly what to run. Privately, locally.
It reads npm, pnpm, Yarn, Bun, Cargo, Python and Go lockfiles today, with early support for Ruby and PHP; Maven, Gradle and .NET projects are not covered yet.
It reads the lockfiles across all your projects, checks the exact installed versions against OSV advisories and registry releases, and names the fix: the version that clears each advisory and, where the lockfile shows it, whether a lockfile refresh is enough or which parent package to upgrade. No account, and your source code never leaves the machine.
- Version-confirmed findings. An advisory counts only when the version in your lockfile falls inside its affected range. Dev-only and transitive copies are labelled as such, and a crate your build never compiles on this host is marked as unreachable rather than raised as urgent.
- The fix, not just the alert. Each finding carries the version that clears it (per release line, where a fix exists). The Upgrade Plan orders the work across projects and says when a transitive copy needs its parent upgraded instead.
- The Brief. One answer to "anything I need to do today?", grounded in those same facts.
- Your coding agent sees it too. The free, Apache-2.0 MCP server gives Claude Code, Cursor and other MCP hosts the same lockfile-grounded answers: what an upgrade changes, which of your files import the package, which vulnerabilities a bump fixes.
4DA also reads developer news (Hacker News, Reddit, RSS and 20+ other sources) and score it against your stack. That reading is a supporting extra that serves the engine, not the product; the scoring section below explains how it works.
The fastest way to try it
Already using Claude Code, Cursor, or Windsurf? One command:
npx @4da/mcp-server
This scans your project, detects your stack, and gives your AI assistant live vulnerability scanning, dependency health, upgrade planning, and ecosystem intelligence. No API keys. No accounts. Works standalone — no desktop app required. Full MCP documentation.
How It Works
Scoring
This section covers the news reading: articles, releases and discussions from 20+ sources, scored against what you actually build. Dependency findings above do not go through it; they come from your lockfiles and the advisory databases.
Benchmarked across 9 developer personas against a 245-item labeled corpus (1,997 scored evaluations): 93% of content is rejected, and 98.9% of labeled noise is correctly rejected. You can reproduce these figures in one command. When the engine improves, it re-judges everything it already holds: yesterday's noise becomes tomorrow's signal.
Four axes score each item today, with a fifth reserved. An item must pass 2 or more to surface. Single-axis matches are hard-capped at 28% — no matter how strong one signal is, it cannot pass alone.
| Axis | What it measures |
|---|
| Context | Semantic similarity to your active codebase |
| Interest | Alignment with your declared topics |
| ACE | Real-time signals from your Git commits and file edits |
| Dependency | Direct matches against your installed packages |
| Learned | Reserved — held out of scoring until it can be validated against your explicit feedback |
What passes the gate goes through 12 quality multipliers: content depth, novelty detection, competing tech penalties, title-body coherence, and intent scoring from recent work. Every constant is calibrated across 9 simulated developer personas with 245 labeled test items.
LLM Verification
After keyword scoring, an LLM layer verifies the top items against your full developer context — stack, dependency names, topics derived from your recent git activity (never the commit messages themselves), anti-technologies, and the titles of items you saved. Strict 1-5 rubric:
- 5 = MUST-READ: Security alert for YOUR dependency, breaking change YOU must act on
- 3 = WORTH KNOWING: Useful tool that fits YOUR exact stack
- 1 = NOISE: Mentions your tech but isn't actionable
This is where the gold surfaces — articles the keyword pipeline misses because there's no keyword overlap, but the LLM understands the conceptual relevance to your specific project.
You own the compute. Use Ollama for free local inference (fully private), or bring your own Anthropic/OpenAI key. 4DA never pays for your compute, never stores your keys remotely, never makes API calls you didn't configure.
Anti-Gaming
Content creators who learn the scoring algorithm still can't game it:
- Title-body coherence: titles must deliver on what they promise. Claim "React + Rust + Tauri" but only discuss React? Penalty.
- Keyword concentration: repeating "Rust" four times in a title hurts your score.
- Confirmation gate: keyword-stuffing hits one axis. Without matching the user's codebase, installed packages, AND recent work — the gate rejects it.
- Grounded scoring: relevance keys on your actual dependency graph and stack — not popularity, not engagement. There is no behavioural signal to farm; content scores only when it matters to what you actually build.
No algorithm can be gamed when the scoring signal comes from your local filesystem. Your Cargo.lock doesn't lie.
Privacy & Trust
4DA is local-first and direct-to-provider. It has no analytics, no telemetry, no crash reporting and no user accounts, and 4DA runs no server that receives your projects, scores or reading. Your indexed content, scores, and intelligence live in a SQLite database on your machine. Your source code and file contents never leave it (one opt-in exception, cloud embeddings, is described in NETWORK.md §2a).
Outbound traffic, in summary:
| Category | Where | What it receives |
|---|
| Dependency checks | OSV.dev; npm, crates.io, PyPI and the Go module proxy | The package names and versions from your lockfiles (OSV.dev gets installed versions; registries get names). Go module paths are sent in full, so a private module path such as github.com/yourco/internal-svc names that repository. Never your code. |
| News sources | HN, GitHub, Reddit, arXiv, RSS and the others you enable | Plain requests for public content; Reddit and Stack Overflow see the subreddits and tags you follow |
| AI provider | Anthropic / OpenAI / any OpenAI-compatible endpoint, or local Ollama | Only if you set one up with your own key: item titles and snippets plus a short context profile (dependency names, project labels, git-derived topics, interests). File paths are replaced with project labels; source code and commit messages are never sent |
| Licence | Keygen (api.keygen.sh) and 4DA's own 4da.ai | Paid licences only: the key, to validate it and, for subscriptions, to renew it near expiry. 4da.ai also receives your email if you use "Recover License by Email" |
| Updater | GitHub Releases | A plain request for the update manifest, once per session; updates are minisign-verified |
| One-time downloads | Hugging Face, GitHub | The local search model, only when a feature first needs it (see System Requirements) |
| Crash reports | None | 4DA sends no crash reports. Export a scrubbed diagnostic bundle locally, on demand. |
NETWORK.md is the complete, source-referenced list, including the opt-in flows (cloud translation, digest email, GitHub release notes) and the local-only Signal Terminal port (127.0.0.1:4446). On Windows, the Microsoft WebView2 runtime that draws the window also contacts Microsoft on its own; NETWORK.md §5 explains what it is and how to limit it.
Don't take our word for it:
Download
Pre-built binaries — no Rust toolchain required.
Every release publishes SHASUMS256.txt and per-file .sha256 sidecars. Verification instructions.
Windows users: the Windows installer is not yet code-signed, so SmartScreen shows "Windows protected your PC / Unknown publisher". Verify the SHA-256 against SHASUMS256.txt from the release first, then click More info → Run anyway. Full details.
Signing, per file: the macOS app is signed with an Apple Developer ID and notarized. The Windows installer is not Authenticode-signed (see above). The standalone 4da-cli-* binaries are not code-signed on any platform. Every installer and CLI binary is listed in SHASUMS256.txt; the Windows and Linux installers and the macOS update bundle also carry a minisign .sig from the 4DA release key (the .dmg and the CLI binaries do not). SECURITY.md has the full table.
Or install the MCP server for Claude Code / Cursor / Windsurf:
npx @4da/mcp-server
Build from Source
git clone https://github.com/4DA-Systems/4DA.git
cd 4DA
pnpm install
pnpm tauri dev # First build: 5-15 min. Dev server: localhost:4444.
Prerequisites: Rust 1.95.0 (pinned in rust-toolchain.toml), Node.js 22 (what CI uses; package.json requires at least 20), pnpm 10.34.6 (pinned by packageManager in package.json; corepack enable picks it up). Platform-specific: Windows needs VS Build Tools 2022 with C++ workload. Full build guide.
First-run setup (API keys, context dirs, sources): Getting Started.
System Requirements
4DA runs on modest hardware. The dependency engine needs no GPU, no API key and no model download. Private semantic search (for interests and natural-language search) runs on your machine too, after a one-time model download.
| Baseline (free) | + Cloud AI (BYOK) | + Local AI (offline) |
|---|
| RAM | 4 GB | 4 GB | 16 GB (8B model); 32 GB for 12–14B |
| CPU | any 64-bit | any 64-bit | 6–8 cores |
| GPU | not needed | not needed | optional (recommended for speed) |
| Disk | several GB (grows with use) | several GB (grows with use) | + 5–9 GB per model |
| Network | advisory, registry and news checks (offline: cached data) | the same + your AI provider | the same + one model download (or none with Ollama) |
- OS: Windows 10 (1803+) / 11, macOS 10.15+, Ubuntu 22.04+ (WebKitGTK 4.1).
- One installer. Up to v1.0.3 it included the local search model (nomic-embed-text v1.5, fp16 ONNX), which is most of its ~280–390 MB. From the next release the model (~262 MB, pinned by SHA-256) is downloaded once from Hugging Face, only when you first turn on an interest, run a natural-language search or press Download in Settings → Intelligence; the dependency engine never needs it. Without it, scoring and search fall back to Ollama or keyword matching (NETWORK.md §3).
- Disk use grows with your corpus. An active install's database reaches a couple of GB and grows by tens of MB a day; each schema migration keeps up to 2 full database backups; caches and models add about 1 GB more. Plan for several GB. The data-retention setting (default 30 days, adjustable 7–365) bounds how long items are kept.
- Baseline = the dependency engine plus private on-device semantic search. Cloud AI adds AI-written briefings + deeper reranking via your own API key. Local AI runs everything offline (Ollama or a downloaded model).
Architecture
Your Codebase External Sources
| |
v v
+-----------+ +--------------+
| ACE | | 20+ Source |
| Scanner + | | Adapters |
| Git Watch | | (background) |
+-----+-----+ +------+-------+
| |
v v
+------------------------------------------+
| News scoring: 4 axes (+1 reserved) |
| |
| context --+ |
| interest --+- confirmation gate (2+) |
| ace -------+ |
| dependency-+ x quality x novelty |
| learned ---+ x domain x intent |
+------------------+-----------------------+
|
v
+-----------------+
| What survived |
+-----------------+
| Layer | Technology |
|---|
| App Shell | Tauri 2.0 (Rust backend + WebView) |
| Frontend | React 19 + TypeScript + Tailwind CSS v4 |
| Database | SQLite 3.45+ with sqlite-vec (vector search) |
| Scoring | Custom pipeline → build-time Rust codegen |
| Embeddings | nomic-embed-text v1.5 locally — ONNX model run in-process (fastembed, downloaded once on first use), or local Ollama when running; OpenAI only on explicit opt-in |
| LLM | Anthropic Claude / OpenAI / Ollama (BYOK) |
Pricing
Free — $0 forever. No credit card. No account. No expiration.
- Version-confirmed vulnerability findings for every project on your machine, each with the version that fixes it
- The daily Brief (AI-written with your own key or a local model, or built without one)
- The free, open MCP server (16 tools, including upgrade impact and upgrade planning) and the CLI
- News reading with the full scoring engine, natural language search (BYOK), Developer DNA, 30 days of history
Signal — $12 AUD/month, $99 AUD/year, or $299 AUD once for a Lifetime license (14-day free trial). Signal sells time saved on upgrades.
- The in-app Upgrade Plan: every fix across your projects in one ordered list, including which parent package to upgrade when a vulnerable copy is transitive
- The full Preemption worklist: AI-assessed findings and early-warning chains on top of the version-confirmed floor
- Full history instead of the last 30 days, plus watches (standing queries and package watches)
- Blind Spots with AI assessment and Knowledge Gaps, as supporting coverage views
Free is not a demo: every version-confirmed vulnerability and its fix is free, in the app and through the MCP server.
The STREETS Playbook — 7 modules on turning developer skills into independent income — is free on the open web. No download, no email.
Features
- Lockfile inventory across every project:
Cargo.lock, package-lock.json / npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock (classic and Berry), bun.lock, poetry.lock, uv.lock, pdm.lock, Pipfile.lock, requirements*.txt, go.mod/go.sum, plus early Gemfile.lock and composer.lock support. Bun's older binary bun.lockb is reported but not read; Maven, Gradle and NuGet files are reported as not covered
- Version-confirmed OSV matching, scoped by dev-only, transitive and per-platform reachability
- Fix targets per release line; the Upgrade Plan names a lockfile refresh or a parent upgrade where the lockfile proves it
- Install drift: flags a
node_modules that disagrees with its lockfile, with the install command to run
- Four scoring axes (a fifth reserved) with a multi-signal confirmation gate (93% rejection, 98.9% noise accuracy across 9 test personas — reproducible)
- Domain profile: graduated tech identity (primary stack → dependencies → detected → interests)
- Content DNA: classifies content type (security advisory, release, tutorial, hiring, etc.)
- Novelty detection: demotes introductory content, boosts new releases and security advisories
- Role-aware scoring: security engineers see security content prominently; experience level adjusts tutorial/depth balance
- Intent scoring: recent Git/file activity influences what surfaces
- Knowledge gap detection: finds blind spots in your dependency understanding
- Anti-gaming: title-body coherence, keyword concentration, adversarial resistance built into the pipeline
- Hacker News, GitHub, Reddit, YouTube, arXiv, Stack Overflow
- Lobsters, DEV.to, Product Hunt, Twitter/X, Bluesky, Hugging Face
- Papers with Code, crates.io, npm, PyPI, Go modules
- CVE/OSV vulnerability databases, custom RSS feeds
- Signal chains: tracks evolving stories across sources
- Reverse mentions: finds where your projects are discussed
- Record and query architectural decisions across sessions
- Tech radar: adoption signals from decisions + content trends
- Decision enforcement: AI agents check alignment before suggesting changes
- Cross-session, cross-agent persistent memory
- Session briefs: tailored startup context for any AI tool
- Delegation scoring: should the agent proceed or ask you?
- Developer DNA: exportable tech identity profile (markdown, SVG, or shareable card)
Plug your intelligence system directly into Claude Code, Cursor, Windsurf, VS Code (Copilot), or any MCP-compatible tool.
npx @4da/mcp-server
11 tools work standalone with zero setup (upgrade impact, pre-install dependency checks, vulnerability scanning, dependency health, upgrade planning, ecosystem news, pre-task briefings, project context, decision memory, alignment checking, agent memory). 5 more activate with the desktop app (scored content feed, actionable signals, knowledge gaps, feedback learning, developer DNA). Full tool reference.
Reads from the same database as the desktop app. No extra setup.
4da briefing # Latest AI briefing
4da signals # All classified signals
4da signals --critical # Critical/high priority only
4da gaps # Knowledge gaps in your dependencies
4da health # Project dependency health
4da status # Database stats
Screenshots
Development
4DA is built by a solo engineer with AI-assisted development (Claude Code), with external audits from gpt 5.4 and 5.5. The test suite (3,400+ tests across Rust and TypeScript) and CI pipeline verify correctness on every commit. The scoring algorithm is hand-designed and benchmarked against 9 developer personas with labeled test data.
pnpm tauri dev # Dev server (localhost:4444)
cargo test # Rust tests (from src-tauri/)
pnpm test # Frontend tests
pnpm validate:all # Full validation (lint + types + tests + build)
Benchmarks
The scoring numbers in this README are measured, not asserted — run the suite and check them yourself. The persona simulation scores a 245-item labeled corpus against 9 simulated developer personas (Rust systems, Python ML, fullstack TypeScript, DevOps/SRE, mobile, bootstrap/first-run, power user, stack switcher, niche specialist), skipping items labeled deliberately borderline, for 1,997 scored evaluations.
cd src-tauri
cargo test scoring::simulation -- --nocapture # 9-persona simulation (the headline numbers)
cargo test scoring::benchmark -- --nocapture # 2-profile pipeline benchmark
scoring::simulation prints a quality dashboard with the aggregate confusion matrix. On the current pipeline:
| Value |
|---|
| Corpus | 245 labeled items, 9 personas, 1,997 scored evaluations (2,205 pairs less the deliberately-borderline ones) |
| Confusion matrix | TP 119 · FP 19 · TN 1,646 · FN 213 |
Rejection rate (TN+FN)/total | 93.1% |
Noise accuracy TN/(TN+FP) | 98.9% |
Precision TP/(TP+FP) | 86.2% |
Recall TP/(TP+FN) | 35.8% |
Recall is low by design: roughly 70% of the "relevant" denominator is tangential/adjacency content a precision-first brief is meant to drop. The load-bearing figure is recall on items labeled strongly relevant — security advisories and releases for declared dependencies — which is 71.3% (72/101) and is reported separately by the same suite.
What CI enforces is a floor, not the headline. The suite asserts aggregate precision >= 0.70, aggregate F1 >= 0.40, and noise rejection >= 80% for every one of the 9 personas; a regression past any of those fails the build. The percentages above are the measured values on top of those floors, so re-run the command against whatever revision you have checked out rather than trusting this table.
Source: src-tauri/src/scoring/simulation/ (corpus, persona definitions, domain embeddings, enrichment data) and src-tauri/src/scoring/benchmark.rs.
License
FSL-1.1-Apache-2.0 — source available. Free to use, inspect, and modify for any purpose except building a competing product. Every release converts to Apache 2.0 three years after publication — after that, no restrictions at all.
4DA — 4 Dimensional Autonomy
All signal. No feed.
"4DA" and the 4DA logo are trademarks of 4DA Systems Pty Ltd (ACN 696 078 841).
The FSL-1.1-Apache-2.0 license does not grant rights to use these trademarks.
