Dependency Intelligence

All signal.
No feed.

4DA knows every dependency on your machine and tells you — and your coding agent — what changed and exactly what to run. Privately, locally.

It reads the lockfiles across all your projects, checks the exact installed versions against OSV advisories and registry releases, and names the fix: the version that clears each advisory, and whether a lockfile refresh is enough or which parent package to upgrade. No account, and your source code never leaves the machine.

npm, pnpm, Yarn, Bun, Cargo, Python and Go lockfiles today, with early Ruby and PHP support. Maven, Gradle and .NET are not covered yet.

In Claude Code, Cursor, or Windsurf?
npx @4da/mcp-server
Zero install. No keys, no account. Live vulnerability & dependency intel in your agent.
MCP setup →
Want the desktop app?
Download for Free
Windows · macOS · Linux · ~300 MB · auto-updates
Install guide →
Runs locally · Zero telemetry · BYOK · AI offline with Ollama
4DA Brief: each version-confirmed advisory in your projects, with the version that clears it and the command to run
Get started in about 60 seconds

Three steps to your first signal

01

Install

Run npx @4da/mcp-server, or download the app for your OS. No account and no API key to start.

Install guide →
02

Point it at your code

4DA finds the lockfiles in your projects and builds the inventory locally. Your source code stays on your machine; package names go to OSV.dev and the package registries.

Quickstart →
03

Read your Brief

Open the Brief tab — anything you need to do today, with the version that fixes it. Preemption holds the full worklist.

How it works →
Rust + Tauri 2.0 Lockfile-grounded OSV version-confirmed 16 MCP Tools No account

Every lockfile, every project

Finds Cargo.lock, package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, requirements.txt and go.mod across your projects. No manual configuration, no repository to connect.

Version-confirmed, then fixed

An advisory counts only when your installed version falls in its affected range. Each finding names the version that clears it, and the Upgrade Plan says when a parent package has to move instead.

Privacy by Architecture

Your code and indexed data stay on your machine; 4DA runs no server that receives your projects, scores or reading. Dependency checks send package names and versions to OSV.dev and the registries, never your code. BYOK for AI features (a cloud model sees only what you send it, with your key). Zero telemetry. AI fully offline with Ollama.

Pricing

Free means free. No expiration. No catch.

The free tier is a complete product. Most individual developers will never need more.

Free

$0 forever
No credit card. No account. No expiration.
  • Version-confirmed vulnerability findings for every local project
  • The version that fixes each one
  • The daily Brief (AI-written with your own key, or without one)
  • Open MCP server (16 tools): upgrade impact, upgrade planning, vulnerability scans
  • CLI binary
  • Developer news, scored against your stack
  • 30 days of history
  • Unlimited projects, unlimited use
Download Free

Signal

$12 /month
Or $99/year. Time saved on upgrades.
  • Everything in Free, plus:
  • The in-app Upgrade Plan: every fix across your projects, in order
  • The full Preemption worklist (AI-assessed findings, early-warning chains)
  • Full history, watches and standing queries
  • Blind Spots + AI assessment, Knowledge Gaps
  • Priority support
Subscribe to Signal

14-day free trial included. Download to start.

Download

Pre-built binaries with auto-updates. No Rust toolchain required.

Platform Format Auto-updates
Windows .exe installer (NSIS) Yes
macOS .dmg (Apple Silicon + Intel) Yes
Linux .AppImage / .deb Yes

Windows: the installer is not yet code-signed, so SmartScreen warns on first run. Check its SHA-256 against SHASUMS256.txt, then click "More info" then "Run anyway" — code signing is in progress.

How It Works

From lockfile to fix in four stages

Your Lockfiles
Cargo.lock, package-lock.json, pnpm-lock.yaml + more
→
Inventory
Exact installed versions, every project
→
Advisories + Registries
OSV ranges, new releases
→
The Fix
In the Brief, Preemption and your agent
A finding means your installed version is inside the advisory's affected range. Where a fix exists, it comes with the version that clears it.
news

Developer news, scored against your stack

4DA also reads Hacker News, Reddit, RSS and 20+ other sources and scores each item on four axes (Context, Interest, ACE, Dependency; a fifth, Learned, is reserved). An item needs two confirming signals to pass. Across 9 simulated developer personas, that gate rejected 93% of incoming content. How the scoring works →

privacy

Privacy First

Your indexed data stays on your machine; with BYOK, a cloud model sees only the snippets you send it. BYOK for Anthropic, OpenAI, or fully local with Ollama. Zero telemetry. Transparent cost tracking.

fix paths

What to run, not just what's wrong

Each finding names the version that clears it on each release line. The Upgrade Plan orders the work across projects, says when a transitive copy needs its parent upgraded, and says when a lockfile refresh is enough (where the lockfile records the requirement). When node_modules disagrees with the lockfile, 4DA names the install command to run.

learning

Learned Preferences

Saves and dismissals build a preference profile you can inspect, pin, or forget. Scoring stays grounded in your actual stack — and the whole corpus is re-judged as the engine improves.

MCP Integration

Your coding agent gets the same answers

4DA ships an MCP server with 16 tools, 11 of which work without the desktop app. Install it with one command and, before your agent bumps a dependency, it learns what changes between the version you run and the one you want, which of your files import it, and which vulnerabilities the move fixes — from your own lockfiles, not a guess.

Works with Claude Code, Cursor, and any MCP-compatible host. Apache-2.0 licensed. Always free.

Full MCP setup & the 16 tools → One-click Claude Desktop extension →
  • "What breaks if I upgrade axum to 0.8?"
  • "Scan my dependencies for vulnerabilities"
  • "What should I upgrade first, and to which version?"
  • "What should I know before I start this task?"
// Install -- one command
npx @4da/mcp-server

// Or add to claude_desktop_config.json
{
  "mcpServers": {
    "4da": {
      "command": "npx",
      "args": ["@4da/mcp-server"]
    }
  }
}
Trust

Built for developers who read the source

No trust-us claims. Verify everything yourself.

Read every outbound connection 4DA makes →

Free means free

No credit card. No account. No expiration. Every version-confirmed vulnerability and its fix, the daily Brief and the MCP server, forever. Signal features include a 14-day trial.

Source available

FSL-1.1-Apache-2.0 license. Read every line. Converts to Apache 2.0 after 3 years.

Data stays local

We cannot see your data because we never receive it. No 4DA cloud, no sync, no account. The app contacts us only for paid licences: the key, when a subscription renews, and your email, if you ask to recover a lost key. (If you use a cloud AI model, it talks to your chosen provider directly, with your key — not to us.)

Clean uninstall

Nothing of yours is stored in any 4DA cloud. Uninstalling removes the program; your data folder and the keys in your OS keychain stay until you delete them, and the Windows uninstaller offers to delete the data. What uninstalling leaves behind.

FAQ

Common questions

What is 4DA in one sentence?
4DA knows every dependency on your machine and tells you — and your coding agent — what changed and exactly what to run. Privately, locally. It reads npm, pnpm, Yarn, Bun, Cargo, Python and Go lockfiles today, with early support for Ruby and PHP; Maven, Gradle and .NET projects are not covered yet. It's a Tauri 2.0 desktop app plus a free MCP server for your coding agent.
How does it work?
It reads the lockfiles across all your projects, checks the exact installed versions against OSV advisories and registry releases, and names the fix: the version that clears each advisory and, where the lockfile shows it, whether a lockfile refresh is enough or which parent package to upgrade. No account, and your source code never leaves the machine — only package names go out, to OSV.dev and the package registries.
How is this different from Dependabot or npm audit?
Dependabot works per repository on GitHub, and npm audit covers one project in one ecosystem. 4DA runs on your machine and reads every project you have locally, across ecosystems, into one worklist. Each finding names the version that fixes it, and the same answers reach your coding agent through the MCP server before it touches a dependency.
Does 4DA read my source code?
The app reads lockfiles, manifests and Git metadata. The MCP server's upgrade impact tool also searches your project's files, locally, for imports of the package you are upgrading. Everything stays in local databases on your machine; no source code is uploaded anywhere.
Can I use it without any API keys?
Yes. Vulnerability findings, fix versions, the Brief and the MCP server all work without an API key. An AI-written Brief and natural language search are also free — just add an LLM provider: Ollama for fully local inference, or your own Anthropic or OpenAI key (BYOK).
What happens if I never pay?
Nothing changes. Every version-confirmed vulnerability finding and its fix version, the daily Brief, the MCP server with 16 tools and the CLI stay free, and the free tier never expires. Signal adds the in-app Upgrade Plan, the full worklist and full history, with a 14-day trial so you can evaluate before subscribing.
Does 4DA still read developer news?
Yes, as a supporting extra rather than the product. It reads Hacker News, Reddit, RSS and 20+ other sources and scores each item against your stack; an item needs two independent signals to pass. When the engine improves, it re-judges everything it already holds: yesterday's noise becomes tomorrow's signal.
How big is the download?
About 280–300 MB on Windows and macOS, and about 370 MB for the Linux AppImage. Most of that is the local embedding model, which ships inside the installer so semantic search works offline from the first run. 4DA is built with Tauri 2.0 (Rust), not Electron. Pre-built binaries with auto-updates for Windows, macOS, and Linux.
Is it open source?
Source available under FSL-1.1-Apache-2.0. You can read, audit, and self-host. The license converts to Apache 2.0 (full open source) after 3 years. The MCP server is Apache-2.0 licensed.

Stop guessing what changed.
Start knowing what to run.

Your lockfiles already know what you depend on. 4DA reads them.

Download 4DA -- Free
No account · No credit card · No telemetry · ~300 MB download

4DA surfaces the signal. STREETS teaches you to convert it into revenue. 7 modules, free on the open web — no download required.

Read the STREETS Playbook →

Questions? support@4da.ai