One click gets you the installer for your platform. The local embedding model ships inside it, so 4DA works fully offline on first run.
Prefer to verify first? All files, checksums & CLI binaries on GitHub →
npx @4da/mcp-server
This build is not code-signed, so SmartScreen will warn you and Windows cannot tell you who published it. That is a real gap, not a formality, and the only honest way to close it on your side is to check the hash below against the one in SHASUMS256.txt before you run it. Click More info → Run anyway once you have. Signed builds are in progress.
Every release ships SHASUMS256.txt and per-file .sha256 sidecars. Source-available under FSL-1.1-Apache-2.0 — you can also build from source.
Add your project folders. 4DA finds the lockfiles in them (npm, pnpm, Yarn, Bun, Cargo, Python, Go; early Ruby and PHP) and builds the inventory locally.
4DA checks the exact installed versions against OSV advisories and registry releases. No API key needed.
Open the Brief tab: anything you need to do today, with the version that fixes it. Preemption holds the full worklist. Quickstart →