Built with open source
Painted Wolf Code wouldn’t be possible without Open Source Software. The projects below are the ones we bundle or lean on hardest and want to acknowledge.
The engine
Painted Wolf Code runs a local engine written in Go. It serves the host API, runs the agents, and does the reading and parsing.
- Go
The engine is written in Go — one static binary, no runtime to install.
- chi
Routes the local host API that the desktop app and the CLI both talk to.
- modernc.org/sqlite
SQLite compiled to pure Go, so session history is a real database with no cgo and no system library to match.
- go-tree-sitter
Binds Tree-sitter grammars for parsing source into syntax trees, which is how agents locate symbols instead of guessing at line numbers.
- MCP Go SDK
Speaks Model Context Protocol, so any MCP provider works as a tool source.
- pongo2
Renders the prompt and task templates that packs ship as plain text.
- gojq
Implements the built-in jq tool, so agents query JSON in-process instead of shelling out.
- yq
Decodes YAML for that same tool, so one query language covers both formats.
- Rod
Drives the headless browser behind web research.
- Chrome for Testing
The pinned headless shell web research runs pages in.
- enry
Identifies languages in a repository, which sets what a project gets by default.
- Bubble Tea
Charm's terminal UI framework, behind the log viewer `pw logs` opens.
- Chroma
Highlights source and captured output in that viewer.
- santhosh-tekuri/jsonschema
Validates tool arguments and pack manifests against their schemas before anything runs.
The local decision model
A small model on your Mac loads what each turn needs, prunes the rest, and reranks your code before your provider sees it. It runs in its own process, on your GPU, and answers only the engine.
- Laya
The foundation of Bialy: Convai Innovations' open decision model, on the multilingual mmBERT backbone. We tune our own heads on it. It gives calibrated answers in one forward pass and writes no text, so it can only choose among the options it is given.
- candle
Hugging Face's machine-learning framework for Rust. The engine's inference core started from laya-candle, a Rust port of Laya built on it.
- Tokenizers
Splits each request into tokens exactly the way the model was trained to read them.
Security scanning
Scanning runs locally, on your machine. These are the engines and third-party rule sets we bundle — our own rules build on top of them.
- Opengrep
The static analysis engine bundled with the app. Rules are patterns you can read, and it runs entirely on your machine.
- Gitleaks
Finds credentials in working trees and git history before they leave the machine.
- OSV-Scalibr
Inventories dependencies across ecosystems and matches them against known advisories.
- Kingfisher
MongoDB's secret detection rules, copied into the app and run alongside our own.
The desktop app
The desktop shell is Rust; the interface inside it is a web app that talks to the local engine and nothing else.
- Tauri
The desktop shell — a native window over the system webview, with the filesystem and shell reachable only through capabilities we declare.
- Wry
The webview layer Tauri renders into on each platform.
- Tokio
The async runtime the shell uses to talk to the engine without blocking the UI.
- Rustls
Terminates TLS in Rust rather than binding to a platform OpenSSL.
- Serde
Serializes everything crossing the boundary between the shell and the engine.
- Solid
The reactive framework the interface is built on — fine-grained updates, no virtual DOM diff on every token that streams in.
- CodeMirror
The editor — syntax, search, linting, and the diff view used for review.
- marked
Renders the Markdown that agents write back into chat.
- DOMPurify
Sanitizes that rendered Markdown, because model output is untrusted input like any other.
- Tailwind CSS
Styles the interface.
- Vite
Builds the interface into the static assets the app bundle carries.
- TypeScript
Types the interface, including the API client generated from our own OpenAPI spec.
This website
paintedwolf.ai is a static site. It ships no analytics and makes no third-party requests.
And everyone else
The full dependency tree runs to hundreds of projects. The complete list, with license text, is on our license page.