Skip to main content
This documentation is for the federal deployments of Devin. Back to Devin Docs
The air-gapped build of Devin Desktop and the Devin CLI is designed for networks without internet access. Inference goes to model endpoints you host, access is controlled by a signed license file that is validated locally, and every event is written to a local audit log. This guide is for the administrator who installs, configures, and supports the product. It is organized as a runbook: each page covers one part of the deployment and ends with the error codes you may see and what to do about them.
Beta. The air-gapped build is currently offered as a beta. The supported platforms are macOS (Apple silicon and Intel), Linux (x86_64 and aarch64), and Windows (x64 and arm64).

​
What the product is

The Desktop and the bundled CLI are built from the same release commit, so a single Desktop bundle is a complete, self-consistent install.

​
Before you begin

​
Provided by Cognition

​
You supply

​
Endpoints the product uses

The air-gapped CLI and Desktop are configured entirely by files on the host. The endpoints they use are the ones you configure:
  • Model endpoints listed in your models file. There is no cloud model catalog: the model list, the model picker, and inference routing all come from that file. Endpoints must be https://; plain http:// is accepted only for loopback hosts (localhost, 127.0.0.0/8, [::1]), for example a vLLM or Ollama server on the same machine.
  • Your identity provider, if you enable SSO. The CLI reads the issuer’s OIDC discovery document and uses its authorization, token, and JWKS endpoints.
  • MCP servers you configure locally, if any.
  • The portal (windsurf.fedstart.com), which an administrator reaches from a browser to download bundles and issue licenses.
The audit log and the diagnostics report are written to local disk. devin update is disabled; new versions are installed from bundles you download from the portal (see Updates).

​
How access is controlled

  1. License (always). At startup the CLI verifies the signature and validity window of the license file against public keys embedded in the binary. Without a valid license the CLI does not start; see License.
  2. SSO (optional). If you create an auth file that selects "mode": "sso", each user must also sign in to your IdP with devin auth login. Login can be gated on membership in a required group, and a running session is re-validated against the cached token; see SSO.
Both mechanisms are enforced by the CLI, so they apply identically to standalone terminal use and to the agent inside Desktop.

​
Where to go next

Install

Download from the portal, verify the download, install, and run the first health check.

Error codes

The complete LIC, IDP, MDL, NET, and CFG catalog with operator actions.

Troubleshooting

The devin airgap doctor runbook and what to send to support.

On-disk formats

Configuration paths per OS and the audit-log JSONL schema for SIEM ingestion.