> ## Documentation Index > Fetch the complete documentation index at: https://docs.devinenterprise.com/llms.txt > Use this file to discover all available pages before exploring further. # Air-Gapped Devin Desktop and CLI > Administrator overview of the air-gapped Devin Desktop and CLI: what Cognition provides, what you supply, how it authenticates, and which endpoints it uses. > [!NOTE] > > This documentation is for the federal deployments of Devin. [Back to Devin Docs](/get-started/devin-intro) The air-gapped build of Devin Desktop and the Devin CLI is designed for networks without internet access. Inference goes to model endpoints you host, access is controlled by a signed license file that is validated locally, and every event is written to a local audit log. This guide is for the administrator who installs, configures, and supports the product. It is organized as a runbook: each page covers one part of the deployment and ends with the error codes you may see and what to do about them. > [!NOTE] > > **Beta.** The air-gapped build is currently offered as a beta. The supported platforms are macOS (Apple silicon and Intel), Linux (x86\_64 and aarch64), and Windows (x64 and arm64). *** ## What the product is | Component | What it does | | - | - | | **Devin Desktop (air-gapped build)** | The desktop application, installed from the portal's air-gapped downloads page. It bundles the air-gapped Devin CLI as its agent and talks to it locally. It has no cloud login, no Cascade, and no automatic updates. | | **Devin CLI (air-gapped build)** | The terminal agent. Runs standalone in a shell (`devin`) or as the agent inside Desktop. Reads its model catalog from a models file you author and its entitlement from a license file you install. | The Desktop and the bundled CLI are built from the same release commit, so a single Desktop bundle is a complete, self-consistent install. ## Before you begin ### Provided by Cognition | Item | Where it is covered | | - | - | | Portal access with an active on-prem entitlement for your team, set up by your account team | [Install](/federal/air-gapped/install) | | The Desktop bundles (and the Desktop tunnel CLI) on the portal's air-gapped downloads page, with SHA-256 checksums | [Install](/federal/air-gapped/install), [Updates](/federal/air-gapped/updates) | | Signed license files, issued from the portal; the public keys that verify them are embedded in the binaries | [License](/federal/air-gapped/license) | ### You supply | Item | Where it is covered | | - | - | | A host running a supported platform, with the license file installed at `/etc/devin/license.devin-onprem-license` (Windows: `C:\ProgramData\Devin\license.devin-onprem-license`) or the path in `DEVIN_LICENSE_FILE` | [License](/federal/air-gapped/license) | | One or more OpenAI-compatible model endpoints inside your network, described in a models file at `/etc/devin/models.json` (Windows: `C:\ProgramData\Devin\models.json`) or the path in `DEVIN_MODELS_FILE` | [Models file](/federal/air-gapped/models-file) | | Optionally, an OIDC identity provider to require user login on top of the license | [SSO](/federal/air-gapped/sso) | | Optionally, a private CA bundle if your model endpoints or IdP use certificates not in the OS trust store | [Network and certificates](/federal/air-gapped/network-and-certificates) | ## Endpoints the product uses The air-gapped CLI and Desktop are configured entirely by files on the host. The endpoints they use are the ones you configure: * **Model endpoints** listed in your models file. There is no cloud model catalog: the model list, the model picker, and inference routing all come from that file. Endpoints must be `https://`; plain `http://` is accepted only for loopback hosts (`localhost`, `127.0.0.0/8`, `[::1]`), for example a vLLM or Ollama server on the same machine. * **Your identity provider**, if you enable SSO. The CLI reads the issuer's OIDC discovery document and uses its authorization, token, and JWKS endpoints. * **MCP servers** you configure locally, if any. * **The portal** (`windsurf.fedstart.com`), which an administrator reaches from a browser to download bundles and issue licenses. The audit log and the diagnostics report are written to local disk. `devin update` is disabled; new versions are installed from bundles you download from the portal (see [Updates](/federal/air-gapped/updates)). ## How access is controlled 1. **License** (always). At startup the CLI verifies the signature and validity window of the license file against public keys embedded in the binary. Without a valid license the CLI does not start; see [License](/federal/air-gapped/license). 2. **SSO** (optional). If you create an auth file that selects `"mode": "sso"`, each user must also sign in to your IdP with `devin auth login`. Login can be gated on membership in a required group, and a running session is re-validated against the cached token; see [SSO](/federal/air-gapped/sso). Both mechanisms are enforced by the CLI, so they apply identically to standalone terminal use and to the agent inside Desktop. ## Where to go next > **[Install](/federal/air-gapped/install)** > > Download from the portal, verify the download, install, and run the first health check. > **[Error codes](/federal/air-gapped/error-codes)** > > The complete `LIC`, `IDP`, `MDL`, `NET`, and `CFG` catalog with operator actions. > **[Troubleshooting](/federal/air-gapped/troubleshooting)** > > The `devin airgap doctor` runbook and what to send to support. > **[On-disk formats](/federal/air-gapped/on-disk-formats)** > > Configuration paths per OS and the audit-log JSONL schema for SIEM ingestion. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.