ThreatLens: the on-device AI model

ThreatLens: the on-device AI model

ThreatLens is Vooki Pro's AI analyst. It is a language model that runs entirely on your own machine and reviews findings during a scan.

What it does

  • Demotes likely false positives, so triage time goes on real issues.
  • Finds exposed secrets and personal data in responses that pattern-based rules miss, such as API keys, tokens and personal information.
  • Prioritises parameters and payloads, focusing the scan where it is most likely to find something.

Privacy

The model runs on your hardware. Requests, responses and findings are never sent to a remote AI service. The only time the model uses the network is its one-time download.

Download it

  1. Open Settings → AI Model.
  2. Click Download. The model is about 5 GB and is stored in ~/.vooki-pro/models/.
  3. If the download is interrupted, click Download again. It resumes where it stopped.
  4. When the status dot turns green, the model is ready.

Download it before your first scan. Until it is present, the tab shows Model not found — AI analysis disabled, and scans run on the rule-based checks alone, without AI triage.

Hardware

The model holds about 5 GB of RAM while a scan runs, which is why Vooki Pro needs a machine with at least 16 GB. If you run out of memory, close other heavy applications and make sure no earlier Vooki Pro instance is still running.

AI detection in a scan

On the Policy step of the scan wizard, the AI detection option lets the model look for exposed secrets and personal data. This option is experimental. In the CLI, the matching config key is "ai_detect": true. The standalone CLI package for build servers does not include the model.

Related: Install and activate Vooki Pro · Settings & AI model (docs)