What are air-gapped AI agents?
Air-gapped AI agents run in an environment with no connection to the public internet. The agent runtime, the tools it uses, and the language model itself all run inside the isolated network, so no prompt, document, or output can ever leave.
This is the strictest form of self-hosting, used in defense, critical infrastructure, finance, and any setting where "the data physically cannot leave" is a hard requirement.
Air-gapped vs. self-hosted
Section titled “Air-gapped vs. self-hosted”The two terms are related but not the same:
- Self-hosted is about ownership — you run the infrastructure, but it may still reach out to a cloud model API.
- Air-gapped is about isolation — the network has no path to the public internet, so even cloud APIs are unavailable.
Every air-gapped deployment is self-hosted; not every self-hosted deployment is air-gapped.
What an air-gapped deployment requires
Section titled “What an air-gapped deployment requires”- A local model runtime so inference never leaves the network. Cloud model APIs cannot be used.
- No mandatory phone-home anywhere in the stack — no telemetry, no license server, no update check that blocks startup.
- Offline installation — images and dependencies brought in deliberately rather than pulled at runtime.
The main trade-off is model choice: you are limited to what runs on your own hardware, rather than the frontier models behind cloud APIs.
In Pinchy
Section titled “In Pinchy”Pinchy can run fully offline. Paired with local models via Ollama, inference stays inside the network and no request ever reaches an external service. The license key is validated offline with no license server in the path, and the whole stack ships as a single Docker Compose deployment that can be installed without internet access. When isolation is not a requirement, the same instance can use cloud model APIs instead. See the Installation Guide and Set Up Local Ollama.