How to Deploy a Self-Hosted AI Code Detector for Audits

Written by: Mark Hull, Co-Founder and CEO, Exceeds AI | Last updated: July 12, 2026

Key Takeaways

• Most open-source and heuristic AI code detectors stall around 20–25% accuracy and cannot answer which tool, model, or session produced specific lines.
• Watermarks and post-hoc classifiers break down on edited or hybrid code, so they do not meet audit or regulatory standards.
• Client-level capture through Git hooks creates authoritative, line-level provenance without sending code outside your firewall.
• Exceeds Ink uses per-tool checkpoint materializers and portable Git Notes attestations that support multi-tool environments and strict data-residency rules.
• Teams ready to move from probability scores to auditable records can book a demo with Exceeds AI and deploy trustworthy, self-hosted detection.

Read This First: Access, Tools, and Security

Confirm these prerequisites before you deploy a self-hosted AI code detector.

Repository access:

• Git repositories with commit access across the target engineering fleet
• Per-repo opt-in capability, avoiding any solution that requires global git config mutation
• GitHub stopped supporting Git Notes in 2014, and other hosting services like GitLab and Azure DevOps also provide no native visibility or support.

Target AI coding tools in scope:

• Identify which tools engineers actively use, such as Cursor, Claude Code, Codex (OpenAI), GitHub Copilot, or Windsurf.
• Expect a mix of tools across teams, because multi-tool environments are now standard.

Security review requirements:

• Confirm data residency constraints, such as US-only, EU-only, or air-gapped environments.
• Decide whether prompt content must be redacted before any persistence.
• Determine whether aggregate-only mode is required for the initial rollout.

Scope and time estimate: This implementation focuses on line-level provenance capture only. No source code is transmitted externally. A pilot rollout across 10–20 engineers usually completes within a single working day, with first provenance records visible within 60 minutes of hook installation.

Step-by-Step Tutorial

Phase 1: See Why Heuristics Break Before You Rely on Them

Teams often deploy a heuristic classifier and then treat its output as authoritative. Heuristic detection fails because programming languages have fewer degrees of freedom than prose, so human and AI implementations of the same algorithm converge and erase the statistical fingerprint.

Vendor benchmarks that claim detection rates above 90% usually rely on direct, unedited model outputs. These benchmarks do not reflect the edited or hybrid code that dominates real engineering work. Once a developer edits AI output, the statistical signal collapses.

Watermarks embed a signal at generation time and can outperform post-hoc classification in controlled settings. Editing, paraphrasing, or using non-cooperating models weakens or removes that signal, and watermarks only apply to text from watermark-enabled models. Neither approach can identify which tool, model, session, or interaction mode produced a specific line.

Callout — Common mistake: Teams sometimes treat a heuristic classifier’s probability score as a governance record. Probability scores support screening. They do not qualify as auditable provenance.

Phase 2: Measure False Positives in Your Current Detector

Run this diagnostic if your team already uses an open-source AI code detector from GitHub.

• Sample 50 commits from engineers who write code without AI assistance.
• Run the detector on those commits and record the false-positive rate.
• Sample 50 commits from engineers who use Claude Code or Cursor heavily and have confirmed AI usage.
• Compare detection rates against ground truth for both groups.

Standard boilerplate and simple configuration files carry little statistical signal, so detectors cannot reliably label them as AI-generated or human-written. In languages with strict syntax, a human and an AI can produce mathematically identical functions, which removes any distinguishable signal.

If your false-positive rate exceeds 10% on human-written code, the tool does not meet governance requirements. At that point, client-level capture becomes the necessary next step.

Phase 3: Capture Provenance on the Client with Git Hooks

Client-level capture records what actually happens on the engineer’s machine at the moment work is done. It tracks which tool was invoked, how long the session ran, which model was used, and how many tokens were spent. The system writes that record alongside the commit before the commit becomes reachable for push, which creates authoritative provenance.

Pro tips for Git hook integration:

• Use prepare-commit-msg and post-commit hooks for capture, and post-rewrite for rebase handling. This combination captures the commit after the message is set and keeps history rewrites consistent.
• Keep capture invocation per-repo, not global. Per-repo opt-in prevents a misconfigured hook from blocking commits across every repository.
• Run finalization in a spawned subprocess so git commit returns immediately. This approach keeps attribution work off the developer’s critical path and avoids noticeable latency.
• Avoid modifying commit messages. Treat the Git Note as the single source of provenance for each commit.
• Write attestations to refs/notes/exceeds-ink as structured JSON. Any Git client can then resolve them without proprietary tooling.

Exceeds Ink implements this architecture without a long-lived daemon, a PATH-shimmed git binary, or a global git config mutation. Its per-tool checkpoint materializers for Claude Code, Cursor, and Codex resolve edit evidence against the actual working tree at commit finalization, so multi-edit Cursor sessions retain human-typed lines and Claude Code rewrites receive accurate Claude attribution. See how Exceeds Ink handles multi-tool attribution in your environment.

Phase 4: Protect Data Residency and Sensitive Prompts

Watchouts for security and privacy:

• Prompt content is PII-adjacent. Prompts often contain internal system names, customer identifiers, or credentials. Require LLM-based prompt redaction before persisting prompts, because entropy-only redaction misses short tokens and prefixed PATs in URLs.
• Git Notes should store session references, not transcripts. Attestations work best when they reference a session hash instead of embedding verbatim prompt content in Git history, which replicates across forks and mirrors.
• Local-first capture is essential in regulated environments. Every event should land in a local database on the developer’s machine before any optional remote delivery. Capture should continue even if the collector goes offline.
• Self-host the ingest endpoint. The remote ingest URL must be configurable so telemetry routes only to infrastructure you control. Exceeds Ink supports this through a configurable remote_base_url, using the same binary, Git Notes, and dashboards entirely inside your perimeter.

GitLab’s 2026 AI Accountability Report lists missing code-origin tracking as a primary barrier to AI traceability, alongside difficulty distinguishing AI-generated code and fragmented toolchains.

Validation and Success Criteria

Validate your client-level capture deployment before expanding to additional teams.

Git Notes presence:

• Run git notes --ref=refs/notes/exceeds-ink show <commit-sha> on a recent commit from an engineer using a supported AI tool.
• Confirm the note contains structured JSON with tool, model, session, turn, interaction mode, and timestamp fields.
• Check that lines without confident attribution appear as unknown_lines instead of being forced into “human” or “AI.”

Per-tool attribution:

• Verify that commits from Claude Code sessions carry Claude Code attribution rather than a generic “AI” label.
• Confirm that Cursor agent-mode sessions are distinguished from Cursor ask-mode sessions through interaction-mode classification.
• Ensure that human-typed lines inside a Cursor session retain human attribution.

Consistency checks:

• Push a commit immediately after git commit and confirm that the Git Note appears on the remote before the push completes, which proves attribution is not racing the push.
• Confirm that global git config remains unchanged by running git config --global --list.
• Verify that no long-lived process runs between commits by checking ps aux | grep exceeds for persistent daemons.

Validate your deployment with Exceeds Ink and review real provenance examples.

Advanced Rollout, Governance, and Reporting

Scaling across teams: Roll out per-repo opt-in gradually. Start with teams that have the highest AI tool adoption and the clearest governance mandate. Use machine integration health signals, which report hook installation and adapter wiring without exposing prompt content, to track coverage across the fleet.

Governance policy integration: Structured JSON attestations in the repo plug directly into policy engines. You can block deploys when AI authorship exceeds a threshold in sensitive paths or require extra review when agent-mode produces more than a defined share of a diff. The Black Duck 2026 OSSRA report found license conflicts in 68% of audited codebases, up 12 points year over year, with AI coding assistants as a primary driver, which makes line-level provenance central to IP risk management.

Longitudinal outcome tracking: Provenance records create the base layer. Governance value grows when you correlate attestations with outcomes such as incident rates 30, 60, and 90 days after merge, rework rates, and test coverage trends on AI-attributed lines. Research on agentic AI systems shows that agents favor immediate task completion and often ignore long-term maintainability costs, which creates hidden technical debt. Longitudinal tracking exposes that debt before it turns into a production incident.

Compliance documentation: A usable provenance record for AI-generated changes must capture the governing specification version, model and provider, prompt or task description, the human who accepted the output, and the tests that passed. Exceeds Ink’s Git Notes schema records these fields at commit finalization, which produces documentation suitable for regulatory review without adding a separate workflow. Explore how Exceeds Ink supports compliance teams and auditors.

FAQ

What makes client-level capture different from post-hoc AI code classifiers?

Post-hoc classifiers analyze code after it is written and infer AI authorship from statistical patterns. They output probability scores, and their accuracy drops sharply on edited or hybrid content, which describes most real code. As explained in Phase 3, client-level capture records the actual tool interaction at the moment work is done and produces an authoritative attestation instead of a probability estimate, which makes it suitable for governance and audits.

Does self-hosted deployment require sending any source code outside the firewall?

No. Exceeds Ink captures all events locally first, writing every event to a SQLite database on the developer’s machine before any optional remote delivery. The remote ingest endpoint is configurable, so telemetry can stay within infrastructure you control. Git Notes attestations live in your repository and travel with it across forks and mirrors. No source code reaches Exceeds-hosted infrastructure unless you explicitly enable cloud delivery. For the highest-security environments, local-only mode keeps all data on the developer’s machine with no collector.

How does this approach handle engineers who use multiple AI tools in the same session or workday?

Per-tool checkpoint materializers support multi-tool environments by resolving edit evidence against the working tree at commit finalization for each tool independently. A commit that uses Cursor for scaffolding and Claude Code for a later rewrite carries attribution records for both tools, with each line mapped to the tool that produced it. Lines without confident attribution appear as unknown_lines instead of being silently assigned to AI or human authorship, which keeps governance decisions conservative.

What do security and compliance teams typically require before approving deployment?

Security and compliance teams usually ask for confirmation that no source code is stored permanently outside the perimeter, HMAC-signed ingest with revocable per-machine tokens, LLM-based prompt redaction before any prompt content is persisted, per-repo opt-in with no global git config mutation, and a self-host option for the ingest endpoint. Exceeds Ink satisfies these requirements by design. For regulated environments, aggregate-only mode, enabled through a single environment variable, keeps all prompt content off the wire while still providing tool inventory and spend data. Privacy operates across four configurable rungs, and teams within the same organization can run at different rungs.

How long does initial rollout take, and what does the first week of data show?

Hook installation and adapter wiring for a pilot team of 10–20 engineers usually completes within a single working day. First Git Notes attestations appear within minutes of the first post-installation commit. Within 60 minutes, per-tool attribution data becomes visible. Within four hours, historical analysis of prior commits is available for repositories where Ink was not present at commit time, although those historical records rely on commit metadata rather than full client-level capture. Real-time updates appear within about five minutes of new commits. The first week of data is enough to establish baseline AI authorship percentages by team, tool, and interaction mode.

Conclusion: Build Governance on Provenance, Not Guesses

The core decision for self-hosted AI code detection centers on architecture. You either observe what AI tools do on the engineer’s machine, or you infer authorship after the fact.

Heuristic classifiers and watermark-based detectors cannot meet production governance needs. They operate on edited, hybrid content, produce probability scores, and fail to answer the concrete questions that auditors, legal teams, and regulators now raise. Stronger governance, grounded in clear provenance and accountability for AI-generated code, closes much of the current AI accountability gap.

Client-level capture with per-tool checkpoint materialization delivers authoritative, line-level provenance inside your own infrastructure. Exceeds Ink implements this pattern without a long-lived daemon, a PATH-shimmed git binary, or global git config changes, and writes portable Git Notes attestations at refs/notes/exceeds-ink that live in your repository, travel with it, and remain readable by any Git client.

That attestation layer forms the foundation. Governance policies, longitudinal outcome tracking, IP risk management, and regulatory documentation all depend on whether that foundation is authoritative or merely probabilistic. Review a live deployment of Exceeds Ink and see authoritative provenance in action.