Vector Docs

Features

Vector Local

From desktop 1.99.111: Vector Local is in the desktop app and the engine it starts. The terminal's vector local commands and vector run --local come with the next CLI release, and Windows WSL servers get Vector Local once a later desktop release requires that CLI.

Vector Local runs Vector's AI features on model servers you or your company host. With it on, model calls go only to the servers on your list, Vector blocks its own requests to vectordev.ai and to AI services that are not on the list unless you allow one, and a network log, What Vector sent, shows what Vector's engine and windows sent or blocked.

The agent, subagents, the judge, Vectorscope, Deep research, memory search and the helpers that write titles and summaries all use the servers on your list. Web pages and searches you approve still reach those sites unless you set Web access to None.

Vector Local is a policy inside Vector, not a firewall. A person with administrator rights on the computer can remove the policy or run another program. Pair Vector Local with your network controls.

Turning it on

In the desktop app, open Settings → Vector Local, or choose Models you host in Getting started for a setup that finds your servers, picks a model for each role, checks them and turns Vector Local on. While it is on, the composer shows Local, Local · your network or Local · no web; opening it shows what the session sent: its model calls by server, the pages and searches it read, the memory its requests carried and what was blocked.

In a terminal, vector local on turns it on and vector local status shows what is in effect. vector run --local keeps one run on Vector Local without changing your settings. vector local detect finds the model servers running on this computer, and vector local setup <address> reads a server you name, such as http://10.0.0.5:8000, and puts it on the list. vector local check checks every layer, as Run a check does in the app. In the terminal UI, /local opens the same settings.

Ask
Research and the browser can read the sites you approve.
Your network only
Only your network and sites your company lists.
None
Vector makes no internet requests. Deep research uses your brain and files.

A change that would loosen Vector Local (turning it off, a looser Web access, a new model server or a newly allowed service) waits for you to confirm it, so an agent cannot loosen it for you: This change would loosen Vector Local. Apply it? A Vector that an agent or Vector's own terminal started cannot loosen it at all.

Model servers

Find servers asks this computer for Ollama, LM Studio, vLLM, llama.cpp and SGLang on their usual ports. It never scans your network: add a server elsewhere by typing its address in Add server. Vector reads the server and keeps its identity: the kind of server, its version, the models it serves and, over https, its key. It reads the server again before its first model call, and a server that answers as a different one is held until you confirm it: gpu-box:8000 now answers as a different server. Check it before sending prompts. Updating the server or changing its models counts as a change too, so confirm it after an update or an ollama pull. Each server on the list says where it is and what Vector can tell about it:

  • Not encryptedPrompts to this server travel in plain text on your network.
  • ForwardingThis server may pass your prompts or queries on to services it is set up to use, as a LiteLLM proxy or Ollama's cloud models do. Vector can't see past it.
  • This computerAnother user on this computer could run a server on this port.

Check models sends each model two or three requests for every role it fills, with that role's real tools, and only when you press it. It finds whether the model calls tools and how much context it was loaded with, and sets the reply limit and how many requests the server takes at once. A server whose count nobody set takes one request at a time, and the titles and summaries Vector writes wait behind your own requests. A role whose model has too small a context is refused with the fix: qwen3-coder:30b has an 8,192-token context. Vector's agent needs about 19,000. Raise the context size or pick another model.

Models on this computer, or on a server on your network that is on your list, have no per-token price in Vector. Your hardware and power costs are not counted. Step and loop limits still apply. A server on the internet, a server that passes requests on and Ollama's cloud models stay unpriced, so a dollar cap still stops them. Fast is not offered for a model on a server someone hosts.

Off in Vector Local

Free models provided by Vector and Vector Codium send prompts through vectordev.ai to the services that run them, so they are off in Vector Local, along with cloud providers, Ollama's cloud models, ChatGPT sign-in, share links, automatic update checks, usage counts, crash reports, release notes and the help assistant. Vector does not start Claude Code, Codex or Cursor as outside agents while it is on, because they make their own connections. Each shows Off in Vector Local with why, and Settings → Vector Local lists them all. Where a service can be allowed, such as GitHub pull requests or a remote MCP server, Allow there or vector local allow <source> --reason "…" allows it. A download Vector needs once, such as the memory-search model or a language server, asks first, and Check for updates asks each time.

On a desktop's first run, Vector holds its own startup requests until you sign in, connect a provider or turn Vector Local on: the model catalog's refresh, the lists of free models and plans, the sign-in options, release notes, the dictation model's preparation, the usage count and the update check.

What Vector Local does not cover

  • Sites you approveThey receive the requests you approved. That is the point of research.
  • Programs the agent startsShell commands, stdio MCP servers and language servers make their own connections. With Web access None, the shell sandbox blocks the agent's shell commands on macOS and Linux; MCP servers and language servers run outside it, and Windows has no such block.
  • Model servers that forward requestsA LiteLLM proxy and Ollama's cloud models can pass your prompts on to a cloud service. Vector labels the ones it can recognise.
  • Everything outside VectorThe operating system, other apps, and the DNS resolver for names Vector is allowed to look up.
  • It is a policy inside Vector, not a firewallA person with administrator rights on this computer can change it. Companies should pair it with network controls.

With Web access None, the agent's shell commands run in Vector's sandbox. On macOS they can reach servers on this computer only; on Linux, where the sandbox needs bubblewrap (the bwrap command), they reach no network at all, and without bubblewrap Vector does not run them. Either way they can write only in this repository, the working folder, temporary folders and package caches.

What Vector sent

While Vector Local is on, every request Vector decides is logged by origin, never with a path, a query, a header or a body. In the app it is the Network log in Settings → Vector Local, and vector local log lists it in a terminal (--blocked, --since 2h, --session). The log is kept for 30 days on this computer unless you or your company set another length. Chromium makes some connections itself, below the layer where Vector decides each request, such as name lookups for the hosts a page names; those are not in the log.

For companies

Your company's policy is a vector.json that Vector reads before anything else, from a place only an administrator can change. It overrides each person's own settings. A policy file a standard user could have written is left out, and Vector says so: Ignored a policy file that standard users can change. Environment variables can only make it stricter.

macOS
/Library/Application Support/vector/vector.json, owned by root with no group or world write, or a configuration profile for the ai.vector.managed domain delivered by your device management.
Linux
/etc/vector/vector.json, owned by root with no group or world write.
Windows
The Config value (REG_SZ, one line of JSON) under HKLM\SOFTWARE\Policies\Vector, or C:\ProgramData\vector\vector.json when the folder and the file are owned by Administrators or SYSTEM and no other account may change them.

A policy file Vector finds but cannot read or check keeps Vector Local on with Web access None until it is fixed. Vector Local reads the policy files again when they change; the macOS profile, the Windows policy key and the rest of the policy apply when Vector next starts.

Locking it

With "lock": true in the policy's local block, the company's block is the one that applies: Vector Local stays on, and the app and vector local show Set by your company. Ask your administrator to change it. A lock keeps local, share and autoupdate, and the top-level keys you list in locked_keys, such as model or small_model. Their values come from your policy alone: a person's own values for them and a repository's are left out, so a list in your policy replaces theirs rather than adding to it, and a key you lock without setting keeps its default. Changing one fails with ConfigLocked, and reading the config returns the locked keys as locked.

  • user_mayThe parts of local a person may still change: endpoints, allow, web_domains and web (Web access only to a stricter setting). Anyone may add sites to deny.
  • endpoint_domainsUnder a lock, a model server a person adds must be on their own network or match one of these patterns, such as *.corp.example.com. A name they list that says it is on their network, such as gpu.local, must resolve there; your own endpoints are reached wherever they resolve.
  • endpointsYour model servers. Only your policy may use a wildcard host (https://*.ml.corp.example.com) or an address range (10.0.0.0/8). A cloud AI service you list yourself, such as a private deployment, is allowed; Vector's own models never are.
  • log.retain_daysHow long the network log is kept. Under a lock, only your policy sets it, and only your policy erases the log.

Certificate authorities

local.ca.files names certificate files to trust besides the system's and Vector's own, for a network that inspects TLS. A relative path is read from the folder of the policy that names it. The desktop app and its engine add them to what every connection trusts; the terminal's Vector, which runs on Bun, sends them with its own requests and model calls, after the certificates it already trusts, so public sites keep working. Vector's windows use the system's certificate store, as browsers do, so install the authority there too. Programs Vector runs, such as git, use their own certificate settings. Vector reads the files when it starts, and the app offers to restart when they change. A person's own config may name certificate authorities as well: the desktop app trusts each only once its owner agrees, and the terminal's Vector uses only your policy's, so a person adds their own there with NODE_EXTRA_CA_CERTS.

Updates from your mirror

local.updates.url points the desktop app at your own update server: a generic feed that serves the same latest.yml, latest-mac.yml and latest-linux.yml files and installers as Vector's own, side by side at that address. Only where updates come from changes. Each download is still checked against the hash in those files, Windows still checks the installer's publisher, and macOS still checks the new app's signature and team. On Linux the hash is the only check, so the mirror must use https, and its address may not carry a user name, a password or a query. With Vector Local on, automatic update checks go to your mirror and nowhere else. The terminal's vector upgrade does not read the mirror yet. Setting "autoupdate": false stops the terminal's own automatic upgrades.

local.models_dir and local.catalog_path, for the memory-search and dictation model files and a model catalog of your own, are read in a later release.

Samples

A policy that keeps Vector Local on with your network only, lists your model servers, lets each person add servers under corp.example.com and make Web access stricter, and sets the model, a certificate authority and the update mirror:

{ "$schema": "https://vectordev.ai/config.json", "share": "disabled", "autoupdate": false, "model": "company/coder", "small_model": "company/small", "provider": { "company": { "npm": "@ai-sdk/openai-compatible", "name": "Company model servers", "options": { "baseURL": "https://llm.corp.example.com/v1" }, "models": { "coder": { "name": "Coder", "tool_call": true, "limit": { "context": 131072, "output": 8192 } }, "small": { "name": "Small", "tool_call": true, "limit": { "context": 32768, "output": 4096 } } } } }, "local": { "enabled": true, "lock": true, "web": "network", "endpoints": [ "https://llm.corp.example.com", "https://*.ml.corp.example.com" ], "user_may": ["endpoints", "web"], "endpoint_domains": ["*.corp.example.com"], "web_domains": { "allow": ["docs.corp.example.com"], "deny": [] }, "locked_keys": ["model", "small_model"], "ca": { "files": ["corp-root.pem"] }, "updates": { "url": "https://mirror.corp.example.com/vector/" }, "log": { "retain_days": 90 } } }

macOS. Deliver the same settings as a configuration profile through your device management (in Intune, as a custom configuration profile for macOS). Vector reads the profile's ai.vector.managed payload as it reads vector.json:

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadContent</key> <array> <dict> <key>PayloadType</key> <string>ai.vector.managed</string> <key>PayloadIdentifier</key> <string>com.example.vector.policy</string> <key>PayloadUUID</key> <string>8F2C4E6A-1B3D-4F5A-9C7E-2D4B6A8C0E1F</string> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadDisplayName</key> <string>Vector policy</string> <key>share</key> <string>disabled</string> <key>autoupdate</key> <false/> <key>model</key> <string>company/coder</string> <key>small_model</key> <string>company/small</string> <key>local</key> <dict> <key>enabled</key> <true/> <key>lock</key> <true/> <key>web</key> <string>network</string> <key>endpoints</key> <array> <string>https://llm.corp.example.com</string> <string>https://*.ml.corp.example.com</string> </array> <key>user_may</key> <array> <string>endpoints</string> <string>web</string> </array> <key>endpoint_domains</key> <array> <string>*.corp.example.com</string> </array> <key>web_domains</key> <dict> <key>allow</key> <array> <string>docs.corp.example.com</string> </array> <key>deny</key> <array/> </dict> <key>locked_keys</key> <array> <string>model</string> <string>small_model</string> </array> <key>ca</key> <dict> <key>files</key> <array> <string>corp-root.pem</string> </array> </dict> <key>updates</key> <dict> <key>url</key> <string>https://mirror.corp.example.com/vector/</string> </dict> <key>log</key> <dict> <key>retain_days</key> <integer>90</integer> </dict> </dict> </dict> </array> <key>PayloadDisplayName</key> <string>Vector</string> <key>PayloadDescription</key> <string>Vector Local and the settings your company sets for Vector.</string> <key>PayloadIdentifier</key> <string>com.example.vector</string> <key>PayloadType</key> <string>Configuration</string> <key>PayloadUUID</key> <string>3A5C7E9B-2D4F-4B6A-8E0C-1F3A5C7E9B2D</string> <key>PayloadVersion</key> <integer>1</integer> <key>PayloadScope</key> <string>System</string> </dict> </plist>

Windows, Group Policy. In a Group Policy Object, under Computer Configuration → Preferences → Windows Settings → Registry, add a registry item: action Update, hive HKEY_LOCAL_MACHINE, key path SOFTWARE\Policies\Vector, value name Config, type REG_SZ, and as its data the policy on one line, as plain JSON without comments. Keep the text ASCII; write other characters as \u escapes.

Windows, Intune. Add a PowerShell platform script that runs as the system, not with the signed-in user's credentials, and writes the value from your policy file:

$file = "\\fileserver\it\vector\vector.json" # One line: a policy file holds no line break inside its strings. $json = (Get-Content -Raw $file) -replace '\s*\r?\n\s*', '' $key = "HKLM:\SOFTWARE\Policies\Vector" New-Item -Path $key -Force | Out-Null Set-ItemProperty -Path $key -Name Config -Value $json -Type String

Linux. Install the file as /etc/vector/vector.json with your configuration management, owned by root and mode 0644.

WSL

An engine the desktop app starts in WSL gets the app's Vector Local as a floor: on, at least as strict a Web access, and the plain addresses of the model servers on the list. It is your own setting there, never a lock, and it carries no allowed services or sites, so put your policy in the distribution's /etc/vector/vector.json too; a wildcard or address-range entry applies only there. In WSL's default networking, a server on this computer is reached from the distribution at the Windows host's address, which Vector lists as well. Ollama on Windows listens on 127.0.0.1 only. Use WSL mirrored networking, or run Ollama inside WSL. Setting OLLAMA_HOST=0.0.0.0 exposes it to your whole network.