LeaseCheck, a new open-source submission for the Hacktoberfest Open-Source AI Challenge, tackles the notorious opacity of rental agreements by running entirely on the user's local machine. Developed by Phantom9869, the tool combines deterministic rule-based analysis with a lightweight Large Language Model (LLM) to highlight risky clauses without uploading sensitive personal data to the cloud. It represents a pragmatic shift in developer tooling: keeping the privacy of local execution while offering the readability of AI-assisted interpretation.

The Architecture: Rules First, AI Second

The core design decision separates detection from explanation. LeaseCheck uses 11 YAML-defined rules to scan for specific risky patterns, such as landlord entry without notice or automatic renewal traps. These rules are instant, repeatable, and auditable. Once a clause is flagged, the tool employs Gemma 3 4B, running locally via Ollama, to generate a two-sentence plain-English explanation. The developer explicitly notes that the model does not decide what is risky; it only translates the rule's finding for the user. On a Ryzen 7 7730U laptop with 16 GB of RAM and no dedicated GPU, the model achieved 12.6 to 13.9 tokens per second, proving that a 4B parameter model is sufficient for short, structured explanations.

Verifying Updates with The Update Framework

The most technically interesting aspect is the integration of The Update Framework (TUF) to manage rule pack updates. Since tenancy laws change, the rules must be updatable, but the developer avoids the common pitfall of trusting HTTPS alone. TUF splits trust across four roles—root, targets, snapshot, and timestamp—to prevent rollback, freeze, and impersonation attacks. The implementation uses python-tuf 7.0.1. When a malicious mirror attempts to serve altered rules or outdated signed versions, the client refuses the update with specific errors like LengthOrHashMismatchError or BadVersionNumberError. This ensures that even if the server is compromised, the tenant’s tool doesn’t quietly start ignoring critical lease clauses.

Privacy and Practical Limitations

The tool is built for tenants who are wary of pasting income details and ID numbers into third-party web apps. By running offline, LeaseCheck eliminates per-call API costs and data leakage risks. However, the project is honest about its current state: it has only been tested on a synthetic 11-clause lease, not real-world documents. The rules are a starter set and have not been verified against any specific jurisdiction’s laws. The interface, built with Streamlit and custom HTML/JS, provides a marked-up view with severity levels—Push back, Look closer, and Good to know—but the lack of legal verification means it remains an educational aid, not a legal counsel.

Key Takeaways

  • Local Execution: Runs on CPU via Ollama with Gemma 3 4B, ensuring no data leaves the device.
  • Deterministic Detection: Uses YAML rules for flagging clauses, avoiding LLM hallucinations in the detection phase.
  • Secure Updates: Implements TUF to verify rule pack integrity and freshness against rollback and freeze attacks.
  • Early Stage: Tested only on synthetic data; rules are not yet jurisdiction-specific or legally verified.

The Bottom Line

LeaseCheck is a compelling example of how to use small local models responsibly: let the code do the checking and the AI do the talking. The integration of TUF for rule updates is a sophisticated touch that solves a real problem in local-first software—how to trust changing data without trusting the server. While it needs real-world legal validation, the architecture is a solid blueprint for privacy-preserving developer tools.

Technical Stack

  • Backend: Python 3.10+, Streamlit
  • AI Model: Gemma 3 4B via Ollama
  • Security: python-tuf 7.0.1
  • Config: YAML for rule definitions
  • Frontend: Custom HTML/JS component for the review panel