Nimbus

Cross-service incident context in under 100 ms. Consent-gated automation. Your credentials never leave the machine.

A local-first, HITL-gated AI agent over your dev tools — it builds a private index of your work across 90+ services and answers questions and runs multi-step workflows entirely on your machine.

Install · Docs · Watch the 15-second cast · Architecture

---

Note

Nimbus is a headless Gateway + CLI (plus a VS Code extension and a browser web clipper). It runs on your machine and talks to ~90 cloud services through first-party MCP connectors. Nothing about your data — the index, your credentials, the audit log — leaves your box.

What it does

Three things, in one query:

• Incident response — PagerDuty alert → deploy → commit → author, correlated locally.
• CVE / code exposure — indexed code search across every connected repo, with no fan-out network calls.
• Data lineage — Tableau → Looker → dbt → Airflow → the renamed column.

Three load-bearing words

• local — the SQLite index, the Vault, and the audit log all live on your machine. The cloud is a connector, not the source of truth. Telemetry is opt-in and off by default ([telemetry] enabled = false).
• consent-gated — every destructive or outbound action is intercepted by a human-in-the-loop gate before it runs. It lives in the executor, not the prompt, so it can't be jailbroken away.
• MCP — Nimbus speaks the Model Context Protocol in both directions. As an MCP client it drives every connector as an MCP server (tools), and hosts any third-party server you register with nimbus connector add --mcp. As an MCP server, nimbus mcp-server --stdio exposes your local index to editor AIs through six read-only tools. The engine never calls a cloud API directly.

Quickstart

1. Install. No admin on macOS and Windows; the Linux .deb uses sudo.

macOS

# The keychain must be UNLOCKED. Nimbus never shows an authorization dialog (a
# background service could not answer one), so on a locked keychain it fails
# immediately and tells you what to run. Over SSH or in CI, give it its own
# keychain:  security create-keychain -p "" nimbus.keychain
#            security default-keychain -s nimbus.keychain
#            security unlock-keychain  -p "" nimbus.keychain

curl -fsSL https://github.com/nimbus-agent/Nimbus/releases/latest/download/install.sh | sh -s -- --yes
# then open a new shell:
nimbus --version

The installer picks Apple silicon or Intel from uname -m, verifies the release signature before it installs anything, and copies the binaries to ~/.local/bin.

Rather read the script before running it? Download the archive and run the copy inside it — same installer, no pipe:

# Apple silicon — for Intel, swap arm64 → x64.
curl -fsSL https://github.com/nimbus-agent/Nimbus/releases/latest/download/nimbus-headless-macos-arm64.tar.gz -o /tmp/nimbus.tar.gz
mkdir -p /tmp/nimbus && tar -xzf /tmp/nimbus.tar.gz -C /tmp/nimbus
less /tmp/nimbus/install.sh
/tmp/nimbus/install.sh

Linux

# Credentials live in the OS keystore, and the Gateway will not start without it:
sudo apt install libsecret-tools   # Debian/Ubuntu
# sudo dnf install libsecret       # Fedora/RHEL

curl -fsSL https://github.com/nimbus-agent/Nimbus/releases/latest/download/nimbus_amd64.deb -o /tmp/nimbus.deb
# apt, not `dpkg -i` — the package depends on bubblewrap and libcap2-bin,
# and dpkg will not install those for you.
sudo apt install /tmp/nimbus.deb
nimbus --version

Prefer no sudo? Two options, neither of which resolves the dependencies for you — the .deb above is the only path that does:

# x86-64 only; there is no published Linux arm64 build.
curl -fsSL https://github.com/nimbus-agent/Nimbus/releases/latest/download/install.sh | sh -s -- --yes
# then open a new shell:
nimbus --version

This installs to ~/.local/bin and updates your shell PATH. It warns if bubblewrap is missing rather than installing it — and the Gateway will not start without it (sudo apt install bubblewrap). The AppImage is the other no-sudo route: a portable single file.

Headless box — server, container, SSH session or WSL? libsecret also needs a D-Bus session and an unlocked keyring, which those machines usually lack. Run nimbus doctor; it names which piece is missing. Full recipe: Headless Linux.

Windows (PowerShell, no admin)

$url = "https://github.com/nimbus-agent/Nimbus/releases/latest/download/install.ps1"
& ([scriptblock]::Create((irm $url))) -Yes
# then open a new PowerShell window:
nimbus --version

Works on stock Windows PowerShell 5.1 as well as PowerShell 7. It is spelled & ([scriptblock]::Create(...)) rather than irm ... | iex because iex cannot pass -Yes to the script.

Rather read the script before running it? Download the archive and run the copy inside it — same installer, no pipe:

$url = "https://github.com/nimbus-agent/Nimbus/releases/latest/download/nimbus-headless-windows-x64.zip"
Invoke-WebRequest -Uri $url -OutFile "$env:TEMP\nimbus.zip"
Expand-Archive -Path "$env:TEMP\nimbus.zip" -DestinationPath "$env:TEMP\nimbus" -Force
notepad "$env:TEMP\nimbus\install.ps1"
& "$env:TEMP\nimbus\install.ps1"

Every release artefact is covered by a GPG-signed SHA-256 manifest (SHA256SUMS.asc, key 5A20457CCD8B53FFAA945240886ADA6B487CAB6E) — that manifest is the cross-platform integrity proof. Linux artefacts and the AppImage additionally ship an individual .asc sidecar; the macOS and Windows archives do not, so verify those against the manifest. The gateway and CLI binaries also carry GitHub build-provenance attestations. When it downloads a release, the installer runs the manifest check for you: it verifies SHA256SUMS.asc against a fingerprint pinned inside the script itself, refuses to install on a mismatched, expired or revoked key, then checks the downloaded archive against the manifest. If gpg is missing, or the signature file cannot be fetched, it installs on the checksum alone and says so — SIGNATURE NOT CHECKED — rather than letting a checksum pass read as a signature pass. To verify by hand instead, see Verify your download. Homebrew and Scoop taps are also available (see the install guide).

2. Index a repo you already have — no account, no token, no API key:

cd ~/code/your-project
nimbus init

nimbus init adds the repo to nimbus.toml with code indexing on, starts the gateway, and indexes it. It appends to your config — it never rewrites it, so your comments and existing settings survive (and it keeps a nimbus.toml.bak).

3. Trace a line's provenance — who wrote it, the PR, the ticket, the incident it responded to, and what breaks downstream:

nimbus why src/auth.ts:42

nimbus init prints a real file:line from your own repo to try first. This works with no credentials and no LLM configured.

Optional: add an LLM

Indexing, nimbus why, and the agent briefs all work with no LLM configured — briefs render deterministically. An LLM buys you two things: nimbus ask (natural-language queries), and prose synthesis that rewrites those briefs into more readable narrative.

It does not have to be a cloud one. Point Nimbus at a local model and nothing — not even prompts — leaves the machine:

# ~/.config/nimbus/nimbus.toml
[llm]
prefer_local = true
local_model  = "llama3.1"     # served by Ollama on http://127.0.0.1:11434

See Local & air-gapped LLM setup.

Optional: connect a cloud service

To correlate across GitHub, Jira, PagerDuty, Slack and ~90 others, add a connector. The fastest path is a token-based one like GitHub:

nimbus connector auth github --token <your_PAT>
nimbus connector sync github
nimbus ask "what PRs did I open in the last 7 days?"

(OAuth services — Google Drive, Gmail, Slack, … — use nimbus connector auth <service>, which opens your browser. See Connect a service.)

How it works

~90 cloud services ─▶ first-party MCP connectors ─▶ local SQLite index (+ embeddings)
                                                          │
                              your question ─▶ engine ─▶ HITL consent gate ─▶ action
                                                          │
                                       CLI · VS Code · web clipper · (desktop, coming)

A headless Bun Gateway maintains the private index and runs the agent; clients talk to it only over local JSON-RPC IPC. Credentials live in the OS keystore (DPAPI / Keychain / libsecret) — never in logs, config, or IPC. Full design: Architecture.

Connectors

90+ first-party MCP connectors across Google, Microsoft, GitHub/GitLab, Slack, Jira, Notion, plus observability, CI/CD, security/quality, feature-flags, GitOps, data/BI, deploy, finance, and support tools. Browse the full roster in the connector docs; building your own is covered in CONTRIBUTING.

Security & trust

• Human-in-the-loop consent on every outbound/destructive action (structural, not a prompt).
• No plaintext credentials — OS Vault only.
• Signed, reproducible releases — GPG manifests, SBOM (CycloneDX), build-provenance attestations.
• Audited — see the security model & disclosure policy.

Found a vulnerability? See SECURITY.md.

Community & contributing

• 💬 GitHub Discussions — questions, ideas, show-and-tell.
• 🧩 awesome-nimbus — connectors, recipes, extensions.
• 🛠️ CONTRIBUTING.md — good-first-issues, workflow, and the contributor walkthrough. PRs welcome.

License

Dual-licensed by design: AGPL-3.0 for the gateway, CLI, and MCP connectors; MIT for the separately-published @nimbus-dev/sdk and @nimbus-dev/client npm packages so extensions and integrations stay unencumbered.