JEBAT v8.4.0 — Sovereign Agent OS & Agent Workstation
Sovereign execution, private memory, and audited intelligence.
JEBAT is an enterprise-grade self-hosted AI platform and agent workstation. It provides governed local LLM inference, multi-agent orchestration, persistent memory, adaptive context windowing, observability, an MCP workspace server, and a full web interface. Run fully air-gapped on your private network with zero data leakage.
Named after the legendary Malay warrior Hang Jebat — loyal, powerful, and unforgettable.
Public Service
The public JEBAT service is available at jebat.online.
The public API and WebUI are production services. Configure provider credentials in your own deployment before sending requests that require model inference.
Quick Start
Option 1: npx (Recommended — Zero Install)
# First run: configure your LLM provider (one-time wizard)
npx @nusabyte/jebat init
# Interactive REPL
npx @nusabyte/jebat repl
# One-shot chat
npx @nusabyte/jebat chat "Explain the memory consolidation algorithm"
# Run agent task
npx @nusabyte/jebat agent "Audit all API endpoints in src/services"
# Generate code
npx @nusabyte/jebat code "Create a REST API with FastAPI"
# Launch WebUI
npx @nusabyte/jebat webui
# With bun
bunx @nusabyte/jebat repl
Requirements: Node.js >= 18, Python >= 3.11, pip
Option 2: Global Install (via npm)
# Installs the npx wrapper globally; first run bootstraps the Python core
npm install -g @nusabyte/jebat
jebat repl
The npm package is a thin launcher — on first run it downloads and runs the
bootstrap, which provisions Python, the venv, and the jebat launcher in
~/.local. Do not run pip install jebat — that name is a unrelated
package on PyPI (a website checker) and is not JEBAT. The bootstrap is the
only supported install path.
Option 3: Source Build
git clone https://github.com/nusabyte-my/jebat-core.git
cd jebat-core
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash # bootstrap the core CLI
jebat repl
Installation — Three Surfaces, One Script
JEBAT installs like Hermes: a single self-contained bootstrap that provisions
Python, the venv, the CLI launcher, and (optionally) the Desktop app and MCP
server. No sudo required — everything lands in ~/.local.
# Zero-install (downloads + runs the bootstrap). Uses the raw GitHub URL so it
# always serves the script as plaintext (no CDN/HTML fallback).
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash # CLI only
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --desktop
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --mcp
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --all
# Or pin a profile explicitly
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --cli --no-inference
# Agent / CI friendly: fully non-interactive
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --yes --quiet
# Emit a ready-to-paste MCP config for your IDE (no install needed)
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --print-mcp-config=cursor
What gets installed (components)
| Component | Surface | Purpose |
|---|
| JEBAT CLI | CLI / Desktop / MCP | jebat repl, chat, code, agent (core) |
| Python venv | all | Isolated runtime at ~/.local/jebat/venv (editable install) |
jebat launcher | all | Symlink on PATH (~/.local/bin/jebat) |
| DESIGNmd CLI | CLI companion | Standalone registry tool (designmd search/get/download/...) |
| MCP surface | MCP | IDE snippet prepped at ~/.local/jebat/mcp.ide.json (server ships with the full Jebat workspace) |
| Unified Inference Stack | CLI / Desktop | Ollama + llama.cpp + router + OpenWebUI (from the full Jebat workspace) |
| Desktop surface | Desktop | jebat desktop UI from the full Jebat workspace |
Note: This installer clones the public core CLI (jebat-core),
which exposes repl, chat, code, and agent. The design, mcp serve,
and desktop surfaces live in the full Jebat workspace (jebat-dev).
The installer still prepares their config (IDE snippet, Electron note) so
they activate the moment that code is present.
Surface quick-reference
# CLI — primary surface (core)
jebat repl # interactive REPL
jebat chat "hello" # one-shot
jebat code "refactor utils.py" # coding agent
jebat --help # full command list
# Default inference provider is seeded at install: JEBAT Online
# (OpenAI-compatible) → https://jebat.online/v1 [switch with /provider <id>]
# local Ollama (http://127.0.0.1:11434) is also registered, inactive by default
# DESIGNmd (companion tool, standalone)
designmd search "dark fintech" --limit 3 # browse the registry
designmd tags # list tags
# MCP — run from a full workspace checkout
# python ./jebat-mcp --transport stdio
# See MCP.md for IDE configuration and self-hosted HTTP deployment.
# Desktop — native workstation UI (full workspace)
jebat desktop # launch GUI
Local Unified Inference Stack (optional, --no-inference to skip)
The full Jebat workspace ships a local LLM layer so jebat can route to your
own hardware:
- llama.cpp (
llama-server) — CPU/AVX-512 + Intel Iris Xe (Vulkan)
- Ollama — local GGUF registry
- Router — one OpenAI-compatible endpoint at
http://127.0.0.1:8000/v1
that merges every backend and fans out by model/@backend/?backend=
- OpenWebUI — chat frontend at
http://127.0.0.1:8080, pointed at the router
- Remote vLLM / Ollama — offload big models to a GPU host
# from the full Jebat workspace checkout:
infra/inference/start.sh # boot the stack
# or as a user service:
systemctl --user start jebat-router.service
Remote Ollama Endpoint
JEBAT uses a remote Ollama instance hosted on a dedicated server with AMD EPYC 9354P (8 vCPU, 32GB RAM).
# Default endpoint (zero config)
# https://jebat.online/ollama
# Models available:
# - qwen2.5-coder:7b (4.7GB, fast coding)
# - qwen2.5:14b (9GB, general purpose)
# Test the endpoint
curl https://jebat.online/ollama/v1/models
# Use with JEBAT
jebat chat "Hello from jebat.online"
Configuration
# ~/.jebat/config.yaml
llm:
provider: ollama
model: qwen2.5-coder:7b
api_base: https://jebat.online/ollama # Default endpoint
Providers & Auth
JEBAT routes to 17 providers — OpenAI, Anthropic, Google Gemini, xAI, DeepSeek, Mistral, Groq, Cerebras, Together, OpenRouter, GitHub Models, Cloudflare, SambaNova, Novita, Z.AI, local Ollama, or any OpenAI-compatible endpoint. Add one interactively from the REPL:
jebat repl # then: /provider add
Auth method — key / env / store
Every keyed provider (Gemini, Anthropic, and any OpenAI-compatible) supports three ways to supply the API key. Choose at add time; the key is resolved at runtime via resolve_api_key().
| Method | How it works | Best for |
|---|
key | Paste the key inline (stored in ~/.jebat/jebat-cli-providers.json) | Quick local use |
env | Read from an env var at runtime (e.g. ANTHROPIC_API_KEY) | CI / shared machines — secret never hits disk |
store | Named key from the JEBAT auth store (~/.jebat/auth/tokens.json, set via /apikey) | Multiple / rotated keys |
env and store keep secrets out of the provider config — recommended for anything shared.
Models (refreshed catalog)
Defaults point at current models:
- OpenAI →
gpt-5 (+ gpt-5-mini / gpt-5-nano), gpt-4.1, o3, o4-mini
- Anthropic →
claude-opus-4-1 / claude-sonnet-4-1 / claude-haiku-4-5
- xAI →
grok-4 (+ grok-4-mini)
- Gemini →
gemini-2.5-pro / gemini-2.5-flash
- GitHub Models →
openai/gpt-5 (free tier with a GitHub token)
- Local Ollama →
qwen2.5:3b (avoids a 404 when a bigger model isn't pulled)
Local Ollama auto-start
When Ollama is the selected provider, JEBAT auto-starts ollama serve if it isn't running and auto-pulls the chosen model if it isn't pulled — no manual setup.
Default provider
Install seeds JEBAT Online (https://jebat.online/v1, OpenAI-compatible) as the active default; local Ollama is registered but inactive. Switch any time with /provider <id>.
Platform Suite — 5 Products, 1 Memory
JEBAT ships as a unified platform with 5 integrated products sharing a persistent memory layer and MCP protocol bus.
| Product | Codename | Description |
|---|
| JEBAT Core | — | The sovereign AI engine — REPL, chat, agent, memory, MCP |
| Sahabat | Companion | Memory keeper, briefing agent, meeting intelligence |
| Keris | Sentinel | Autonomous pentest orchestrator with AI analysis |
| Pandai | Developer | Skills, tools, code generation, developer suite |
| Perisai | Nexus | Multi-channel bot orchestrator (Telegram, Discord, Slack, etc.) |
WebUI — Stealth-Dark Tactical Interface
Launch the full web interface with real-time system metrics, product dashboards, and enterprise UX.
# Launch WebUI
python -m jebat.services.webui.launch
# → http://localhost:8787
# Or via CLI
jebat webui
WebUI Pages (13)
| Page | Description |
|---|
| Dashboard | System metrics (CPU/RAM/disk), product overview, recent scans |
| Chat | Universal AI chat with provider selection |
| Sahabat | Companion chat, drag-and-drop transcript upload |
| Keris | Security scan form, scan history, severity badges |
| Pandai | Skills browser, code tools |
| Perisai | Channel management, send/broadcast, channel stats |
| Control | Runtime control, provider config |
| Skills | Skill browser and management |
| Agents | Agent orchestration and status |
| Channels | Messaging channel configuration |
| Setup | Environment setup wizard |
| Settings | Provider selection, preferences, API reference |
WebUI Enterprise Features (25)
Backend:
- Rate limiting (120 req/min per IP)
- CORS tightened (localhost-only)
- CSP headers (Content-Security-Policy, X-Frame-Options, nosniff)
- Request ID tracking (X-Request-ID on every response)
- Audit trail (last 500 requests,
/api/audit)
- Error pages (404/429/500 styled)
- Health check (
/health)
- Session check (
/api/session/check)
Frontend:
- Loading progress bar
- Dark/Light theme toggle
- Clickable breadcrumb navigation
- Global search palette (Ctrl+K)
- Keyboard shortcuts overlay (?)
- Toast notification system
- Activity log drawer (Ctrl+L)
- Activity log export (JSON/CSV)
- Confirmation dialogs
- Session timeout (15 min inactivity)
- i18n (English/Bahasa Melayu)
- Copy-to-clipboard
- Focus trap (keyboard accessibility)
- Skeleton loading (shimmer)
- Reduced motion support (prefers-reduced-motion)
- Print-friendly CSS
- Drag-and-drop file upload
- Service worker (offline caching)
- PWA manifest (install as desktop app)
- Favicon + OG meta tags
- Responsive mobile sidebar
WebUI API Endpoints
GET /health Health check
GET /api/system/metrics CPU, memory, disk, uptime
GET /api/audit Audit trail (last N requests)
GET /api/session/check Session verification
GET /api/keris/history Scan history
POST /api/keris/scan Trigger pentest scan
GET /api/nexus/channels List channels
POST /api/nexus/send Send message
POST /api/nexus/broadcast Broadcast to all
GET /api/nexus/stats Channel statistics
GET /webui/api/status Provider/model status
POST /webui/api/chat Chat with AI
POST /webui/api/runtime Runtime control
Core Commands
General
| Command | Description |
|---|
jebat repl | Interactive REPL; resume with jebat --continue or jebat repl --session ID |
jebat chat "prompt" | One-shot chat without tools |
jebat agent "task" | Run one-shot agent with tool-calling |
jebat code "prompt" | Generate code from description |
jebat webui | Launch Stealth-Dark WebUI |
jebat status | Local provider, run, and session inventory; not a live health probe |
jebat doctor | Agentix registry/build/budget checks; not remote API or MCP health |
jebat init | First-run provider setup (REPL /init = workspace scan → AGENTS.md) |
jebat workflow list [--json] | List nine opt-in operator playbooks without model calls |
jebat workflow show NAME --task "objective" --scope . | Render shared CLI/MCP guidance; does not execute agents or tools |
jebat learning analyze|advise|dream|status|search|feedback | Scoped AutoMimpi/SelfLearn, cited advisor proposals, persistent KB reports, explicit reviewer feedback; no model calls |
Workspace & Config Import
| Command | Description |
|---|
jebat capture (alias agents) | Repo scan → generate AGENTS.md (backs up existing; stack, layout, entrypoints, tests) |
jebat config import -s omp|opencode|claude | Import MCP server config from another CLI — normalizes transports/timeouts/env templates; --dry-run, --only, --overwrite; auto-backup |
Current lifecycle, audit findings, quick wins, and isolated verification: Operating workflows.
Main-agent execution is the default. Necessary subagents must use the exact same provider/model, with no fallback substitution.
Agentix — Solution Lifecycle
| Command | Description |
|---|
jebat agentix create NAME -t reflex|flow|lattice | Scaffold an agent solution (ReAct loop / workspace-driven / schema-driven tools) |
jebat agentix create NAME --from security-audit | Create from a shipped specialist doctrine; discover the current catalog with jebat agentix templates |
jebat agentix build PATH | Validate + compile + content-addressed build manifest (.agentix/build.json) |
jebat agentix eval PATH [--live] | Structural checks + golden tasks (golden/*.json); llm-runtime tasks run against the real provider only with --live |
jebat agentix deploy PATH --target local|mcp|vps | Ship it: local registry, ready-to-paste MCP config, or scp to VPS — gated by deploy.allow in agentix.yaml |
jebat agentix run NAME|PATH "task" | Spawn the agent: runtime: llm solutions run the shared ReAct loop with the solution's doctrine, tool allowlist and workspace jail; code solutions execute run(task, ctx.tools) |
jebat agentix run NAME|PATH "task" --parallel 2|3 | Automatically split the task into independent slices and run up to three subagents concurrently. Planning and every worker inherit the exact selected provider/model; provider failures never trigger model substitution. |
jebat agentix ask "objective" | Type only an objective — routes to the best deployed solution (top-3 candidates shown when ambiguous) |
jebat agentix run NAME - < task.txt | Pipe a task via stdin (- reads the task) |
jebat agentix run NAME --resume RUN_ID "follow-up" | Continue a recorded run's conversation (every llm run is recorded) |
jebat agentix oneshot "task" --tools read_file,terminal | Ephemeral agent — no solution folder; transcript kept in the run registry |
jebat agentix runs | List recent runs (ids for --resume) |
jebat agentix doctor [--fix] | Health-check: dangling registry entries, stale builds, budget sanity, doctrine drift |
|
Specialists declare their own budgets (budget.tokens, budget.wall_clock) — the loop stops and summarizes when either is exhausted.
Configuration & Memory
| Command | Description |
|---|
jebat config import -s omp|opencode|claude | Import MCP server config from another CLI (transport/timeout/env normalization, --dry-run, --overwrite) |
jebat memory store|search|stats | 6-type eternal memory with Ghost DB vector search |
jebat llm providers|config|auth | LLM provider management |
jebat llm best-provider | Auto-detect best available provider |
Learning lifecycle and isolated checks: Learning advisor and KB. Advice and dream history reuse the existing SQLite/FTS5 wiki database; trace memory remains JSON-backed. No production migration or automatic deployment.
File & Tools
| Command | Description |
|---|
jebat file read|write|patch|search|undo|tree | Safe file ops with backups |
jebat tools list|inspect | Inspect all registered tools |
jebat skills list|search|show | Tok Guru skills |
Platform Suite
| Command | Description |
|---|
jebat companion chat|briefing|meeting|stats | Sahabat — companion AI |
jebat keris scan|assess|history | Keris — pentest scanner |
jebat nexus list|add|remove|send|broadcast|health|stats | Perisai — multi-channel bot |
jebat design search "query" [--tag X] [--limit N] [--json] | Search the DESIGNmd.ai registry (no key needed) |
jebat design get <owner/name> [--json] | View a design system (needs DESIGNMD_API_KEY) |
jebat design download <owner/name> [-o PATH | --vault] | Save a system as DESIGN.md (needs key) |
jebat design upload ./DESIGN.md --name "Kit" --tags a,b | Publish a DESIGN.md to your account (needs key) |
jebat design tags | List registry tags (no key needed) |
jebat design sync --tag dark --limit 5 [--vault] | Bulk-pull tag-matched systems into the vault |
jebat design doctor | Check install / API key / connectivity |
Agent Orchestration
| Command | Description |
|---|
jebat delegate run "task" | Multi-agent swarm dispatch |
jebat loop start|stop|status | Autonomous agent loop |
jebat think "question" | Deep reasoning engine |
MCP Server Integration
JEBAT includes a native MCP server for a full workspace checkout. Use the standalone jebat-mcp entry point for local IDE connections. The available tool set is determined by the installed runtime and its enabled integrations; do not expose it publicly without access controls.
Running JEBAT as an MCP Server
# Stdio mode (recommended for a local IDE)
python ./jebat-mcp --transport stdio
# Self-hosted HTTP mode (bind to loopback and put authentication in front of it)
python ./jebat-mcp --transport http --host 127.0.0.1 --port 8099
MCP Tools
JEBAT exposes registered file, terminal, browser, search, scheduling, memory, and integration tools over MCP. Tool availability depends on the installed workspace and enabled integrations.
| Category | Tools |
|---|
| File | file_read, file_write, file_patch, file_search, file_undo, file_tree |
| Terminal | terminal, terminal_bg, process_list, process_log, process_kill, process_write |
| Browser | browser_navigate, browser_snapshot, browser_click, browser_type, browser_scroll, browser_back, browser_vision, browser_console, browser_get_images |
| Vision / Search | vision_analyze, image_generate, search_web, web_extract |
| Auth / Cron | auth_*, cron_* (create, list, pause, resume, remove, update, run) |
| Wiki | wiki_* (create, read, edit, delete, list, search, auto_save, suggest, consolidate, stats) |
| Memory | memory_store, memory_search, memory_forget, memory_stats |
| autoMimpi / SelfLearn | mimpi_dream, mimpi_status, selflearn_analyze, project_remember, project_recall, project_forget, adapt_environment |
For a remote installation, deploy the MCP service with infra/vps/vps/docker-compose.mcp.yml and an authenticated reverse proxy based on infra/vps/vps/nginx.jebat.mcp.conf. The repository does not promise a shared public MCP endpoint.
IDE Configuration
Cursor / Windsurf / Zed
Add to your MCP config (.cursor/mcp.json, .windsurf/mcp.json):
{
"mcpServers": {
"jebat": {
"command": "python3",
"args": ["/absolute/path/to/jebat-mcp"],
"env": {}
}
}
}
VS Code (via Continue / Cline extension)
{
"mcpServers": {
"jebat": {
"command": "python3",
"args": ["/absolute/path/to/jebat-mcp"]
}
}
}
JetBrains (via MCP Plugin)
Settings > Tools > MCP > Add Server:
Command: python3 /absolute/path/to/jebat-mcp
Mode: stdio
Connecting to External MCP Servers
# Start a local MCP server for your IDE
python ./jebat-mcp --transport stdio
# Start a loopback HTTP service behind your own authenticated proxy
python ./jebat-mcp --transport http --host 127.0.0.1 --port 8099
Keris — Sentinel Security
Autonomous pentest orchestrator with AI-powered analysis.
# Quick scan
jebat keris scan example.com --profile quick
# Full scan with orchestration
jebat keris scan 192.168.1.0/24 --profile full
# Quick assessment
jebat keris assess example.com
# View history
jebat keris history
Scan Profiles
| Profile | Description |
|---|
quick | Port scan + basic vulns (~30s) |
standard | Full port scan + service detection + vulns (~2min) |
full | Comprehensive scan + CVE check + SSL analysis (~5min) |
vuln | Vulnerability-focused scan only |
Perisai — Nexus Multi-Channel
Multi-channel bot orchestrator for Telegram, Discord, Slack, Signal, Matrix, and WhatsApp.
# List channels
jebat nexus list
# Add a channel
jebat nexus add telegram -123456789 --token "BOT_TOKEN"
# Send a message
jebat nexus send -123456789 "Hello from JEBAT!"
# Broadcast to all channels
jebat nexus broadcast "System update complete"
# Health check
jebat nexus health
# Statistics
jebat nexus stats
Sahabat — Companion
AI companion for memory, briefings, and meeting intelligence.
# Interactive chat
jebat companion chat
# Generate briefing
jebat companion briefing
# Summarize meeting
jebat companion meeting --file transcript.txt --title "Sprint Review"
# Companion stats
jebat companion stats
autoMimpi & SelfLearn — Memory Dreams & Adaptive Learning
JEBAT's cross-session learning loop. The EnhancedMemorySystem (6 memory types: working, episodic, semantic, procedural, emotional, prospective) persists traces to ~/.jebat/memory/traces.json; autoMimpi consolidates them into patterns and recommendations during "dream" cycles; SelfLearn adapts JEBAT's behavior to the current project.
Dream Cycle (autoMimpi)
"Mimpi" = dream in Malay. Run a full consolidation cycle to turn raw session activity into durable knowledge:
- Strengthen important memories, prune weak ones (forgetting curve)
- Extract patterns and generalizations from recurring themes
- Rebuild the learning profile (skill level, weak/strong areas, knowledge gaps)
- Emit up to 5 prioritized suggestions (streak risk, consolidation due, pattern emerging, etc.)
- Return a Laksamana quote
# CLI — run dream consolidation + selflearn analysis
python run_mimpi_dream.py
# MCP — from any IDE
mimpi_dream # run a dream cycle (force optional)
mimpi_status # dream count, memory health, patterns
Dream state is tracked in .jebat/dream_state.json; a session-start check auto-flags when a dream is due.
SelfLearn — Project Adaptation
JEBAT remembers durable facts about each project so a future session doesn't re-discover them:
# MCP tools
project_remember # store a fact: stack, command, convention, environment, gotcha, goal
project_recall # restore project context at session start
project_forget # remove a stored fact
selflearn_analyze # skill assessment, knowledge coverage, retention, recommendations
adapt_environment # combine project facts + learning recommendations into guidance
Memory is tagged per project (project:<name>), so one server serves many projects without cross-contamination. Facts are categorized stack | command | convention | environment | gotcha | goal | other; high-importance facts survive consolidation pruning. Never store secret values — only where a secret lives.
REPL
| Command | Purpose |
|---|
/mimpi | Trigger auto-dream |
/memory | List stored memory |
/mem+ | Store key/value in memory |
/recall | Search memory by query |
Multi-Agent Orchestration
JEBAT dispatches work to specialized sub-agents:
# Delegate to a specific agent
jebat delegate run "Audit all API endpoints" --agent tukang --tools terminal,file
# Parallel multi-agent task
jebat delegate run "Security audit + code review" --parallel
# Spawn agent swarms
jebat agent "Analyze this codebase for vulnerabilities, performance issues, and code quality"
Agent Roles
| Agent | Domain |
|---|
| Tukang | Implementation, code, builds |
| Hulubalang | Security, pentest, hardening |
| Pawang | Research, investigation, docs |
| Syahbandar | Ops, automation, deploy |
| Bendahara | Database, schema, migrations |
| Penyemak | QA, validation, release |
Technical Comparison
| Capability | JEBAT v8.4.0 | Commercial SaaS (Claude/GPT) | Ollama WebUI | LM Studio |
|---|
| Data Residency | 100% Private / Air-gapped | Cloud (Third-Party) | Local Only | Local Only |
| LLM Provider Routing | 17 Providers (Failover) | Single Provider | Ollama Only | Local Only |
| MCP Server | Native workspace server | None | Basic API | Local API |
| Cognitive Profiles | 7 Thinking Modes (Ultra-Think) | Standard Chat | Standard Chat | Standard Chat |
| Security Auditing | Autonomous Pentest Suite | Blocked | None | None |
| Access Control (RBAC) | 3-Tier Command Classification | Muted Policy | Basic Auth | None |
| Eternal Memory | 5-Layer Heat-Scored Recall | Session Limits | No | No |
| Web Interface | Stealth-Dark Tactical (25 features) | Chat UI | Basic UI | Local UI |
| Platform Suite | 5 Products, 1 Memory |
Configuration
Config file: ~/.jebat/config.yaml
llm:
provider: ollama
model: qwen2.5-coder:7b
api_base: https://jebat.online/ollama
fallback_providers:
- openai
- anthropic
- openrouter
- groq
safety:
default_tier: confirm
sandbox_restricted: true
mcp:
server_port: 8787
enable_stdio: true
agent:
max_iterations: 10
stream_tokens: true
Quick Config Commands
# Import MCP servers from another CLI (show/set/reset/edit are legacy-CLI only)
jebat config import -s opencode --dry-run
# Agent + registry health check
jebat doctor
System Architecture
jebat-core/
├── jebat/ # Active runtime modules
│ ├── cli/ # Entrypoints
│ ├── core/ # Cognitive loops (agent_loop, orchestrator, delegation)
│ ├── mcp/ # MCP server + skill registry + adapter
│ ├── services/ # WebUI, MCP protocol, API gateway
│ │ └── webui/ # Stealth-Dark Tactical WebUI
│ │ ├── launch.py # Enterprise launcher (rate limit, CSP, audit)
│ │ ├── webui_server.py # FastAPI server + WebSocket
│ │ └── static/ # SPA shell, 13 partials, CSS theme
│ ├── features/ # Specialized capability suites
│ │ ├── companion/ # Sahabat — memory, briefing, meetings
│ │ ├── sentinel/ # Keris — pentest orchestrator
│ │ ├── nexus/ # Perisai — multi-channel bot
│ │ ├── design/ # DESIGN.md integration
│ │ ├── code_agent/ # Code agent feature
│ │ ├── ultra_loop/ # Autonomous agent loop
│ │ └── ultra_think/ # 7-mode reasoning engine
│ ├── cortex/ # Skill recommendation engine
│ ├── orchestration/ # DAG-based workflow engine
│ ├── multitenancy/ # Multi-tenant isolation
│ └── llm/ # Multi-provider cognitive routing
├── jebat-npm/ # npx/npm wrapper package
├── db/ # SQLite RAG wiki & memory files
└── docs/ # Platform architecture references
Safety Classification Tiers
To safeguard target servers, JEBAT categorizes all tool execution into permission tiers:
- AUTO: Read-only, safe commands executed without intervention (e.g.
cat, grep).
- CONFIRM: Write and modification commands prompting user validation (e.g.
write, patch, git commit).
- DANGEROUS: Destructive or privilege-escalating commands requiring explicit terminal validation tags (e.g.
rm -rf, sudo).
Staged CLI approvals. The REPL classifies shell commands into read (runs free) → write → execute stages; each higher stage prompts once per session, yolo bypasses. write_file previews a diff card first — answer y (once), a (always this session), or n.
Security Hardening (v8.2.x)
Production audit fixes shipped across API, WebUI, MCP transport, and tools:
- WebUI control plane auth —
/webui/api/* and /webui/ws/* now enforce the API key (previously only /api/* + /v1/* were gated); the SPA attaches X-API-Key / ?api_key= automatically.
- MCP HTTP transport auth —
streamable-http and legacy HTTP transports reject unauthenticated tools/call when JEBAT_API_KEY is set (timing-safe compare; dev fail-open preserved).
- Path containment —
jebat://file/{path} resource reads and vision_analyze local-path inputs are workspace/denylist-contained (no traversal, no secret-file exfil to external APIs).
- SSRF guard —
seo_url_audit and vision URL fetches route through the outbound validator (blocks loopback/link-local/metadata targets, re-resolves DNS per hop).
- Fail-closed defaults — deploy webhook refuses to run without
--secret; compose files require ${POSTGRES_PASSWORD:?}-style mandatory interpolation; agent_execute defaults yolo=False + confirm tier.
- Key hygiene — Google API key moved to the
x-goog-api-key header (never in URLs or error strings).
- Per-call deadlines — every MCP
tools/call is bounded by its declared timeout; hung tools return structured isError instead of wedging the IDE.
- MCP observability —
jebat://metrics/tools resource exposes per-tool call counts, error counts, and p50/p95 latency.
- Sampling boundary — IDE
sampling/createMessage content is size-capped and wrapped as untrusted data before reaching the local model.
Platform Support
| OS | Shell | Status |
|---|
| macOS | zsh/fish/bash | Full |
| Linux | bash/zsh/fish | Full |
| Windows | PowerShell/CMD/Git Bash | Full |
| WSL2 | bash | Full |
Documentation
Model Fine-Tuning (JEBAT-Builder)
Train a custom model that knows YOUR code style and JEBAT architecture.
Free Cloud GPU Options
| Platform | GPU | VRAM | Free Tier | Best For |
|---|
| Google Colab | T4 | 15GB | ✅ Unlimited sessions | Quick experiments |
| Kaggle | T4 x2 | 30GB | ✅ 30h/week | Medium fine-tunes |
| AWS SageMaker | T4 | 16GB | ✅ 4h/session | Quick tests |
| Paperspace | M4000 | 8GB | ✅ Limited hours | Development |
| Lightning AI | T4 | 16GB | ✅ 22h/month | Development |
| GCP Free Tier | T4/V100/A100 | Varies | ✅ $300 credit | Serious training |
Paid Options (Cheapest)
| Platform | GPU | Cost/Hour | Best For |
|---|
| RunPod | RTX 3090 24GB | $0.45 | Budget training |
| Vast.ai | RTX 3090 | $0.20-0.40 | Cheapest |
| Lambda | A100 80GB | $1.10 | Production |
| Together.ai | A100 80GB | $1.36 | Fine-tuning API |
Fine-Tuning Steps
# Step 1: Create training dataset from your repos
python -m jebat.ml.create_dataset --repos /path/to/your/code
# Step 2: Fine-tune on Google Colab (free T4 GPU)
# - Use Unsloth for efficient LoRA (4-bit quantization)
# - Base model: qwen2.5-coder:7b
# - Time: 2-4 hours
# - Cost: $0
# Step 3: Export as GGUF
python -m jebat.ml.export_gguf --model ./finetuned_model --format Q4_K_M
# Step 4: Deploy to jebat.online
scp ./jebat-builder.Q4_K_M.gguf [email protected]:/tmp/
ssh [email protected] "ollama create jebat-builder -f /tmp/Modelfile"
Your Hardware
| Device | GPU | VRAM | Training Capability |
|---|
| Laptop | RTX 3060 | 6GB | QLoRA for 3B-4B models |
| Server .206 | None (CPU) | N/A | Inference only |
| Google Colab | T4 | 15GB | LoRA for 7B-13B models |
| Kaggle | T4 x2 | 30GB | QLoRA for 7B-13B models |
License & Organization
Developed and maintained under strict data residency governance by NusaByte.
Licensed under the MIT Open Source License. Built by Shaidan Shaari (humm1ngb1rd).
🗡️ JEBAT — Because warriors remember everything that matters.
