nimbus-agent/Nimbus

On-Call Intelligence for DevOps, SecDevOps, and Platform Engineering Teams
*Cross-service incident context in under 100 ms. Consent-gated automation. Your credentials never leave the machine.*
"## Authorship" -> "## Gaps", and the
recorded command sequence (init --no-sync -> connector sync -> why) fails on a
real machine with "Gateway is not running".
Restore only from output captured against a REAL gateway. -->
**Install** · **Docs** · **Architecture** · **Roadmap**
---
Start here
Who wrote this line, when, and in which commit — answered from your local git history, with no LLM configured, no API key, and no cloud account. Connect GitHub and a ticket tracker (Jira or Linear) and an incident tool, and the same command extends its answer with the pull request that carried the change, the ticket that asked for it, and the incident it touched.
That is the whole first run. Much of what follows is what becomes available once you connect the tools you already use.
No repo handy, or just want to see it work first? nimbus demo seeds a synthetic "Acme" org — people, PRs, incidents, deployments — into an isolated demo root that never touches your real config or data, then tours on-call triage, why and owners and closes on the locality panel. nimbus demo stop stops the demo gateway; nimbus demo reset removes the whole demo root.
---
Nimbus is an open-source, local-first AI agent built for engineers who run systems in production. A headless **Nimbus Gateway** runs on your machine, maintains a private SQLite index across your entire developer toolchain — source control, CI/CD, cloud infrastructure, monitoring, and incident management — and executes multi-step tasks on your behalf. Every write, send, or delete requires your explicit approval before it runs.
**Your credentials never leave your machine. There is no Nimbus server.**
Every architectural decision in Nimbus is evaluated against one question:
> **Does this return control to the user, or does it erode it?**
The non-negotiables in Contributing follow from that question — they are load-bearing constraints, not aspirational values.
Three load-bearing words
- **local** — the SQLite index, the Vault, and the audit log all live on your machine. The cloud is a connector, not the source of truth. Telemetry is opt-in and off by default ([telemetry] enabled = false).
- **consent-gated** — every destructive or outbound action is intercepted by a human-in-the-loop gate *before* it runs. It lives in the executor, not the prompt, so it cannot be jailbroken away.
- **MCP** — Nimbus speaks the Model Context Protocol in both directions. As an **MCP client** it drives every connector as an MCP server, and hosts any third-party server you register with nimbus connector add --mcp — it runs sandboxed in its own working directory with only the read paths and hosts you approved (on Windows a network grant is all-or-nothing: approving any host opens the whole network to that server, and the approval prompt says so), and every tool call asks your approval first ; register it with --model and its tools are also offered to the model in nimbus ask, for you only, each call still asking your approval (the agent exists only with a remote [llm.remote.*] vendor enabled, so results reach that vendor). As an **MCP server**, it exposes your local index *and* its built-in agents to any MCP client through 21 read-only tools — 9 index tools plus 12 agent tools (explainWhy, findExpert, assessImpact, getCatchup, …) plus, when you turn on [mcp_sink] (default off), one opt-in write tool, capture_note, that saves an agent-authored note into your local index for you to review or revoke with nimbus captures. Install it with npx -y @nimbus-dev/mcp, or run nimbus mcp-server --stdio directly from a checkout. The engine never calls a cloud API directly.
---
What It Does
**Example session:**
**SecDevOps example:**
**Data lineage example:**
More worked examples: examples.md.
---
Who It's For
Nimbus is built for engineers and operators who run systems in production. If your on-call rotation spans five monitoring tools and three cloud consoles, Nimbus is the intelligence layer that collapses that context into a single query.
| Role | What Nimbus gives you |
|---|---|
| **On-call / SRE** | Instant incident context — last deploy, triggering commit, CI result, Slack thread — in one query, without seven browser tabs |
| **Platform Engineer** | Drift detection, multi-cloud infra state, deployment correlation, CI/CD and build pipeline monitoring (Bitrise), consent-gated IaC apply and rollback |