JEBAT v8.4.0 — Sovereign Agent OS & Agent Workstation

Sovereign execution, private memory, and audited intelligence.

JEBAT is an enterprise-grade self-hosted AI platform and agent workstation. It provides governed local LLM inference, multi-agent orchestration, persistent memory, adaptive context windowing, observability, an MCP workspace server, and a full web interface. Run fully air-gapped on your private network with zero data leakage.

Named after the legendary Malay warrior Hang Jebat — loyal, powerful, and unforgettable.

Public Service

The public JEBAT service is available at jebat.online.

Surface	URL
API status	`/api/status`
Swagger UI	`/swagger`
OpenAPI document	`/openapi.json`
WebUI	`/webui/`

The public API and WebUI are production services. Configure provider credentials in your own deployment before sending requests that require model inference.

Quick Start

Option 1: npx (Recommended — Zero Install)

# First run: configure your LLM provider (one-time wizard)
npx @nusabyte/jebat init

# Interactive REPL
npx @nusabyte/jebat repl

# One-shot chat
npx @nusabyte/jebat chat "Explain the memory consolidation algorithm"

# Run agent task
npx @nusabyte/jebat agent "Audit all API endpoints in src/services"

# Generate code
npx @nusabyte/jebat code "Create a REST API with FastAPI"

# Launch WebUI
npx @nusabyte/jebat webui

# With bun
bunx @nusabyte/jebat repl

Requirements: Node.js >= 18, Python >= 3.11, pip

Option 2: Global Install (via npm)

# Installs the npx wrapper globally; first run bootstraps the Python core
npm install -g @nusabyte/jebat
jebat repl

The npm package is a thin launcher — on first run it downloads and runs the
bootstrap, which provisions Python, the venv, and the jebat launcher in
~/.local. Do not run pip install jebat — that name is a unrelated
package on PyPI (a website checker) and is not JEBAT. The bootstrap is the
only supported install path.

Option 3: Source Build

git clone https://github.com/nusabyte-my/jebat-core.git
cd jebat-core
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash   # bootstrap the core CLI
jebat repl

Installation — Three Surfaces, One Script

JEBAT installs like Hermes: a single self-contained bootstrap that provisions
Python, the venv, the CLI launcher, and (optionally) the Desktop app and MCP
server. No sudo required — everything lands in ~/.local.

# Zero-install (downloads + runs the bootstrap). Uses the raw GitHub URL so it
# always serves the script as plaintext (no CDN/HTML fallback).
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash            # CLI only
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --desktop
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --mcp
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --all

# Or pin a profile explicitly
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --cli --no-inference

# Agent / CI friendly: fully non-interactive
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --yes --quiet

# Emit a ready-to-paste MCP config for your IDE (no install needed)
curl -fsSL https://raw.githubusercontent.com/nusabyte-my/jebat-core/main/install.sh | bash -s -- --print-mcp-config=cursor

What gets installed (components)

Component	Surface	Purpose
JEBAT CLI	CLI / Desktop / MCP	`jebat repl`, `chat`, `code`, `agent` (core)
Python venv	all	Isolated runtime at `~/.local/jebat/venv` (editable install)
`jebat` launcher	all	Symlink on `PATH` (`~/.local/bin/jebat`)
DESIGNmd CLI	CLI companion	Standalone registry tool (`designmd search/get/download/...`)
MCP surface	MCP	IDE snippet prepped at `~/.local/jebat/mcp.ide.json` (server ships with the full Jebat workspace)
Unified Inference Stack	CLI / Desktop	Ollama + llama.cpp + router + OpenWebUI (from the full Jebat workspace)
Desktop surface	Desktop	`jebat desktop` UI from the full Jebat workspace

Note: This installer clones the public core CLI (jebat-core),
which exposes repl, chat, code, and agent. The design, mcp serve,
and desktop surfaces live in the full Jebat workspace (jebat-dev).
The installer still prepares their config (IDE snippet, Electron note) so
they activate the moment that code is present.

Surface quick-reference

# CLI — primary surface (core)
jebat repl                                   # interactive REPL
jebat chat "hello"                           # one-shot
jebat code "refactor utils.py"              # coding agent
jebat --help                                 # full command list
# Default inference provider is seeded at install: JEBAT Online
#   (OpenAI-compatible) → https://jebat.online/v1  [switch with /provider <id>]
#   local Ollama (http://127.0.0.1:11434) is also registered, inactive by default

# DESIGNmd (companion tool, standalone)
designmd search "dark fintech" --limit 3     # browse the registry
designmd tags                                # list tags

# MCP — run from a full workspace checkout
# python ./jebat-mcp --transport stdio
# See MCP.md for IDE configuration and self-hosted HTTP deployment.


# Desktop — native workstation UI (full workspace)
jebat desktop                                # launch GUI

Local Unified Inference Stack (optional, `--no-inference` to skip)

The full Jebat workspace ships a local LLM layer so jebat can route to your
own hardware:

llama.cpp (llama-server) — CPU/AVX-512 + Intel Iris Xe (Vulkan)
Ollama — local GGUF registry
Router — one OpenAI-compatible endpoint at http://127.0.0.1:8000/v1
that merges every backend and fans out by model/@backend/?backend=
OpenWebUI — chat frontend at http://127.0.0.1:8080, pointed at the router
Remote vLLM / Ollama — offload big models to a GPU host

# from the full Jebat workspace checkout:
infra/inference/start.sh                     # boot the stack
# or as a user service:
systemctl --user start jebat-router.service

Remote Ollama Endpoint

JEBAT uses a remote Ollama instance hosted on a dedicated server with AMD EPYC 9354P (8 vCPU, 32GB RAM).

# Default endpoint (zero config)
# https://jebat.online/ollama

# Models available:
#   - qwen2.5-coder:7b (4.7GB, fast coding)
#   - qwen2.5:14b (9GB, general purpose)

# Test the endpoint
curl https://jebat.online/ollama/v1/models

# Use with JEBAT
jebat chat "Hello from jebat.online"

Configuration

# ~/.jebat/config.yaml
llm:
  provider: ollama
  model: qwen2.5-coder:7b
  api_base: https://jebat.online/ollama  # Default endpoint

Providers & Auth

JEBAT routes to 17 providers — OpenAI, Anthropic, Google Gemini, xAI, DeepSeek, Mistral, Groq, Cerebras, Together, OpenRouter, GitHub Models, Cloudflare, SambaNova, Novita, Z.AI, local Ollama, or any OpenAI-compatible endpoint. Add one interactively from the REPL:

jebat repl            # then: /provider add

Auth method — `key` / `env` / `store`

Every keyed provider (Gemini, Anthropic, and any OpenAI-compatible) supports three ways to supply the API key. Choose at add time; the key is resolved at runtime via resolve_api_key().

Method	How it works	Best for
`key`	Paste the key inline (stored in `~/.jebat/jebat-cli-providers.json`)	Quick local use
`env`	Read from an env var at runtime (e.g. `ANTHROPIC_API_KEY`)	CI / shared machines — secret never hits disk
`store`	Named key from the JEBAT auth store (`~/.jebat/auth/tokens.json`, set via `/apikey`)	Multiple / rotated keys

env and store keep secrets out of the provider config — recommended for anything shared.

Models (refreshed catalog)

Defaults point at current models:

OpenAI → gpt-5 (+ gpt-5-mini / gpt-5-nano), gpt-4.1, o3, o4-mini
Anthropic → claude-opus-4-1 / claude-sonnet-4-1 / claude-haiku-4-5
xAI → grok-4 (+ grok-4-mini)
Gemini → gemini-2.5-pro / gemini-2.5-flash
GitHub Models → openai/gpt-5 (free tier with a GitHub token)
Local Ollama → qwen2.5:3b (avoids a 404 when a bigger model isn't pulled)

Local Ollama auto-start

When Ollama is the selected provider, JEBAT auto-starts ollama serve if it isn't running and auto-pulls the chosen model if it isn't pulled — no manual setup.

Default provider

Install seeds JEBAT Online (https://jebat.online/v1, OpenAI-compatible) as the active default; local Ollama is registered but inactive. Switch any time with /provider <id>.

Platform Suite — 5 Products, 1 Memory

JEBAT ships as a unified platform with 5 integrated products sharing a persistent memory layer and MCP protocol bus.

Product	Codename	Description
JEBAT Core	—	The sovereign AI engine — REPL, chat, agent, memory, MCP
Sahabat	Companion	Memory keeper, briefing agent, meeting intelligence
Keris	Sentinel	Autonomous pentest orchestrator with AI analysis
Pandai	Developer	Skills, tools, code generation, developer suite
Perisai	Nexus	Multi-channel bot orchestrator (Telegram, Discord, Slack, etc.)

WebUI — Stealth-Dark Tactical Interface

Launch the full web interface with real-time system metrics, product dashboards, and enterprise UX.

# Launch WebUI
python -m jebat.services.webui.launch
# → http://localhost:8787

# Or via CLI
jebat webui

WebUI Pages (13)

Page	Description
Dashboard	System metrics (CPU/RAM/disk), product overview, recent scans
Chat	Universal AI chat with provider selection
Sahabat	Companion chat, drag-and-drop transcript upload
Keris	Security scan form, scan history, severity badges
Pandai	Skills browser, code tools
Perisai	Channel management, send/broadcast, channel stats
Control	Runtime control, provider config
Skills	Skill browser and management
Agents	Agent orchestration and status
Channels	Messaging channel configuration
Setup	Environment setup wizard
Settings	Provider selection, preferences, API reference

WebUI Enterprise Features (25)

Backend:

Rate limiting (120 req/min per IP)
CORS tightened (localhost-only)
CSP headers (Content-Security-Policy, X-Frame-Options, nosniff)
Request ID tracking (X-Request-ID on every response)
Audit trail (last 500 requests, /api/audit)
Error pages (404/429/500 styled)
Health check (/health)
Session check (/api/session/check)

Frontend:

Loading progress bar
Dark/Light theme toggle
Clickable breadcrumb navigation
Global search palette (Ctrl+K)
Keyboard shortcuts overlay (?)
Toast notification system
Activity log drawer (Ctrl+L)
Activity log export (JSON/CSV)
Confirmation dialogs
Session timeout (15 min inactivity)
i18n (English/Bahasa Melayu)
Copy-to-clipboard
Focus trap (keyboard accessibility)
Skeleton loading (shimmer)
Reduced motion support (prefers-reduced-motion)
Print-friendly CSS
Drag-and-drop file upload
Service worker (offline caching)
PWA manifest (install as desktop app)
Favicon + OG meta tags
Responsive mobile sidebar

WebUI API Endpoints

GET  /health                    Health check
GET  /api/system/metrics        CPU, memory, disk, uptime
GET  /api/audit                 Audit trail (last N requests)
GET  /api/session/check         Session verification
GET  /api/keris/history         Scan history
POST /api/keris/scan            Trigger pentest scan
GET  /api/nexus/channels        List channels
POST /api/nexus/send            Send message
POST /api/nexus/broadcast       Broadcast to all
GET  /api/nexus/stats           Channel statistics
GET  /webui/api/status          Provider/model status
POST /webui/api/chat            Chat with AI
POST /webui/api/runtime         Runtime control

Core Commands

General

Command	Description
`jebat repl`	Interactive REPL; resume with `jebat --continue` or `jebat repl --session ID`
`jebat chat "prompt"`	One-shot chat without tools
`jebat agent "task"`	Run one-shot agent with tool-calling
`jebat code "prompt"`	Generate code from description
`jebat webui`	Launch Stealth-Dark WebUI
`jebat status`	Local provider, run, and session inventory; not a live health probe
`jebat doctor`	Agentix registry/build/budget checks; not remote API or MCP health
`jebat init`	First-run provider setup (REPL `/init` = workspace scan → `AGENTS.md`)
`jebat workflow list [--json]`	List nine opt-in operator playbooks without model calls
`jebat workflow show NAME --task "objective" --scope .`	Render shared CLI/MCP guidance; does not execute agents or tools
`jebat learning analyze\|advise\|dream\|status\|search\|feedback`	Scoped AutoMimpi/SelfLearn, cited advisor proposals, persistent KB reports, explicit reviewer feedback; no model calls

Workspace & Config Import

Command	Description
`jebat capture` (alias `agents`)	Repo scan → generate `AGENTS.md` (backs up existing; stack, layout, entrypoints, tests)
`jebat config import -s omp\|opencode\|claude`	Import MCP server config from another CLI — normalizes transports/timeouts/env templates; `--dry-run`, `--only`, `--overwrite`; auto-backup

Current lifecycle, audit findings, quick wins, and isolated verification: Operating workflows.
Main-agent execution is the default. Necessary subagents must use the exact same provider/model, with no fallback substitution.

Agentix — Solution Lifecycle

Command	Description
`jebat agentix create NAME -t reflex\|flow\|lattice`	Scaffold an agent solution (ReAct loop / workspace-driven / schema-driven tools)
`jebat agentix create NAME --from security-audit`	Create from a shipped specialist doctrine; discover the current catalog with `jebat agentix templates`
`jebat agentix build PATH`	Validate + compile + content-addressed build manifest (`.agentix/build.json`)
`jebat agentix eval PATH [--live]`	Structural checks + golden tasks (`golden/*.json`); llm-runtime tasks run against the real provider only with `--live`
`jebat agentix deploy PATH --target local\|mcp\|vps`	Ship it: local registry, ready-to-paste MCP config, or scp to VPS — gated by `deploy.allow` in `agentix.yaml`
`jebat agentix run NAME\|PATH "task"`	Spawn the agent: `runtime: llm` solutions run the shared ReAct loop with the solution's doctrine, tool allowlist and workspace jail; code solutions execute `run(task, ctx.tools)`
`jebat agentix ask "objective"`	Type only an objective — routes to the best deployed solution (top-3 candidates shown when ambiguous)
`jebat agentix run NAME - < task.txt`	Pipe a task via stdin (`-` reads the task)
`jebat agentix run NAME --resume RUN_ID "follow-up"`	Continue a recorded run's conversation (every llm run is recorded)
`jebat agentix oneshot "task" --tools read_file,terminal`	Ephemeral agent — no solution folder; transcript kept in the run registry
`jebat agentix runs`	List recent runs (ids for `--resume`)
`jebat agentix doctor [--fix]`	Health-check: dangling registry entries, stale builds, budget sanity, doctrine drift
`jebat agentix export PATH --format claude-subagent\|skill`	Ship the solution to other harnesses (Claude Code subagents, Agent Skills)
`jebat agentix team run TEAM "objective"`	Run a declared specialist pipeline — file-based handoff through a shared jailed workspace, qa-verifier between legs, human gates, team-level budget
`jebat agentix teams`	List shipped + user team pipelines (go-to-market, security-review, product-release)
`jebat agentix status [PATH]`	Solution state + deployed registry (runtime + stale flags)

Specialists declare their own budgets (budget.tokens, budget.wall_clock) — the loop stops and summarizes when either is exhausted.

Configuration & Memory

Command	Description
`jebat config import -s omp\|opencode\|claude`	Import MCP server config from another CLI (transport/timeout/env normalization, `--dry-run`, `--overwrite`)
`jebat memory store\|search\|stats`	6-type eternal memory with Ghost DB vector search
`jebat llm providers\|config\|auth`	LLM provider management
`jebat llm best-provider`	Auto-detect best available provider

Learning lifecycle and isolated checks: Learning advisor and KB. Advice and dream history reuse the existing SQLite/FTS5 wiki database; trace memory remains JSON-backed. No production migration or automatic deployment.

File & Tools

Command	Description
`jebat file read\|write\|patch\|search\|undo\|tree`	Safe file ops with backups
`jebat tools list\|inspect`	Inspect all registered tools
`jebat skills list\|search\|show`	Tok Guru skills

Platform Suite

Command	Description
`jebat companion chat\|briefing\|meeting\|stats`	Sahabat — companion AI
`jebat keris scan\|assess\|history`	Keris — pentest scanner
`jebat nexus list\|add\|remove\|send\|broadcast\|health\|stats`	Perisai — multi-channel bot
`jebat design search "query" [--tag X] [--limit N] [--json]`	Search the DESIGNmd.ai registry (no key needed)
`jebat design get <owner/name> [--json]`	View a design system (needs DESIGNMD_API_KEY)
`jebat design download <owner/name> [-o PATH \| --vault]`	Save a system as DESIGN.md (needs key)
`jebat design upload ./DESIGN.md --name "Kit" --tags a,b`	Publish a DESIGN.md to your account (needs key)
`jebat design tags`	List registry tags (no key needed)
`jebat design sync --tag dark --limit 5 [--vault]`	Bulk-pull tag-matched systems into the vault
`jebat design doctor`	Check install / API key / connectivity

Agent Orchestration

Command	Description
`jebat delegate run "task"`	Multi-agent swarm dispatch
`jebat loop start\|stop\|status`	Autonomous agent loop
`jebat think "question"`	Deep reasoning engine

MCP Server Integration

JEBAT includes a native MCP server for a full workspace checkout. Use the standalone jebat-mcp entry point for local IDE connections. The available tool set is determined by the installed runtime and its enabled integrations; do not expose it publicly without access controls.

Running JEBAT as an MCP Server

# Stdio mode (recommended for a local IDE)
python ./jebat-mcp --transport stdio

# Self-hosted HTTP mode (bind to loopback and put authentication in front of it)
python ./jebat-mcp --transport http --host 127.0.0.1 --port 8099

MCP Tools

JEBAT exposes registered file, terminal, browser, search, scheduling, memory, and integration tools over MCP. Tool availability depends on the installed workspace and enabled integrations.

Category	Tools
File	`file_read`, `file_write`, `file_patch`, `file_search`, `file_undo`, `file_tree`
Terminal	`terminal`, `terminal_bg`, `process_list`, `process_log`, `process_kill`, `process_write`
Browser	`browser_navigate`, `browser_snapshot`, `browser_click`, `browser_type`, `browser_scroll`, `browser_back`, `browser_vision`, `browser_console`, `browser_get_images`
Vision / Search	`vision_analyze`, `image_generate`, `search_web`, `web_extract`
Auth / Cron	`auth_`, `cron_` (create, list, pause, resume, remove, update, run)
Wiki	`wiki_*` (create, read, edit, delete, list, search, auto_save, suggest, consolidate, stats)
Memory	`memory_store`, `memory_search`, `memory_forget`, `memory_stats`
autoMimpi / SelfLearn	`mimpi_dream`, `mimpi_status`, `selflearn_analyze`, `project_remember`, `project_recall`, `project_forget`, `adapt_environment`

For a remote installation, deploy the MCP service with infra/vps/vps/docker-compose.mcp.yml and an authenticated reverse proxy based on infra/vps/vps/nginx.jebat.mcp.conf. The repository does not promise a shared public MCP endpoint.

IDE Configuration

Cursor / Windsurf / Zed

Add to your MCP config (.cursor/mcp.json, .windsurf/mcp.json):

{
  "mcpServers": {
    "jebat": {
      "command": "python3",
      "args": ["/absolute/path/to/jebat-mcp"],
      "env": {}
    }
  }
}

VS Code (via Continue / Cline extension)

{
  "mcpServers": {
    "jebat": {
      "command": "python3",
      "args": ["/absolute/path/to/jebat-mcp"]
    }
  }
}

JetBrains (via MCP Plugin)

Settings > Tools > MCP > Add Server:

Command: python3 /absolute/path/to/jebat-mcp
Mode: stdio

Connecting to External MCP Servers

# Start a local MCP server for your IDE
python ./jebat-mcp --transport stdio

# Start a loopback HTTP service behind your own authenticated proxy
python ./jebat-mcp --transport http --host 127.0.0.1 --port 8099

Keris — Sentinel Security

Autonomous pentest orchestrator with AI-powered analysis.

# Quick scan
jebat keris scan example.com --profile quick

# Full scan with orchestration
jebat keris scan 192.168.1.0/24 --profile full

# Quick assessment
jebat keris assess example.com

# View history
jebat keris history

Scan Profiles

Profile	Description
`quick`	Port scan + basic vulns (~30s)
`standard`	Full port scan + service detection + vulns (~2min)
`full`	Comprehensive scan + CVE check + SSL analysis (~5min)
`vuln`	Vulnerability-focused scan only

Perisai — Nexus Multi-Channel

Multi-channel bot orchestrator for Telegram, Discord, Slack, Signal, Matrix, and WhatsApp.

# List channels
jebat nexus list

# Add a channel
jebat nexus add telegram -123456789 --token "BOT_TOKEN"

# Send a message
jebat nexus send -123456789 "Hello from JEBAT!"

# Broadcast to all channels
jebat nexus broadcast "System update complete"

# Health check
jebat nexus health

# Statistics
jebat nexus stats

Sahabat — Companion

AI companion for memory, briefings, and meeting intelligence.

# Interactive chat
jebat companion chat

# Generate briefing
jebat companion briefing

# Summarize meeting
jebat companion meeting --file transcript.txt --title "Sprint Review"

# Companion stats
jebat companion stats

autoMimpi & SelfLearn — Memory Dreams & Adaptive Learning

JEBAT's cross-session learning loop. The EnhancedMemorySystem (6 memory types: working, episodic, semantic, procedural, emotional, prospective) persists traces to ~/.jebat/memory/traces.json; autoMimpi consolidates them into patterns and recommendations during "dream" cycles; SelfLearn adapts JEBAT's behavior to the current project.

Dream Cycle (autoMimpi)

"Mimpi" = dream in Malay. Run a full consolidation cycle to turn raw session activity into durable knowledge:

Strengthen important memories, prune weak ones (forgetting curve)
Extract patterns and generalizations from recurring themes
Rebuild the learning profile (skill level, weak/strong areas, knowledge gaps)
Emit up to 5 prioritized suggestions (streak risk, consolidation due, pattern emerging, etc.)
Return a Laksamana quote

# CLI — run dream consolidation + selflearn analysis
python run_mimpi_dream.py

# MCP — from any IDE
mimpi_dream        # run a dream cycle (force optional)
mimpi_status       # dream count, memory health, patterns

Dream state is tracked in .jebat/dream_state.json; a session-start check auto-flags when a dream is due.

SelfLearn — Project Adaptation

JEBAT remembers durable facts about each project so a future session doesn't re-discover them:

# MCP tools
project_remember   # store a fact: stack, command, convention, environment, gotcha, goal
project_recall     # restore project context at session start
project_forget     # remove a stored fact
selflearn_analyze  # skill assessment, knowledge coverage, retention, recommendations
adapt_environment  # combine project facts + learning recommendations into guidance

Memory is tagged per project (project:<name>), so one server serves many projects without cross-contamination. Facts are categorized stack | command | convention | environment | gotcha | goal | other; high-importance facts survive consolidation pruning. Never store secret values — only where a secret lives.

REPL

Command	Purpose
`/mimpi`	Trigger auto-dream
`/memory`	List stored memory
`/mem+`	Store key/value in memory
`/recall`	Search memory by query

Multi-Agent Orchestration

JEBAT dispatches work to specialized sub-agents:

# Delegate to a specific agent
jebat delegate run "Audit all API endpoints" --agent tukang --tools terminal,file

# Parallel multi-agent task
jebat delegate run "Security audit + code review" --parallel

# Spawn agent swarms
jebat agent "Analyze this codebase for vulnerabilities, performance issues, and code quality"

Agent Roles

Agent	Domain
Tukang	Implementation, code, builds
Hulubalang	Security, pentest, hardening
Pawang	Research, investigation, docs
Syahbandar	Ops, automation, deploy
Bendahara	Database, schema, migrations
Penyemak	QA, validation, release

Technical Comparison

Capability	JEBAT v8.4.0	Commercial SaaS (Claude/GPT)	Ollama WebUI	LM Studio
Data Residency	100% Private / Air-gapped	Cloud (Third-Party)	Local Only	Local Only
LLM Provider Routing	17 Providers (Failover)	Single Provider	Ollama Only	Local Only
MCP Server	Native workspace server	None	Basic API	Local API
Cognitive Profiles	7 Thinking Modes (Ultra-Think)	Standard Chat	Standard Chat	Standard Chat
Security Auditing	Autonomous Pentest Suite	Blocked	None	None
Access Control (RBAC)	3-Tier Command Classification	Muted Policy	Basic Auth	None
Eternal Memory	5-Layer Heat-Scored Recall	Session Limits	No	No
Web Interface	Stealth-Dark Tactical (25 features)	Chat UI	Basic UI	Local UI
Platform Suite	5 Products, 1 Memory	Single Product	None	None
npx / npm	Zero-install wrapper	N/A	N/A	N/A
Remote Inference	AMD EPYC 9354P (8 vCPU/32GB)	Cloud GPU	Local GPU	Local GPU

Configuration

Config file: ~/.jebat/config.yaml

llm:
  provider: ollama
  model: qwen2.5-coder:7b
  api_base: https://jebat.online/ollama
  fallback_providers:
    - openai
    - anthropic
    - openrouter
    - groq
safety:
  default_tier: confirm
  sandbox_restricted: true
mcp:
  server_port: 8787
  enable_stdio: true
agent:
  max_iterations: 10
  stream_tokens: true

Quick Config Commands

# Import MCP servers from another CLI (show/set/reset/edit are legacy-CLI only)
jebat config import -s opencode --dry-run

# Agent + registry health check
jebat doctor

System Architecture

jebat-core/
  ├── jebat/                  # Active runtime modules
   │   ├── cli/                # Entrypoints
  │   ├── core/               # Cognitive loops (agent_loop, orchestrator, delegation)
  │   ├── mcp/                # MCP server + skill registry + adapter
  │   ├── services/           # WebUI, MCP protocol, API gateway
  │   │   └── webui/          # Stealth-Dark Tactical WebUI
  │   │       ├── launch.py   # Enterprise launcher (rate limit, CSP, audit)
  │   │       ├── webui_server.py  # FastAPI server + WebSocket
  │   │       └── static/     # SPA shell, 13 partials, CSS theme
  │   ├── features/           # Specialized capability suites
  │   │   ├── companion/      # Sahabat — memory, briefing, meetings
  │   │   ├── sentinel/       # Keris — pentest orchestrator
  │   │   ├── nexus/          # Perisai — multi-channel bot
  │   │   ├── design/         # DESIGN.md integration
  │   │   ├── code_agent/     # Code agent feature
  │   │   ├── ultra_loop/     # Autonomous agent loop
  │   │   └── ultra_think/    # 7-mode reasoning engine
  │   ├── cortex/             # Skill recommendation engine
  │   ├── orchestration/      # DAG-based workflow engine
  │   ├── multitenancy/       # Multi-tenant isolation
  │   └── llm/                # Multi-provider cognitive routing
  ├── jebat-npm/              # npx/npm wrapper package
  ├── db/                     # SQLite RAG wiki & memory files
  └── docs/                   # Platform architecture references

Safety Classification Tiers

To safeguard target servers, JEBAT categorizes all tool execution into permission tiers:

AUTO: Read-only, safe commands executed without intervention (e.g. cat, grep).
CONFIRM: Write and modification commands prompting user validation (e.g. write, patch, git commit).
DANGEROUS: Destructive or privilege-escalating commands requiring explicit terminal validation tags (e.g. rm -rf, sudo).

Staged CLI approvals. The REPL classifies shell commands into read (runs free) → write → execute stages; each higher stage prompts once per session, yolo bypasses. write_file previews a diff card first — answer y (once), a (always this session), or n.

Security Hardening (v8.2.x)

Production audit fixes shipped across API, WebUI, MCP transport, and tools:

WebUI control plane auth — /webui/api/* and /webui/ws/* now enforce the API key (previously only /api/* + /v1/* were gated); the SPA attaches X-API-Key / ?api_key= automatically.
MCP HTTP transport auth — streamable-http and legacy HTTP transports reject unauthenticated tools/call when JEBAT_API_KEY is set (timing-safe compare; dev fail-open preserved).
Path containment — jebat://file/{path} resource reads and vision_analyze local-path inputs are workspace/denylist-contained (no traversal, no secret-file exfil to external APIs).
SSRF guard — seo_url_audit and vision URL fetches route through the outbound validator (blocks loopback/link-local/metadata targets, re-resolves DNS per hop).
Fail-closed defaults — deploy webhook refuses to run without --secret; compose files require ${POSTGRES_PASSWORD:?}-style mandatory interpolation; agent_execute defaults yolo=False + confirm tier.
Key hygiene — Google API key moved to the x-goog-api-key header (never in URLs or error strings).
Per-call deadlines — every MCP tools/call is bounded by its declared timeout; hung tools return structured isError instead of wedging the IDE.
MCP observability — jebat://metrics/tools resource exposes per-tool call counts, error counts, and p50/p95 latency.
Sampling boundary — IDE sampling/createMessage content is size-capped and wrapped as untrusted data before reaching the local model.

Platform Support

OS	Shell	Status
macOS	zsh/fish/bash	Full
Linux	bash/zsh/fish	Full
Windows	PowerShell/CMD/Git Bash	Full
WSL2	bash	Full

Documentation

MCP integration — Local IDE setup and self-hosted transport
Workstation MCP guide — IDE integration guide
llama.cpp VPS deployment — Inference runbook
Production Compose — Public API and WebUI stack
Production Nginx vhost — Public routing

Model Fine-Tuning (JEBAT-Builder)

Train a custom model that knows YOUR code style and JEBAT architecture.

Free Cloud GPU Options

Platform	GPU	VRAM	Free Tier	Best For
Google Colab	T4	15GB	✅ Unlimited sessions	Quick experiments
Kaggle	T4 x2	30GB	✅ 30h/week	Medium fine-tunes
AWS SageMaker	T4	16GB	✅ 4h/session	Quick tests
Paperspace	M4000	8GB	✅ Limited hours	Development
Lightning AI	T4	16GB	✅ 22h/month	Development
GCP Free Tier	T4/V100/A100	Varies	✅ $300 credit	Serious training

Paid Options (Cheapest)

Platform	GPU	Cost/Hour	Best For
RunPod	RTX 3090 24GB	$0.45	Budget training
Vast.ai	RTX 3090	$0.20-0.40	Cheapest
Lambda	A100 80GB	$1.10	Production
Together.ai	A100 80GB	$1.36	Fine-tuning API

Fine-Tuning Steps

# Step 1: Create training dataset from your repos
python -m jebat.ml.create_dataset --repos /path/to/your/code

# Step 2: Fine-tune on Google Colab (free T4 GPU)
# - Use Unsloth for efficient LoRA (4-bit quantization)
# - Base model: qwen2.5-coder:7b
# - Time: 2-4 hours
# - Cost: $0

# Step 3: Export as GGUF
python -m jebat.ml.export_gguf --model ./finetuned_model --format Q4_K_M

# Step 4: Deploy to jebat.online
scp ./jebat-builder.Q4_K_M.gguf [email protected]:/tmp/
ssh [email protected] "ollama create jebat-builder -f /tmp/Modelfile"

Your Hardware

Device	GPU	VRAM	Training Capability
Laptop	RTX 3060	6GB	QLoRA for 3B-4B models
Server .206	None (CPU)	N/A	Inference only
Google Colab	T4	15GB	LoRA for 7B-13B models
Kaggle	T4 x2	30GB	QLoRA for 7B-13B models

License & Organization

Developed and maintained under strict data residency governance by NusaByte.
Licensed under the MIT Open Source License. Built by Shaidan Shaari (humm1ngb1rd).

🗡️ JEBAT — Because warriors remember everything that matters.

JEBAT v8.4.0 — Sovereign Agent OS & Agent Workstation

Public Service

Quick Start

Option 1: npx (Recommended — Zero Install)

Option 2: Global Install (via npm)

Option 3: Source Build

Installation — Three Surfaces, One Script

What gets installed (components)

Surface quick-reference

Local Unified Inference Stack (optional, --no-inference to skip)

Remote Ollama Endpoint

Configuration

Providers & Auth

Auth method — key / env / store

Models (refreshed catalog)

Local Ollama auto-start

Default provider

Platform Suite — 5 Products, 1 Memory

WebUI — Stealth-Dark Tactical Interface

WebUI Pages (13)

WebUI Enterprise Features (25)

WebUI API Endpoints

Core Commands

General

Workspace & Config Import

Agentix — Solution Lifecycle

Configuration & Memory

File & Tools

Platform Suite

Agent Orchestration

MCP Server Integration

Running JEBAT as an MCP Server

MCP Tools

IDE Configuration

Cursor / Windsurf / Zed

VS Code (via Continue / Cline extension)

JetBrains (via MCP Plugin)

Connecting to External MCP Servers

Keris — Sentinel Security

Scan Profiles

Perisai — Nexus Multi-Channel

Sahabat — Companion

autoMimpi & SelfLearn — Memory Dreams & Adaptive Learning

Dream Cycle (autoMimpi)

SelfLearn — Project Adaptation

REPL

Multi-Agent Orchestration

Agent Roles

Technical Comparison

Configuration

Quick Config Commands

System Architecture

Safety Classification Tiers

Security Hardening (v8.2.x)

Platform Support

Documentation

Model Fine-Tuning (JEBAT-Builder)

Free Cloud GPU Options

Paid Options (Cheapest)

Fine-Tuning Steps

Your Hardware

License & Organization

Reviews (0)

Local Unified Inference Stack (optional, `--no-inference` to skip)

Auth method — `key` / `env` / `store`