Nexus is a local trust layer between your AI agents, the content they read, and your machine. Inspect what agents read. Guard what they run. Keep a local memory store they can search.
# install, try the demo, then add the Claude Code hooks (other MCP clients: add nexus-mcp) npm install -g @hawon/nexus nexus guard demo nexus guard install
One local layer
Nexus does not ask you to replace the tools you already use. It gives them a shared safety boundary and a local store of context.
Save notes, pages, feeds, and documents into a local store and search it from any MCP client, with Korean–English query expansion. Agents recall it when they call the search tool; automatic capture and recall across sessions are planned, not built yet.
Frame untrusted content, quarantine clear prompt injection, redact secrets, and stop dangerous commands before execution. In Claude Code, also ask before an agent edits CLAUDE.md, settings or hooks, and flag changes you did not approve at the next session start. It warns and gates; it cannot stop Claude Code from loading a changed file.
Map architecture, review code, scan repository history, and give a new agent the context it needs without another hosted model.
Not another coding agent. A local boundary around the ones you use.
Nexus is infrastructure for the multi-agent world: an inspectable execution boundary on one side, a local context store on the other.
The MCP server exposes 13 default tools — guard, prompt-injection scan (which now returns the same verdict as nexus_guard), secrets, memory search/save/forget, session and collection tools — through one local interface. Five heuristic, low-precision tools (code review, codebase map/onboard, test health, config validation) are off by default and registered only when NEXUS_EXPERIMENTAL_TOOLS=1. Automatic hooks exist for Claude Code (nexus guard install) and Codex CLI (nexus guard install --codex --trust: Codex runs only the hooks you trust). Codex hooks cannot ask for confirmation or reframe output, so under Codex Nexus blocks what Claude Code would ask about, replaces output it blocks or that holds a credential, and adds only a note to other flagged output; clean output is not framed. Other clients call tools such as nexus_guard themselves.
Trust architecture
Nexus is a tripwire and structural backstop, not a sandbox. Its core design keeps trust decisions visible and local.
Normalize obfuscation, scan for injection, redact secrets, and always frame fetched content as data inside a per-call nonce boundary.
The agent keeps working with the tools and model you chose. Nexus does not proxy model calls.
Resolve obfuscation and judge capabilities such as fetch-and-execute, exfiltration, and destruction.
Evidence over theatre
Every published claim maps to a reproducible command. Regression sets are labelled as regression sets, not passed off as independent evaluation.
Reproduce locally with npm run benchmark:redteam and npm run benchmark:logic. See the repository for third-party benchmark methodology, pinned upstream revisions, and the known limitations of the guard.
Built for the multi-agent era
Open source, local-first, and useful without a model API key.