Nexus
Local-first · agent-agnostic · open source

Your agents should not start from zero.

Nexus is the local continuity and trust layer between your AI agents, your knowledge, and your machine. Carry memory across sessions. Inspect what agents read. Guard what they run.

Start in 60 seconds Explore the source 
# install once, then connect any MCP client
npm install -g @hawon/nexus
nexus guard demo
nexus guard install
17MCP tools
0model API calls in core analysis
2declared direct dependencies

One local layer

Every agent gets continuity. Every action earns trust.

Nexus does not ask you to replace the tools you already use. It gives them durable context and a shared safety boundary.

01 / MEMORY

Remember the work

Search session history, extract reusable skills, and carry useful context forward with local semantic memory trained on your own corpus.

02 / TRUST

Guard the boundary

Frame untrusted content, quarantine clear prompt injection, redact secrets, and stop dangerous commands before execution.

03 / CONTEXT

Understand the codebase

Map architecture, review code, scan repository history, and give a new agent the context it needs without another hosted model.

Not another coding agent. The layer that makes your agents compound.

Nexus is infrastructure for the multi-agent world: persistent local context on one side, an inspectable execution boundary on the other.

Bring the agent you already use.

Claude Code Codex Cursor Cline Continue Any MCP client

The MCP server exposes memory, guard, review, secrets, codebase, configuration, and collection tools through one local interface.

Trust architecture

Assume detection can miss. Guard what happens next.

Nexus is a tripwire and structural backstop, not a sandbox. Its core design keeps trust decisions visible and local.

Untrusted input

Web, issues, docs

Normalize obfuscation, scan for injection, redact secrets, and always frame fetched content as data.

Your agent

Model-independent

The agent keeps working with the tools and model you chose. Nexus does not proxy model calls.

Proposed action

Command or write

Resolve obfuscation and judge capabilities such as fetch-and-execute, exfiltration, and destruction.

Evidence over theatre

The unflattering numbers ship too.

Every published claim maps to a reproducible command. Regression sets are labelled as regression sets, not passed off as independent evaluation.

Round 3+4 red-team replay 107 / 143 74.8% overall; now a regression corpus after hardening
Generalization tier 80.0% Fresh when authored; no longer an unseen evaluation set
Adaptive tier 71.6% Residual bypasses remain; pair Nexus with least privilege
Logic benchmark 100% P / 61% R Precision is prioritised over pretending every semantic attack is detectable

Reproduce locally with npm run benchmark:redteam and npm run benchmark:logic. See the repository for third-party benchmark methodology and pinned upstream revisions.

Built for the multi-agent era

Make every session safer—and more valuable than the last.

Open source, local-first, and useful without a model API key.

View Nexus on GitHub Open on npm