io.github.eidetic-works/nucleus

nucleus

Sovereign Agent OS — Persistent Memory, Governance & Compliance for AI Agents.

1.15.2
Version
remote + pypi
Transport
28
Tools

Security review

Review passed

Reviewed Jan 1, 2000.

  • tools: 28 tools scanned
  • metadata: scanned
  • packages: 1 checked

No findings.

Tools (28)

  • nucleus_governance

    Governance, Hypervisor & security tools for the Nucleus Agent OS. Actions: auto_fix_loop - Auto-fix loop: Verify->Diagnose->Fix->Verify (3 retries). params: {file_path, verification_command} lock - [HYPERVISOR] Lock a file/dir immutable (chflags uchg). params: {path} unlock - [HYPERVISOR] Unlock a file/dir. params: {path} set_mode - [HYPERVISOR] Switch IDE context: "red" or "blue". params: {mode} list_directory - [GOVERNANCE] List files in a directory. params: {path} delete_file - [GOVERNANCE] Delete a file (governed by Hypervisor). params: {path, confirm?}. HITL: requires confirm=true. watch - [HYPERVISOR] Monitor a file/folder for changes. params: {path} status - [HYPERVISOR] Report current security state of Agent OS curl - [EGRESS] Proxied HTTP fetch for air-gapped agents. params: {url, method?} pip_install - [EGRESS] Proxied pip install for air-gapped agents. params: {package} validate_strate

  • nucleus_features

    Feature tracking, proof generation & MCP server mounting. Actions: add - Add a feature. params: {product, name, description, source, version, how_to_test, expected_result, status?, tags?} list - List features. params: {product?, status?, tag?} get - Get feature by ID. params: {feature_id} update - Update feature fields. params: {feature_id, status?, description?, version?} validate - Mark feature validated. params: {feature_id, result} search - Search features. params: {query} mount_server - Mount external MCP server. params: {name, command, args?} thanos_snap - Trigger Instance Fractal Aggregation unmount_server - Unmount MCP server. params: {server_id} list_mounted - List mounted MCP servers discover_tools - Discover tools from mounted servers. params: {server_id?} invoke_tool - Invoke tool on mounted server. params: {server_id, tool_name, arguments?} traverse_mount - Recursively m

  • nucleus_sessions

    Session management, events, state & checkpoint tools. Actions: save - Save session for later. params: {context, active_task?, pending_decisions?, breadcrumbs?, next_steps?} resume - Resume a saved session. params: {session_id?} list - List all saved sessions check_recent - Check for recent session to resume (alias: "current") end - End work session. params: {summary?, learnings?, mood?} start - Mandatory session start protocol archive_resolved - Archive .resolved.* backup files propose_merges - Detect redundant artifacts, generate merge proposals garbage_collect - Archive stale tasks. params: {max_age_hours?, dry_run?} emit_event - Emit event to brain ledger. params: {event_type, emitter, data, description?} read_events - Read recent events. params: {limit?} get_state - Get brain state. params: {path?} update_state - Update brain state. params: {updates} checkpoint

  • nucleus_tasks

    Task management, depth tracking & ADHD context-switch tools. Actions: list - List tasks. params: {status?, priority?, skill?, claimed_by?, required_role?} get_next - Get highest-priority unblocked task. params: {skills, required_role?} claim - Atomically claim a task. params: {task_id, agent_id} update - Update task fields. params: {task_id, updates} add - Create a new task. params: {description, priority?, blocked_by?, required_skills?, source?, task_id?, skip_dep_check?, required_role?, plan_ref?} (alias: "create") import_jsonl - Import tasks from JSONL. params: {jsonl_path, clear_existing?, merge_gtm_metadata?} escalate - Escalate task for human help. params: {task_id, reason} depth_push - Go deeper into subtopic. params: {topic} depth_pop - Come back up one level depth_show - Show current depth state depth_reset - Reset depth to root depth_set_max - Set

  • nucleus_sync

    Sync, artifact, trigger & deploy management for multi-agent coordination. Actions: identify_agent - Register agent identity. params: {role, provider, session_id} (per ADR-0005 §D1) OR legacy {agent_id, environment, role?} (coerced per §D5 until end of Cycle C+2) sync_status - Check current multi-agent sync status sync_now - Manually trigger sync. params: {force?} sync_auto - Enable/disable file watching. params: {enable} sync_resolve - Resolve a file conflict. params: {file_path, strategy?} read_artifact - Read an artifact file. params: {path} write_artifact - Write to an artifact file. params: {path, content} list_artifacts - List artifacts. params: {folder?} trigger_agent - Trigger an agent via event. params: {agent, task_description, context_files?} get_triggers - Get all defined neural triggers evaluate_triggers - Evaluate triggers for an event. params: {event_type, emitter} start_deploy_poll - St

  • nucleus_next_message

    Get the next unread relay message. One call — returns full message body and auto-acks. Long-poll (60s timeout). This is the agent's idle loop. Call it, get a message or None, act or re-call. No separate inbox + ack dance. The agent's loop: 1. nucleus_next_message() → blocks up to 60s for a message 2. If message: handle it (execute task, respond to comment, etc.) 3. Re-call nucleus_next_message() — always re-arm, never sit idle 4. Never stop the loop Role is auto-detected from posture (.brain/posture/current.json). No args needed. Returns: dict with: message: full relay message (id, from, subject, body, priority, task_id) or None acked: True if message was auto-acked waited_seconds: how long the poll ran

  • nucleus_relay_subscribe

    Long-poll subscription that pushes ctx.info() on each new inbox file. Replaces bash polling daemons (watch-relay-*.sh) with server-initiated push. Call once at session start (e.g. via SessionStart hook). Server holds the subscription, watches the calling agent's role-specific inbox dir, and fires info-level notifications on each new relay file arrival. Client re-calls this in a loop for persistent coverage. Per PR #1 (CCR-inversion-for-relay-pickup): `inbox_filter` parameter added to BYPASS role-based dir resolution. Use when role detection is unreliable OR when subscribing to a specific canonical inbox (e.g., 'cc_tb'). Closes 3-week-old feedback_relay_arrival_invisible_midsession HARD RULE.

  • nucleus_ccr_arm

    One-shot convenience: resolve canonical inbox + arm long-poll subscription. Per PR #2 (CCR server-side auto-arm) — IDE-agnostic relay-arrival arming. This is the RECOMMENDED entry point for SessionStart auto-arming across all MCP clients (Claude Code, Antigravity, Cursor, Windsurf, etc.). Equivalent to: 1. resolve_canonical_inbox_name(role) → canonical inbox name 2. nucleus_relay_subscribe(inbox_filter=<canonical>, timeout_seconds=...) Why this exists vs nucleus_relay_subscribe + inbox_filter: nucleus_relay_subscribe + inbox_filter requires the caller to KNOW the canonical inbox name for their role. nucleus_ccr_arm hides that step. Agent just calls nucleus_ccr_arm() with no args; server detects role from CC_SESSION_ROLE / NUCLEUS_SESSION_ROLE env OR detect_session_role().

  • nucleus_wakeup_wait

    Quick scan for a PENDING task. Returns the task directly if one is available, or None if no task is ready within the timeout. Default timeout is 5s (non-blocking). The agent should NOT loop on this — tasks arrive via relay push. This is a fallback for when the agent wants to check for tasks without waiting for a relay. No args needed — the role is auto-detected from posture (.brain/posture/current.json) or NUCLEUS_AGENT_ROLES env var.

  • nucleus_orchestration

    Satellite view, commitments, loops, patterns & metrics. Actions: satellite - Unified satellite view. params: {detail_level?} scan_commitments - Scan artifacts for new commitments archive_stale - Auto-archive commitments older than 30 days export - Export brain to zip list_commitments - List open commitments. params: {tier?} close_commitment - Close a commitment. params: {commitment_id, method} commitment_health - Get commitment health summary open_loops - View all open loops. params: {type_filter?, tier_filter?} add_loop - Add a new open loop. params: {description, loop_type?, priority?} weekly_challenge - Manage weekly challenge. params: {action?, challenge_id?} patterns - Manage learned patterns. params: {action?} metrics - Get coordination metrics pr_watch - Enumerate stale PRs (>N days), classify (auto-mergeable / billing-stuck / needs-verdict), fire one relay pe

  • nucleus_telemetry

    LLM tiers, telemetry, PEFS notifications & protocol tools. Actions: set_llm_tier - Set default LLM tier. params: {tier} get_llm_status - Get LLM tier configuration record_interaction - Record user interaction timestamp value_ratio - Get Value Ratio metric check_kill_switch - Check Kill Switch status pause_notifications - Pause PEFS notifications resume_notifications - Resume PEFS notifications record_feedback - Record notification feedback. params: {notification_type, score} mark_high_impact - Mark loop closure as high-impact check_protocol - Check protocol compliance. params: {agent_id} request_handoff - Request agent handoff. params: {to_agent, context, request, priority?, artifacts?} get_handoffs - Get pending handoffs. params: {agent_id?} agent_cost_dashboard - Get agent cost tracking dashboard dispatch_metrics - Get dispatch telemetry (per-action timing, error rates) rate_limit_status -

  • nucleus_slots

    Orchestration slots, sprints & mission management. Actions: orchestrate - THE GOD COMMAND. params: {slot_id?, model?, alias?, mode?} slot_complete - Mark task complete. params: {slot_id, task_id, outcome?, notes?} slot_exhaust - Mark slot exhausted. params: {slot_id, reset_hours?} status_dashboard - ASCII dashboard. params: {detail_level?} autopilot_sprint - Sprint command. params: {slots?, mode?, halt_on_blocker?, halt_on_tier_mismatch?, max_tasks_per_slot?, budget_limit?, dry_run?} force_assign - Force assign task. params: {slot_id, task_id, acknowledge_risk?} autopilot_sprint_v2 - Enhanced sprint V3.1. params: {slots?, mode?, halt_on_blocker?, halt_on_tier_mismatch?, max_tasks_per_slot?, budget_limit?, time_limit_hours?, dry_run?} start_mission - Start mission. params: {name, goal, task_ids, slot_ids?, budget_limit?, time_limit_hours?, success_criteria?} mission_status - Get mission status. params: {mission_id?} halt_sprint

  • nucleus_infra

    Infrastructure: file changes, cloud, marketing & strategy tools. Actions: file_changes - Get pending file change events gcloud_status - Check GCloud auth status gcloud_services - List Cloud Run services. params: {project?, region?} list_services - List Render.com services scan_marketing_log - Scan marketing log for failures synthesize_strategy - Analyze marketing & update strategy. params: {focus_topic?} status_report - Generate State of the Union. params: {focus?} optimize_workflow - Self-optimize workflow cheatsheet manage_strategy - Read/Update strategy doc. params: {action, content?} update_roadmap - Read/Update roadmap. params: {action, item?} growth_pulse - Full growth pipeline: brief→metrics→streak→compound. params: {write_engrams?} capture_metrics - Refresh GitHub+PyPI metrics + gate evaluation. params: {write_engram?}

  • nucleus_agents

    Agent spawning, critic, swarm, memory, ingestion & dashboard tools. Actions: spawn_agent - Spawn Ephemeral Agent. params: {intent, execute_now?, persona?, confirm?}. HITL: requires confirm=true. apply_critique - Apply critique fixes. params: {review_path} orchestrate_swarm - Start multi-agent swarm. params: {mission, agents?} search_memory - Search long-term memory. params: {query} read_memory - Read memory category. params: {category} respond_to_consent - Respond to respawn consent. params: {agent_id, choice?} list_pending_consents - List agents awaiting consent critique_code - Run Critic review. params: {file_path, context?} fix_code - Auto-fix code. params: {file_path, issues_context} session_briefing - Get session briefing. params: {conversation_id?} register_session - Register session focus. params: {conversation_id, focus_area, role?, tier?, charter_path?, parent_session?}. Tier ∈ {opus,sonnet,h

  • nucleus_federation

    Federation management for multi-brain coordination. Actions: status - Get comprehensive federation status join - Join a federation via seed peer. params: {seed_peer} leave - Leave the federation gracefully peers - List all federation peers with details sync - Force immediate synchronization with all peers route - Route a task to the optimal brain. params: {task_id, profile?} health - Get federation health dashboard

  • nucleus_engrams

    Engrams, health, observability, DSoR & tier system tools. Actions: health - Get system health status version - Get Nucleus version info export_schema - Export MCP toolset as JSON Schema performance_metrics - Get perf metrics. params: {export_to_file?} prometheus_metrics - Get Prometheus metrics. params: {format?} audit_log - View cryptographic interaction log. params: {limit?} write_engram - Write engram to memory. params: {key, value, context?, intensity?}. context: Feature|Architecture|Brand|Strategy|Decision. intensity: 1-10. (alias: "add") query_engrams - Query engrams. params: {context?, min_intensity?, limit?}. limit default 50, max 500. search_engrams - Search engrams. params: {query, case_sensitive?, limit?}. limit default 50, max 500. (alias: "search") governance_status - Get governance status morning_brief - Daily Nucleus Morning Brief hook_metrics - Monitor auto-write engram h

  • nucleus_relay

    Relay-substrate facade — post / read / ack / status. Actions: post - Send a relay envelope. params: {to, subject, body, sender?, priority?, in_reply_to?, context?, id?, from_session_id?} sender? auto-fills from your session role when omitted. to accepts short role aliases: main, peer, tb, ops, agy, board. "recipient" is accepted as an alias for "to". Returns {sent: bool, id: str (server message_id), error?: str}. inbox - List inbox messages. params: {role?, unread_only?, limit?} role auto-fills from CC_SESSION_ROLE env. Returns {messages: [...], role: str}. ack - Mark messages seen. params: {message_ids: [str], role?} Returns {acked: int, failed: int}. status - Diagnostic (no server call). params: {role?} Returns {is_http_mode, relay_url_set, bearer_set, canonical_role, resolved_inbox_dir}. Bearer resolves per-role at call-time (~/.tb/relay_token_<

  • nucleus_route

    W5 tier routing — route a prompt to the optimal model tier. Actions: route - Route a prompt to cheapest capable model. params: {prompt, complexity?, context?, estimated_output_tokens?} complexity ∈ 'routine' | 'complex' | 'sovereign' (default 'routine') Returns: provider, model, cost estimates, sovereignty tier.

  • nucleus_audit

    W8 Team-tier tamper-evident audit log (SHA-256 hash chain). Actions: log_event - Append an audit event to the chain. params: {event_type, actor, resource, outcome, metadata?, team_id?, ts?} query - Single-tenant query. Rejects team_id='*'. params: {team_id, since?, until?, actor?, event_type?, limit?, offset?} admin_query - Cross-tenant query (team_id='*' allowed). Requires NUCLEUS_AUDIT_ADMIN_TOKEN env match. Logs every successful call to the synthetic '__admin__' chain. params: {admin_token, team_id?, since?, until?, actor?, event_type?, limit?, offset?} verify - Verify SHA-256 chain integrity for a team. params: {team_id}

  • nucleus_delegate

    Hand a coding or review task to a cross-vendor lane — a cheap, non-Claude agent that does the work for you. Use this INSTEAD OF shelling out to any CLI: it picks the vendor, injects the correct per-vendor permission flags, captures all output synchronously, and reports a real status. Do NOT run `agy`/`devin` yourself in Bash — the raw CLIs take DIFFERENT per-vendor flags (pass the wrong one and a build silently makes ZERO edits yet exits 0), and hand-driven background calls flush output late (a finished call looks empty for tens of seconds). This tool is the only robust path. First call `list` — it needs no setup, confirms cross-vendor is enabled, and shows each vendor's selectable_models + default_model. If dispatch/review return a disabled error, cross-vendor is OFF: run `nucleus onboard` once (one-time), then retry. Actions: dispatch - Hand a task to a cross-vendor lane. params: {vendor, prompt, artifact_ref, mode?, model?, expect_paths?, to?} REQUIRED: vendor ∈ 'agy

  • nucleus_lane_init

    Set up an autonomous task-execution loop in a git repo. WHEN TO USE: you have a list of tasks (bugs, features, tests) you want executed automatically without manual prompting — the lane runs watcher/executor/secretary daemons that claim tasks, invoke an LLM to implement them, and independently verify the results. Use this when you want to batch-execute a backlog of well-defined tasks. Creates .brain/, SPEC.md template, and pins via git tag.

  • nucleus_lane_start

    Start autonomous lane daemons (watcher + executor + secretary) in background. WHEN TO USE: after nucleus_lane_init and SPEC.md is written — this launches the loop that autonomously claims and executes tasks. The executor invokes an LLM CLI (devin/agy) per task; the secretary independently verifies each result. Runs until nucleus_lane_stop is called.

  • nucleus_lane_stop

    Stop all running lane daemons. WHEN TO USE: when all tasks are CONFIRMED or you want to pause autonomous execution.

  • nucleus_lane_status

    Check lane status: task counts (PENDING/IN_PROGRESS/DONE/CONFIRMED), daemon health, spec verification. WHEN TO USE: after starting a lane to monitor progress, or before starting to check if a lane is already running.

  • nucleus_lane_feedback

    Report friction/bugs/enhancements to the nucleus team. WHEN TO USE: when the lane misbehaves, a task fails unexpectedly, the SPEC.md format is confusing, or you have an improvement idea. Creates a GitHub issue on the public nucleus-mcp repo (cross-machine visible) AND stores locally. Requires gh CLI auth'd.

  • nucleus_plan_execute

    Execute a plan file autonomously. WHEN TO USE: you have a plan file (.brain/plans/*.md) you want executed autonomously — parses the plan, creates tasks, starts a mission with budget/time limits. Chains import_plan_as_tasks() then _brain_start_mission_impl() and returns the mission status string.

  • nucleus_plan_import

    Import a plan file as PENDING tasks without starting a mission. WHEN TO USE: you have a plan file (.brain/plans/*.md) you want loaded into the task store so the executor daemon / sprint mission can pick the tasks up later — but you don't want to start a mission right now.

  • nucleus_plan_list

    List available plan files in .brain/plans with task counts. WHEN TO USE: you want to discover which plan files exist and how many tasks each contains before importing or executing one. Returns: JSON string: a list of dicts each with ``{"name", "path", "size_bytes", "task_count", "format"}``. Missing directory returns ``[]``.