The agent harness for work that cannot leave the building.

The Community Edition is genuinely open source under the Apache License 2.0, and it is the whole harness: the agent loop, the tool contracts, the permission engine, the tiered sandbox, the append-only audit log, the CLI, the Go SDK, and a single-tenant server with its web console. It is not a demo, a trial, or a cut-down core — it is the product you run. The source is at github.com/zybuu-ai/abhed, released as v1.2.7 on 7 October 2026. Abhed is open core in the honest sense: some features are paid, and they are named in the next answer rather than discovered when you hit a wall.

The Team and Enterprise features are a separate, proprietary edition built on the same open module. They are: the multi-user server with OIDC, the admin and access dashboard, access policy, scheduled runs, multi-tenant isolation, audit export and retention (both planned), the signed air-gap bundle with its verifier, telemetry export, and a named support contact. Everything else — including the audit log itself and the SDK — is free and stays free. What each tier costs is on this page.

Yes. The binary is static, the web console is self-contained, and the documentation is embedded in the binary, so abhed serve carries its own manual with no network. Nothing leaves the machine except the calls to the model endpoint you configure, which can be a model on your own GPUs, and any web tool or MCP server you turn on. Copy the binary and a config into the enclave and it runs.

What the Enterprise Edition adds for the enclave is provenance, not capability: a signed offline bundle that is verified by signature before the installer runs, so a bundle failing its check never reaches the installer. The free binary runs offline without it; what you give up is the chain of custody you can show an auditor.

Twenty providers over three wire formats, and changing vendors is a line of config rather than a code change. That includes anything speaking an OpenAI-compatible API — vLLM, SGLang, TensorRT-LLM, llama.cpp or Ollama in front of a model on your own hardware — as well as hosted APIs if your policy permits them. Abhed does not ship a model and is model-agnostic by construction: the harness is the same whichever endpoint you point it at.

Run abhed doctor before you rely on one. It checks that the endpoint answers and that the model emits a structured tool call, because a model that describes a tool call in prose cannot drive an agent however well it writes. Details are in models and providers.

Every release publishes one archive per platform and a SHA256SUMS file beside them. The one-line installer downloads both and refuses to unpack anything whose checksum does not match; it makes no other change to your machine — no sudo, no shell profile edits, no telemetry. To do it by hand, fetch the archive and SHA256SUMS from the release page and run sha256sum -c SHA256SUMS --ignore-missing before extracting, exactly as the install steps show. The installer is a short shell script served from this domain — read it first; it is short on purpose.

Yes to both. Apache-2.0 lets you use it, modify it, ship it and sell services on it. The Go SDK gives your program the same loop, the same policy engine and the same record: your application supplies the approver and consumes the event stream, deny rules still hold, and an extension still cannot permit what a deny rule forbids. For anything not written in Go, abhed rpc is the same agent over JSONL.

One guarantee does not come with it, and it is the one to plan around: the SDK builds no sandbox unless the managed configuration sets one. Without one, an embedded agent runs commands with the privileges of the process that embedded it, so the host owns isolation — a container, a jail, a separate user. See the SDK guide.

Several Abhed servers can share one Postgres, but there is no automatic failover: a running turn lives in the server process that started it, and when that server stops or restarts, its running turns end with it. The durable store is Postgres and nothing else; the default in-memory store is there to make a single-machine trial simple and gives you neither the immutability triggers nor the row-level isolation. Prompt injection is contained rather than solved — the architecture assumes it sometimes succeeds and limits what it can reach. There is no support SLA, and a human red-team engagement remains outstanding and is not substitutable by the adversarial suite. The limitations table on the trust page states each of these, with what it means in practice.

No. The console at abhed.zybuu.com is a reference application built on the same SDK anyone else would use, and it runs on our own infrastructure, so accounts on it are by invitation. That invitation gate is about our hardware, not about the software: Abhed itself is public and downloadable, and you can run the same server yourself from the open repository without asking anyone. Request an invite if you would rather try it before you install it.