What is true, what is tested, and what is not yet.
The long-form companion to the product pages: the evidence behind every number, the limits we would rather you knew before a trial, and the defaults a security review should check.
Numbers that survive a technical diligence call.
The first three are checked against the source on every build, and the build fails when a page and the code disagree.
What is not true yet. Zybuu holds no SOC 2, ISO 27001 or HIPAA certification. There is no support SLA. A human red-team engagement remains outstanding and is not substitutable by the adversarial suite. Those are stated here rather than discovered later, because the buyers this is built for will ask — and an honest answer is worth more than a careful one.
What Abhed does not do.
Every row below is a constraint we would rather you knew before a trial than after one. Where there is a path forward it is stated; where the honest answer is "not yet", it says that.
| Constraint | What it means in practice |
|---|---|
| Vision needs a vision model | Abhed reads images, but only on a model that can see. A local text-only model refuses the attachment by name rather than guessing at it. |
| No failover | Several servers can share one Postgres, but a running turn
lives in the server process that started it. There is no
automatic failover, and a restart ends running turns. Accounts survive
it. Transcripts survive it on the Postgres
store — on the default in-memory store they do not. A finished
session can then be continued from its record by any node; a
turn that was in flight cannot. Background subagents and shells
end with the server; the server that next takes the session
over records them as lost, and their work is not
resumed. |
| Postgres only | The durable store is Postgres. Other databases are reachable through SSH and their own CLI, not a native driver. |
| The workbench terminal is screened, not judged | It is an interactive shell, and the sandbox is its boundary.
Deny rules screen each line as typed and miss what the shell
expands, recalls or runs from a script. Set
sandbox.terminal: "lines" for a policy decision on
every line. |
| Auth mode is restart-only | Switching between local accounts and an identity provider rebuilds the routing table, so it needs a restart. Everything else in settings applies live. |
| Prompt injection is contained, not solved | There is no complete defence, and we do not claim one. The architecture assumes injection sometimes succeeds and limits what it can reach: deny rules no mode or approval can override, no network for the sandboxed shell and web fetch off by default, and every observation tagged untrusted at ingest. |
| Only the shell is sandboxed | bash and the workbench terminal run in the
sandbox. The file tools, web fetch and search, SSH, the
Kubernetes tools and extensions run in the server's own
process, with its files and network, bounded by policy and by
whatever contains that process. |
| MCP servers run outside the sandbox | A stdio MCP server runs on the host as the user, with the user's network. Its tool calls still go through policy, but the server process itself is not contained. |
| The process tier bounds processes, not memory | On the default tier (bubblewrap on Linux, Seatbelt on macOS)
sandbox.max_procs caps new processes where Abhed can count
the user's processes; memory, CPU
and disk are not bounded, and there is no seccomp or Landlock
syscall filter. Use the container tier, which adds the engine's
default seccomp profile, drops every capability and limits
memory, processes and CPU, or the vm tier, which runs under
gVisor. A Linux fence preview adds Landlock, seccomp and
cgroups; it is off by default. |
| Accounts share one machine | On a server with several accounts, each person's sessions are their own, but every account works in one workspace, as one operating-system user. On the Community server they also share one secret store; from 1.2.5 the Team and Enterprise server keeps one per account. People who must not see each other's files need separate servers. |
| No certifications | No SOC 2, ISO 27001, HIPAA or FedRAMP. Air-gap deployment, a full audit trail and row-level security are what we have instead — and they are not the same thing as an audit. |
What a security review should know about 1.2.
The workbench terminal is bounded by the sandbox, not judged line by line.
Deny rules hold for every tool call, the agent's and a person's, and no mode or approval overrides them; at the
interactive prompt they are a best-effort screen on each line typed,
and miss what the shell expands, recalls or runs from a script.
sandbox.terminal: "lines" restores one policy-checked
command per line, and a managed policy with deny rules for
bash or for every tool gets that mode without the setting.
A line typed at a password prompt is recorded without its text, except
that on the container tier a password that also appears in the prompt
can be recorded.
Web search and web fetch are managed-only.
From 1.2.6 only the managed configuration can turn them on or set their
provider, endpoint, key or hosts. The same setting in a user's file,
-settings, a workspace or the environment is set aside and
recorded as config.refused; on a Team or Enterprise server
that record also lands in the admin audit.
Managed configuration binds the SDK.
A managed configuration binds the Go SDK, with or without ConfigDir, as well as -mode, /mode, abhed eval and abhed resolve: the permission mode, allow and deny rules, sandbox, syntax check and turn limit it sets may be tightened and never loosened, and the SDK runs bash in the managed sandbox when the managed file sets one. It does not bind the model endpoint, credentials and database set by ABHED_* environment variables, or the choice of model.
A refused override is an error, never a silent change.
The security posture lists what is bound and what is not. The changelog has every change, release by release.
Two guarantees an extension cannot add later.
A log you can replay, and isolation the database enforces. Both are properties of the Postgres store, which is one config line; the in-memory default keeps a trial simple and gives you neither.
The log is the session
The conversation is derived from events, not described by them. That is why replay is exact and forking from any step is cheap.
Append-only, enforced by the database
Update, delete and truncate are refused by triggers; the role the server runs as can only insert and read events; and the server refuses to start as a role that could alter the record. It is not hash-chained, so whoever holds the database owner's credentials can still change it.
Isolated by FORCE
A table's owner bypasses ordinary row-level security. A test read another tenant's rows until FORCE was added.
The data model has the detail.
We don't compete on the model. We run theirs, or yours.
Most regulated firms can accept a cloud vendor's terms through a region and a no-retention agreement. Abhed is for the ones that cannot: defence and intelligence contractors, sovereign and public-sector deployments, operational networks with no route out, and the banks whose policy is no cloud at all.
Cloud coding agents
- Built for
- One developer, one vendor's models
- Where the model runs
- The vendor's cloud
- Abhed's difference
- Runs where the data is, on any model, with policy and a record the organisation owns.
Terminal harnesses
- Built for
- One developer, many models, in a terminal — and better than Abhed for that developer
- Where the model runs
- Wherever you point it
- Abhed's difference
- Built for a platform team serving an organisation: users, tenants, policy, audit, a server, an SDK.
Agent frameworks
- Built for
- A Python team assembling agents
- Left to you
- The sandbox, the approvals, the audit log, the deployment
- Abhed's difference
- The assembled, hardened thing — with extensions, skills and MCP underneath for the parts that should be yours.
Abhed
- Built for
- Platform teams in places with no route out: defence, sovereign, OT, no-cloud finance
- Where it runs
- Laptop, rack, or air-gapped enclave — one binary
- Model
- Twenty providers, including the one on your GPUs
- What you own
- Every action, every decision, every byte — recorded and replayable.
Each category is described as its tools present themselves as of September 2026. If we have one wrong, tell us and we will fix it. Open-source agent platforms also run any model in a sandbox; Abhed's difference from them is the audit record and policy engine in the core, the signed offline bundle (Enterprise Edition), and the SDK that keeps the record and the policy engine.
The scaffold around the model decides more than the model does.
A controlled study ran three frontier models against three harness configurations on SWE-bench Verified. Changing the harness moved scores nearly eight times as much as changing the model, and six of the nine comparisons reversed which model looked better. The configuration that won had context compression, structured retries and rollback — three of the things Abhed is built out of.
Not a result about Abhed: it is a result about the layer Abhed is. Read the study, whose authors are clear that one experiment does not settle the ratio.