Kubic by Konic

Agentic coding, in your control.

Kubic is an open-source coding agent for the terminal, engineered for organizations that must govern how AI changes their code: every action is visible, every change is reversible, and every policy is enforced from the top down.

View on GitHubTalk to us about Kubic
npm install -g kubic
License
MIT
Runtime
Node 22.19+
Models
Any provider
Install
npm i -g kubic

Under control

Every action visible, every change reversible.

Enterprise-edition screens drawn in the language of the real terminal interface.

  1. Every plan is evaluated against the organization’s managed policy before a single tool runs. The policy decides which models, providers and tools a session may use, where it may write and which hosts it may reach; users, repositories and the model itself can narrow it, never widen it.

  2. Each prompt, tool call, approval and result is written to an audit ledger in which every record carries the hash of the one before it. Editing or removing a record breaks the chain, and kubic audit verify reports exactly where.

  3. Outbound traffic from agent commands passes through an egress proxy that admits only the domains policy allows. Secrets are masked before tool output reaches the model, and provider keys never reach the processes the agent starts.

  4. Irreversible operations stop at an approval card that states what the command does and why it was challenged. Decisions can be routed through an approval broker to the people accountable for them, and in the enterprise edition a production change can require more than one signer.

  5. Kubic runs against the models and infrastructure the organization chooses: a commercial provider, a regional endpoint, or a model served on its own hardware. Every team works under the same policy version, with the same ledger and the same perimeter, wherever its sessions run.

Kubic under enterprise policy: a sealed plan, policy allow, signed edits, a sandboxed test run, an egress request denied and the ledger entry sealed.
  • Highest-precedence policy layer, optionally signed
  • Allowed and denied tools, network and filesystem policy
  • kubic policy explain names the layer behind every decision

Open-source core

Built for the engineer at the keyboard.

The enterprise controls sit on an open-source agent that engineers choose to use. These are recordings of the Kubic TUI as it ships today.

  • A Kubic session in the terminal: the agent reads src/slug.js, edits it, runs the tests and reports the change.

    A session, step by step

    Each read, edit and command appears as it happens, with the model, context, spend and journal in the status line.

  • The Kubic approval card for rm -rf dist, marked destructive, with keys to allow, deny or edit the command.

    Approvals in the terminal

    Allow once, allow for the session, deny, deny with a comment, or edit the command before it runs.

  • The Kubic diff panel over the last change: src/slug.js with two lines added.

    Review and undo

    Ctrl+O shows the last change, Ctrl+R the session journal, and /undo restores a turn with or without git.

  • The Kubic session tree listing every prompt, answer and tool call in the session.

    Sessions that branch

    /tree lists every prompt, tool call and answer, and branches from any of them without losing the original line.

For the enterprise

Governance that holds at every layer.

An administrator sets policy once, in a managed configuration that takes precedence over every user, repository and model. Lower layers can only make it stricter.

  • Managed, signed policy

    Allowed models, providers and tools, network and filesystem policy, set in a managed layer that can be signed so a replaced file is refused. kubic policy explain names the deciding layer for any value.

    kubic policy explain

  • Tamper-evident audit ledger

    Every record is hash-chained to the one before it and kubic audit verify walks the chain. Records are delivered to syslog, HTTPS or OpenTelemetry collectors through a spool.

    kubic audit verify

  • Spend caps and cost reporting

    Per-run and per-day caps, where the lowest value set by any layer wins. kubic cost reports spend by user, team, model and day, with CSV export.

    kubic cost

  • Data loss prevention

    Provider keys never reach tool processes, live keys are scrubbed from what a run stores and prints, and redaction can scan sessions or tool output before the model reads it.

  • Sandbox and egress control

    An opt-in Seatbelt or bubblewrap sandbox confines bash to the workspace, away from credential paths and network sockets. An egress proxy limits traffic to allowed domains.

  • Repository trust

    A repository’s own configuration, roles and instructions load only after kubic trust, and a change asks again. Under a restricted project policy a repository cannot widen approvals.

    kubic trust

  • Identity, regions and networks

    Provider keys in the operating system keychain, OIDC workload identity in CI, provider regions with fallbacks, and the system certificate store for TLS-inspecting corporate proxies.

  • Automation and admin hooks

    Headless runs for CI and a GitHub Action, with organization-defined hooks before and after every tool call and at the end of each run.

    kubic run

Models

Any model, including your own.

Kubic works with Anthropic, OpenAI, Google, Amazon Bedrock and OpenRouter, or with any OpenAI-compatible endpoint you host. Paired with a Konic model deployed on your infrastructure, source code and prompts stay inside your network. Policy decides which models a team may use.

  • Konic
  • Anthropic
  • OpenAI
  • Google
  • Amazon Bedrock
  • OpenRouter
  • Self-hosted

MIT

Open-source core

The Kubic agent and TUI: any model, approvals, the change journal, branching sessions, the sandbox, managed policy, audit sinks and spend caps.

View on GitHub

Konic

Enterprise and industry editions

The same core, deployed and supported by Konic for regulated organizations, with multi-party approvals, fleet-wide governance and Konic models served on your own infrastructure.

Talk to us

FAQ

Frequently asked questions.

What is Kubic?
Kubic is Konic's open-source coding agent for the terminal. It reads code, edits files and runs commands with the model your organization chooses, records every change in a journal that can be reviewed and undone, and asks before anything risky runs.
Is Kubic free to use?
The Kubic agent and TUI are open source under the MIT license, including managed policy, audit sinks and spend caps. Enterprise and industry editions add deployment, support and governance across teams, delivered by Konic.
Which models does Kubic support?
Anthropic, OpenAI, Google, Amazon Bedrock and OpenRouter, and any OpenAI-compatible endpoint, including Konic models served on your own infrastructure. A managed policy can restrict which models and providers each team may use.
How are changes made reversible?
Every write is recorded in a change journal, including changes made through bash. The diff and journal panels show what changed, and /undo or kubic undo restores a turn whether or not the project uses git.
What can an administrator control?
A managed policy layer sets allowed models, providers and tools, network and filesystem policy, data redaction, spend caps and audit sinks. It takes precedence over every user, repository and model, which can narrow it but never widen it, and it can be signed so a replaced file is refused.
Does Kubic isolate the agent from my machine?
Not by default. Kubic runs in-process with the engineer's own authority. The opt-in Seatbelt or bubblewrap sandbox confines the bash tool's commands, and the egress proxy limits where they connect; file tools rely on workspace confinement and approvals.
Can Kubic prevent prompt injection?
No coding agent can promise that, and Kubic does not. Injected instructions can reach the model; approvals, the journal, admin hooks, the sandbox and the egress proxy limit what they can make Kubic do. Command detection is lexical and not complete, which is why the sandbox and the proxy do not depend on reading the command.
Can Kubic run in CI?
Yes. kubic run executes the same session headless, and the repository ships a GitHub Action that runs Kubic on a pull request and posts the result. Challenged actions are answered by an approval broker or pre-approval files, or refused.

Kubic

Bring Kubic to your engineering organization.

Start with the open-source agent today, or talk to us about managed policy, audit and on-prem models for your teams.

Book a demoView on GitHub