Nebula-AI

_{The Zero Layer workbench}

First, I would like to thank Almighty God, who is the source of all knowledge. Without Him, this would not be possible.

Nebula brings the working parts of a security engagement into one desktop surface: terminal, code, browser, assistant, files, notes, missions, findings, and reports.

AI can investigate, organize, and write. The operator defines the scope, grants authority, and decides what runs.

Work in one place. Move from research to a contained terminal, preserve useful output as evidence, and carry it into findings and reports without losing context.

Keep authority explicit. Scope enforcement, approval pauses, hard budgets, and isolated OCI execution sit between AI assistance and the systems under test.

Leave a durable trail. Content-addressed artifacts, append-only events, execution provenance, and integrity-manifested exports preserve how a conclusion was reached.

intent  →  assistance  →  approval  →  execution  →  evidence

Nebula supports hosted, local, and OpenAI-compatible model runtimes. A model provider is optional; the human terminal, evidence workflow, notes, findings, and reports remain available without one.

Use Nebula only on systems and networks you own or are explicitly authorized to test.

Nebula 3 preview builds for Linux x86_64 appear as nebula-v3.* prereleases on GitHub Releases. Choose a release with native artifacts and read its published notes before installing; checked-in release notes may also describe unpublished candidates. Docker or Podman is required for the container terminal and Docker-mode automation. Features in a source checkout may be ahead of the published preview.

The preferred installation method is the signed Nebula APT repository. Its archive-key fingerprint is:

1D90 1EB3 4C8C 1065 F118 680D 1C5C 924C B4B5 823D

Verify that fingerprint, add the current preview channel, and install:

sudo apt update
sudo apt install -y ca-certificates curl gnupg
curl -fsSL https://berylliumsec.github.io/nebula-apt/nebula-archive-keyring.asc |
  gpg --show-keys --fingerprint
curl -fsSL https://berylliumsec.github.io/nebula-apt/nebula-archive-keyring.asc |
  sudo gpg --dearmor --batch --yes -o /usr/share/keyrings/nebula-archive-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/nebula-archive-keyring.gpg] https://berylliumsec.github.io/nebula-apt prerelease main" |
  sudo tee /etc/apt/sources.list.d/nebula.list >/dev/null
sudo apt update
sudo apt install nebula
nebula

The prerelease channel is intentional while Nebula 3 is in preview. The DEB supports Debian, Ubuntu, Kali, and compatible systems. Future updates remain under administrator control through the normal APT workflow.

sha256sum --check --ignore-missing SHA256SUMS-linux-x64.txt
sudo apt install ./Nebula-<version>-linux-x86_64.deb

sha256sum --check --ignore-missing SHA256SUMS-linux-x64.txt
chmod +x Nebula-<version>-linux-x86_64.AppImage
./Nebula-<version>-linux-x86_64.AppImage

After launch, inspect the bundled Core and local runtime boundary:

nebula-core doctor --json

First launch: Nebula may need to download, prepare, and verify the official Kali image before terminal and automation features are ready. This can take several minutes depending on your connection and container runtime.

About preview builds

A build exists only when a nebula-v3.* entry and its native artifacts appear on GitHub Releases. Back up engagement data and review the release notes and checksums before use. Do not use pip install nebula-ai to install Nebula 3.

macOS, Windows, and Linux arm64 installers are not part of the current release matrix.

Install Python 3.11–3.13, Poetry 2.1.3, Node.js 20 with npm, the stable Rust toolchain, and the Tauri prerequisites for your operating system.

git clone https://github.com/BerylliumSec/nebula.git
cd nebula
poetry install --with dev
poetry run playwright install chromium
npm --prefix ui ci
npm --prefix ui run dev:desktop

The Playwright browser renders JavaScript-driven URL knowledge sources. Signed Linux installers include the locked Chromium headless runtime used by the packaged desktop. Source checkouts require the explicit installation step above; Nebula can also use an existing system Chrome or Chromium browser. The final command builds the local Nebula Core sidecar, starts the UI development server, and opens the native desktop directly from the checkout.

npm --prefix ui run build
poetry run nebula-core ui

python scripts/nebula3_version.py check
npm --prefix ui run build

Quit Nebula 2, preserve a backup of the engagement directory, and import it without modifying the source:

nebula-core import-2x "/path/to/nebula-2-engagement"

Verify the imported project and its evidence before deleting the original data. See Migrating from Nebula 2 for the complete integrity and recovery procedure.

• Nebula 3 guide
• Usage scenarios
• Automation runtime
• Local diagnostics
• Release notes
• Release process

_{Built for deliberate security work.}