UGENT

Appearance

UGENT Feature List ​

A complete catalog of what UGENT can do, organized by category. Each feature links to its configuration guide or user manual where available.

Multi-Model LLM Routing ​

Route conversations to the right model automatically — or let users pick.

  • Multi-provider support — OpenAI, Anthropic, Google, DeepSeek, DashScope, Moonshot, GLM, MiniMax, OpenRouter, and any OpenAI-compatible endpoint. Configure each as a named instance and switch instantly. See LLM Providers.
  • Per-user model selection — Users can pick their own model from an allowlist you define. The choice persists per user and never affects others.
  • LLM instance failover — If one provider goes down, UGENT automatically tries the next configured fallback instance — no dropped conversations.
  • Cross-provider reasoning — Thinking and reasoning-effort parameters work across OpenAI, Anthropic, and OpenAI-compatible providers. UGENT translates the parameters so each provider gets the right format.
  • Prompt cache requests — Sends cache-control headers to providers that support them (Anthropic, OpenAI), reducing latency and cost on repeated context.
  • Unified multimodal input — Images, audio, and documents are normalized into a single input format that works across all providers. No per-provider image handling code needed.
  • Media generation — Generate images (Agnes, OpenAI, Google Nano Banana), video (Seedance 2.5 up to 30s 4K, Google Veo, Agnes), and audio (Seed Audio 1.0 with voice cloning and music). Delegated to specialized media providers via provider_target.

Context Intelligence ​

Ground every answer in your actual codebase, documents, and data.

  • Pre-LLM code context — Before the LLM responds, UGENT retrieves relevant code snippets from the context engine and injects them into the prompt. The LLM sees your code without you pasting it.
  • Knowledge graph — Builds a graph of code relationships (calls, imports, contains, references) during indexing. Ask "what depends on this function?" and get a structured answer. See Context page.
  • Hybrid search — Combines semantic vector search with lexical BM25 keyword matching, fused by Reciprocal Rank Fusion. The best of both worlds for recall and precision.
  • Cross-encoder reranking — Optional second-pass reranking improves relevance by 40–60% on top results. Supports self-hosted and cloud rerankers.
  • AST-aware chunking — Code is split on function, class, and struct boundaries — not arbitrary character windows. Supports 20+ languages including Rust, Python, TypeScript, Go, Java, Apex, and more.
  • Database understanding — Index PostgreSQL and MySQL databases. Ask data questions in plain English and get safe, auto-generated SQL grounded on auto-profiled table statistics. See Context page.
  • Salesforce intelligence — Index Salesforce DX projects (objects, fields, flows, permissions, layouts, Agentforce bots) and sync Salesforce record data into one unified knowledge graph. See Salesforce page.
  • External data connections — Tenants authorize their own SaaS accounts (HubSpot CRM today) through OAuth with PKCE and the engine indexes the records into their workspace. Read-only, tenant self-service, with per-connection access rules.
  • Standalone context daemon — ugent context-daemon runs only the context ingestion client — no LLM, no tools, no agent. Monitors multiple workspaces at once with per-workspace codebase IDs, tokens, and sync state.
  • Live / realtime sessions — /live opens a bidirectional WebSocket session for real-time voice and text interaction. Supports OpenAI Realtime, Azure OpenAI Realtime, and Google Gemini Live with full-duplex audio (opt-in live-audio feature).

Security ​

Keep secrets safe, block prompt injection, and enforce boundaries.

  • Injection Firewall — Source-boundary taint tracking prevents untrusted content (web pages, tool output, uploaded files) from issuing commands or exfiltrating secrets through the LLM. Strict mode blocks suspicious tool calls before they execute. See Security & Firewall.
  • Secret Vault — Store API keys and tokens in an encrypted local vault and reference them from config as @secret_ref handles. Two backends: OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) or an encrypted file vault with a passphrase. Secrets are only accepted via stdin pipe (clipboard piping with pbpaste / xclip) — never on the command line, never in shell history. Use ugent secret init/add/list/inspect/rotate/delete/audit to manage them. See Vault & Secrets.
  • Secret Broker — An optional local daemon that acts as a credential-injecting egress gateway. Two deployment modes: Native mode (each instance resolves keys from its own vault) or Shared broker mode (one machine-wide daemon holds all credentials, and every instance connects to it — the decrypted key lives in exactly one process). Supports 11 built-in LLM providers (OpenAI, Anthropic, Google, DeepSeek, DashScope, Moonshot, GLM, MiniMax, OpenRouter, Jina, Voyage) plus custom providers. Run as a Linux systemd service for production. Third-party apps can point their SDK at the broker gateway and use the bootstrap token as the API key — the broker swaps in the real credential. See Vault & Secrets.
  • OS sandbox for spawned processes — Kernel-enforced containment for everything UGENT runs: sandbox-exec (Seatbelt) on macOS, bubblewrap on Linux. Five spawn classes (bash, tooling, MCP servers, external agents, plugins) each get their own write-allowlist policy, credential directories are read-denied at the OS level where a shell command cannot walk past it, a startup probe asserts enforcement rather than presence, and workspace configs can only tighten the sandbox, never loosen it. Three modes: off, auto (default), and required (refuse to start unconfined). See OS Sandbox.
  • Session ownership on channels — A session records the actor whose turn created it, and reads of its transcript are checked against that owner. Knowing a session id is not enough to read it, and an unowned session is refused over a channel rather than treated as public.
  • Grants and leases — Access is deny-by-default. Configure per-secret grants that authorize specific consumers, purposes, allowed hosts, and TTLs. Every issue and denial is audited.
  • Environment projection — Run any command with secrets injected only into that child process's environment: ugent secret exec --env VAR=@secret_ref -- <command>. Works for any language, any tool, zero code changes.
  • Workspace trust — Each workspace is explicitly trusted before UGENT loads its config. Untrusted workspaces require onboarding consent, preventing accidental execution of malicious project-level config.
  • Approval-before-action — Every write operation (file edits, shell commands, API calls) can require explicit human approval before execution. Read-only operations auto-approve.
  • Unattended shell mode — For CI and automation, --allow-unattended-bash permits bash and Python execution after validator checks without authorizing native writes, session changes, or cron mutation.

Orchestration ​

Coordinate multiple agents, tools, and external systems.

  • Sub-agent delegation — A manager agent can dispatch specialist sub-agents (researcher, coder, tester, reviewer) with scoped tools and independent LLM instances. Results merge back automatically.
  • Swarm P2P — Trusted UGENT instances on different machines can delegate tasks to each other over an encrypted peer-to-peer channel. No central server required.
  • External agent monitor — Orchestrate Claude Code and OpenAI Codex sessions from inside UGENT. Use /claude or /codex to dispatch with full control over permission modes, iteration limits, and auto-resume policies.
  • Parallel tool execution — Multiple tools run concurrently by default (8 parallel calls). Read-only tools batch together; write tools serialize to prevent conflicts.
  • Background shell jobs — Long-running shell commands run in the background with push notification on completion. If a job times out, UGENT auto-adopts it so the result is never lost.
  • In-flight turn steering — Send additional instructions while the LLM is mid-turn. UGENT injects them before the next iteration without interrupting active tool calls.
  • Turn cancellation — Cancel an in-flight LLM response from the TUI (/recall) or the web UI. The cancellation is durable — pending tool calls are cleanly stopped and the turn is removed from history.
  • Retained sub-agents — A finished sub-agent keeps the context it built. Ask it more with a follow-up rather than briefing a fresh worker and paying to rebuild what it already knows. Workers age out from the last time they were addressed, not from when they finished, so one under active follow-up stays alive.
  • Task management — Track background and delegated tasks with /task status, /task stop, /task continue, and /task force-complete. Tasks survive crashes and can be resumed across sessions.

Continual Harness ​

Let the agent learn from a session, but keep a person in the loop. See Continual Harness.

  • Propose-only refinement — /refine reads a finished session and proposes small, evidence-backed edits to a durable set of operating lessons. Nothing reaches a model until you approve it with /harness approve.
  • Reviewable queue — List, inspect, approve, reject, or roll back proposals. /harness show prints the exact text that would be injected, and rollback reverses a whole refinement pass.
  • Oversight scope check — Proposals that would reduce oversight or widen what runs unsupervised are refused outright, never queued. A harness entry is injected into every future session, so an edit of that shape is a persistent change to supervision rather than one bad turn.
  • Bounded queue — A cap on pending proposals bounds both whether a pass runs and how many it may add, so the review queue stays something a person can actually read.
  • Closed on channels by default — The entry set is global, so approving an entry changes what every future session sees. Channel access is an explicit opt-in.

Memory ​

Remember everything that matters, scoped per user and workspace.

  • Multi-user memory — Each user has their own memory store. Preferences, decisions, contacts, and project facts are isolated by actor identity. One user's memories never leak to another.
  • Hybrid recall — Combines lexical full-text search (SQLite FTS5) with semantic vector search (LanceDB) so you find what you need whether you remember exact words or just the concept.
  • Context compaction — When a conversation gets too long, UGENT compresses older turns into a compact summary while preserving key facts and decisions. Compaction is isolated per user.
  • Memory scopes — Configure which memory tiers are active: core (always on), workspace (per-project), or global (cross-project). See Memory.

Message Pipeline ​

Shape every message before the LLM sees it.

  • Message Routing — Detect tags, complexity, or scope; inject context from your knowledge base; and restrict the toolset per rule. Combine detectors, rewriters, and actions into a flexible pipeline. See Routing.
  • Rule Engine — Define if-this-then-that rules that block, dispatch, or pass messages based on keywords, channels, or user identity. Boolean logic with all_of, any_of, and not. See Rule Engine.
  • Hook system — Register custom hooks at lifecycle points (BeforeAgentTurn, BeforeToolCall, AfterToolCall) to intercept and modify agent behavior. See Security & Firewall.
  • UCTR compression — Reversible tool-result compression stores full tool outputs in a compressed form and restores them on demand, keeping the active context lean without losing information.
  • Context overflow prevention — Automatically manages token budgets so conversations never exceed the model's context window. Older content is compacted or truncated before the LLM request is sent.
  • Context adaptive payload budget — Dynamically adjusts the context payload size based on the model's available window, ensuring maximum useful context without overflow.
  • Monotonic message ordering — Message order is assigned by the database, not by the clock, so an NTP correction, a laptop suspend, or a VM migration cannot reorder a transcript or make a tool result precede its own call.
  • Non-destructive compaction — Compacted and dropped turns stay on disk rather than being deleted. History is readable back in pages, so a summary never means the original is gone.
  • Translation routing — A dedicated routing plugin routes messages to a translation workflow based on language detection, with glossary and reference-text support.

Channels and Plugins ​

Connect UGENT to 13+ messaging platforms and build your own.

  • 13 channel plugins — WeChat, WeCom, Weixin, LINE, Discord, Slack, Telegram, DingTalk, Email, WhatsApp, Salesforce Chatter, Web, and Translation. Each runs as an isolated worker process.
  • Web streaming plugin — A real-time web chat interface with SSE streaming, file upload, drag-and-drop, voice input, and human-in-the-loop approval widgets.
  • Multimedia transfer — Images, audio, video, and documents are transferred across all channels with automatic format normalization.
  • Plugin lifecycle — Plugins are supervised processes with heartbeat monitoring, automatic restart, and graceful shutdown. Instance isolation prevents one plugin's crash from affecting others.
  • Plugin setup wizard — Interactive setup for each channel plugin with credential validation and test messaging.
  • Build your own — Use the plugin template to create custom channel or tool plugins in Rust. See Plugins guide.

Developer Experience ​

Tools that make working with UGENT fast and ergonomic.

  • LSP integration — Go-to-definition, find references, diagnostics, hover, and document symbols from real Language Server Protocol sessions. Supports Rust, Python, TypeScript, Go, Java, and more. Results are distilled as compact pointers, not raw payloads.
  • TUI mode — A full terminal user interface with chat history, streaming responses, tool-call visualization, model picker, and debug panel. See TUI Mode.
  • REPL and execute modes — Run UGENT headless for scripting and automation. ugent -x "your query" runs a single command and exits. See REPL & Execute.
  • Daemon mode — Run UGENT as a systemd service for production deployments. Auto-reloads config on file changes. See Runtime & CLI Flags.
  • Herdr integration — Terminal multiplexer integration with pane state reporting, tool metadata, and toast notifications.
  • Workspace switching — Use /cd <path> to switch workspaces at runtime without quitting. ugent --workspace <path> selects the workspace at startup.
  • Smart mascot — A status-aware terminal mascot that reflects agent activity (thinking, tool running, idle, error) for at-a-glance monitoring.
  • Setup hub — Interactive /setup wizard guides you through LLM provider configuration, audio setup, embedding model selection, context client defaults, and health checks.
  • Web activity feed — Real-time stream of sub-agent assignments and tool execution events, available via the web plugin for monitoring dashboards.
  • Tool output projection — Controls how much of each tool's output is visible to the LLM versus stored in history. Keeps the active context lean without hiding information the agent needs.

Scheduling and Automation ​

Set it and forget it — UGENT runs on your schedule.

  • Cron jobs — Schedule recurring tasks with full cron syntax. Jobs run in the background and report results via your configured channels. See Runtime & CLI Flags.
  • /loop and /goal — Self-paced autonomous loops. /loop runs a task repeatedly on a timer; /goal drives toward a success criterion with progress reporting. See Autonomous Runs.
  • Verification gates — A goal ends on the agent's own judgement, which can be confidently wrong. Configure your project's checks as a gate and completion is not accepted until they pass; a failure feeds the real error back for another attempt instead of a bare rejection. Reruns are skipped when nothing changed, except on the final attempt, which always runs for real so a skip can never be why a goal is declared blocked.
  • Autorun — Automatically execute configured commands on startup or on file changes.
  • Daemon config auto-reload — The daemon polls config files every 5 seconds and reloads on any change — no restart needed. Content fingerprints detect creation, removal, and edits.

Skills ​

Load specialized behaviors on demand.

  • Skill registry — Skills are markdown files that inject specialized instructions, tool guidance, or workflow templates into the agent's context. Loaded from workspace-local and global directories.
  • Claude Code compatibility — UGENT can load and execute skills designed for Claude Code, widening the available skill ecosystem.
  • Skill overrides — Configure per-skill trust levels, shell execution policy, and firewall rules. See Skills.

Multi-Tenancy and Administration ​

Manage multiple users, workspaces, and tenants.

  • Per-user model selection — Each user picks their preferred model from an allowlist. Selections persist and are isolated.
  • Multi-user memory isolation — Memory, context compaction, and session state are scoped per user. No cross-user data leakage.
  • Workspace isolation — Each workspace has its own config, plugins, skills, cron, and memory. Switch workspaces with /cd without cross-contamination.
  • Tenant Console — A standalone Next.js web console for managing the UGENT context engine in multi-tenant deployments. Super admins manage the full tenant lifecycle (create, suspend, delete, rotate keys) through a private management API. Tenants self-serve their own API keys, codebase indexing, and BYOK (bring-your-own-key) secrets through a public self-service API. The browser never holds an engine credential — every call happens server-side. Deploy alongside the engine via Docker.
  • Enterprise SSO — A centralized SSO broker authenticates users against your corporate OIDC identity provider (PingFederate, Entra, Okta) and hands the verified identity to ugent-web through a single-use, 30-second handoff code. Federated and password logins resolve to the same actor, so memory and per-actor access control carry over. External applications can pass federation_issuer/federation_subject so the same person shares one memory scope across CRM, portal, and helpdesk. The broker stores no passwords and assigns no roles; SAML has a built seam but no implementation yet. See SSO & Federated Identity.
  • Per-conversation isolation — Each conversation runs in its own session with independent state, memory scope, and tool registry. Conversations never interfere with each other, even under the same user.
  • RBAC — Role-based access control with granular permissions per domain (users, roles, documents, translation, workspace management).

Data Lifecycle ​

Keep your disk clean automatically.

  • Automatic disk cleanup — Old session data, compressed tool outputs, and stale checkpoints are cleaned up on a configurable schedule.
  • Session management — Sessions can be listed, resumed, checkpointed, and restored. Checkpoints capture the full agent state at a point in time for crash recovery.
  • Migration safety — Database schema migrations are validated at startup with a regression manifest. Unknown or inconsistent schemas are hard errors with actionable guidance.

Runtime and Performance ​

Built for speed and reliability.

  • Multi-core tokio runtime — N worker threads (default = CPU count) with 153+ async tasks across cores. CPU-bound work is offloaded to blocking threads to never stall the async runtime.
  • Runs anywhere — SSH, tmux, zellij, Herdr, Ghostty, Warp, Alacritty, iTerm2, WezTerm, Windows Terminal + WSL. OSC 52 clipboard over SSH.
  • Unified logging — A single logging facade routes messages to file, stderr, and the TUI debug panel simultaneously.
  • Graceful startup — Two-phase bootstrap reads config before the tokio runtime starts. LLM config errors are warnings, not crashes — the agent starts and you fix config interactively.

Released under the Private Beta License.

Copyright © 2026 UGENT Team