nexel

A terminal-based AI coding agent. Type a task; the agent runs shell commands, reads/writes/edits files, and iterates until the task is done — with your approval at every mutating step.

No model key needed. With a Nexel access key (nx_sk_...) from your administrator, the CLI is fully working in under a minute — the model runs behind the Nexel gateway, and skills your administrator installs apply automatically. Prefer full control? BYOK mode connects directly to Azure OpenAI, OpenAI, Anthropic, or any OpenAI-compatible endpoint with your own key.

Install

npm i -g nexel-cli

Requires Node.js ≥ 18.

Quick start

nexel            # first run: paste your Nexel access key, then just type tasks
nexel "add input validation to src/api/users.ts and run the tests"   # one-shot
nexel config     # (re)run the setup wizard
nexel skills     # list the skills your agent has active (hosted mode)

Replies stream as they're generated. In hosted mode the startup banner shows which admin skills are active (e.g. skills: emails).

No setup at all if the key is in the environment:

NEXEL_API_KEY=nx_sk_... nexel "fix the failing test"

In the REPL, conversation history persists across tasks, so follow-ups like "now add tests" work. Type exit to quit. Ctrl+C once cancels the current task; twice exits.

Configuration

Almost everyone only needs their Nexel access key. Set it once and you're done:

export NEXEL_API_KEY=nx_sk_...      # or run `nexel config` to save it

Config is stored locally at ~/.nexel/config.json (file mode 0600). NEXEL_API_KEY alone is enough — the model is handled for you.

Advanced: bring your own model (optional)

Prefer to run the agent against your own provider instead of a Nexel key? Run nexel config and choose Azure OpenAI, OpenAI, Anthropic, or any OpenAI-compatible endpoint. Your key stays on your machine and talks to that provider directly.

Flags

| Flag | Effect | |---|---| | --provider <p> | Override provider for this run | | --model <m> | Override model / deployment name | | --base-url <u> | Override base URL (custom provider) | | --allow-outside-cwd | Allow file access outside the current directory | | --yolo | Dangerous. Skip ALL approval prompts — the agent can run any command and modify any file without asking. Only use in throwaway environments. |

Tools & safety model

The agent has exactly five tools:

| Tool | What it does | Approval | |---|---|---| | read_file | Read a file (truncated at 200 KB) | auto | | list_files | Recursive listing, 2 levels deep | auto | | bash | Run a shell command (120 s timeout, 10 MB output cap) | asked | | write_file | Write a file (shows a content preview) | asked | | edit_file | Exact-match replace (shows a red/green diff; old_str must be unique) | asked |

For each mutating action you're prompted (y)es / (n)o / (a)lways for this tool this session. Denying returns "User denied this action." to the model so it can adjust course. Paths that resolve outside your current directory are rejected unless you pass --allow-outside-cwd.

If a project has an AGENTS.md or NEXEL.md in the working directory, its contents are injected as project-specific instructions.

Security notes

• Hosted mode — with an nx_sk_ key, requests go to the Nexel gateway; the underlying model credentials never leave the server, and your administrator can revoke a key at any time. BYOK mode — your API key goes directly from your machine to your provider. Either way: no telemetry, no logging of keys.
• Config is stored at ~/.nexel/config.json with mode 0600 (owner read/write only).
• Read-only tools auto-execute; anything that mutates your system requires interactive approval.
• --yolo disables the approval gate entirely. Treat it like curl | sudo bash: fine in a container or scratch repo, reckless anywhere else.
• Long sessions are automatically compacted (summarized) through the same model you're already using — no separate third party sees your history.

Development

git clone <repo> && cd nexel-cli
npm install
npm run build        # tsc → dist/
npm test             # builds, then runs the mock-provider loop tests
node dist/cli.js     # run locally without installing
npm link             # or: make `nexel` available globally from this checkout

Publishing

npm run build
npm test
npm publish --access public

Bump versions with npm version patch|minor|major before publishing.

Non-goals

No TUI, no MCP/plugins, no web search, no telemetry. It's a small, auditable loop on purpose.

License

MIT