
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
Your AI agent that never forgets. Persistent memory, 25+ tools, 7 channels, 11+ LLM providers — runs entirely on your machine.
Your AI agent that never forgets.
Persistent memory, 25+ tools, 7 channels, 11+ LLM providers — runs entirely on your machine.
Website · Documentation · Community Skills
curl -fsSL https://zubo.bot/install.sh | bash
Or install via package manager:
bun add -g zubo # recommended
npm i -g zubo # also works
Then:
zubo setup # interactive config wizard (terminal or browser)
zubo start # launch the agent
The web dashboard opens automatically at http://localhost:<port>.
/help.AI Model to choose provider/modelAction Safety to control allowed actionsMemory in Replies to tune how much context is reusedSettings > API Keys for auth errorsSettings > AI Model for missing model errorsollama serve and pull the model firstUser Message
→ Channel (Telegram / Discord / Slack / WhatsApp / Signal / WebChat)
→ Message Router
→ Agent Loop (LLM + Tool Execution)
→ Tools (built-in, skills, integrations)
→ Memory (vector search, FTS5, document parsing)
→ Scheduler (cron, heartbeat, proactive tasks)
→ Response
→ Channel
→ User
All config lives in ~/.zubo/config.json. Run zubo setup for interactive configuration, or set values directly:
zubo config set activeProvider anthropic
zubo config set smartRouting.enabled true
zubo config set budget.monthlyLimitUsd 50
See the full configuration reference for all options.
| Channel | Setup |
|---|---|
| Web Chat | Enabled by default |
| Telegram | Add channels.telegram.botToken from @BotFather |
| Discord | Add channels.discord.botToken from Developer Portal |
| Slack | Add channels.slack.botToken + appToken (Socket Mode) |
Add channels.whatsapp, authenticate via QR | |
Add channels.email with IMAP/SMTP settings | |
| Signal | Install signal-cli, add channels.signal.phoneNumber |
| Service | Capabilities | Secret |
|---|---|---|
| GitHub | Issues, PRs, Repos | github_token |
| Gmail, Calendar, Docs, Drive, Sheets | google_api_key | |
| Notion | Pages, Databases, Search | notion_token |
| Linear | Issues, Projects | linear_token |
| Jira | Issues, Boards | jira_token |
| Slack | Messages | slack_token |
| Posts, Timeline, Search | twitter_bearer_token |
Set secrets through natural conversation: "Set my github_token to ghp_..."
zubo setup Interactive configuration wizard (terminal or browser)
zubo start [--daemon] Start the agent
zubo stop Stop the background daemon
zubo status Show runtime status
zubo logs [--follow] View or stream logs
zubo model [provider/model] Show or switch LLM
zubo skills Manage skills
zubo install <name> Install from registry
zubo search <query> Search the registry
zubo voice Continuous voice conversation mode
zubo eval Run reliability + safety checks
zubo auth create-key Create an API key
zubo export / import Backup and restore
Full reference at zubo.bot/docs/cli.html.
Across WebChat, Telegram, Discord, Slack, and other channels:
/help — quick command menu + docs link/status — runtime status/memory <query> — search saved memory/model — show current provider/model/model set <provider/model> — switch active model at runtime/tools [filter] — list available tools/permissions <tool> — view tool permission + scopes/permissions set <tool> <auto|confirm|deny> — override tool permission/budget — view budget usage and limits/budget pause|resume — pause/resume budget enforcementnpx tsc --noEmit and bun testMIT
Created by @thomaskanze
FAQs
Your AI agent that never forgets. Persistent memory, 25+ tools, 7 channels, 11+ LLM providers — runs entirely on your machine.
The npm package zubo receives a total of 28 weekly downloads. As such, zubo popularity was classified as not popular.
We found that zubo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.