Xum
Open-source desktop app for Mac, Windows and Linux. Agents run on your computer or on your own server.
Product websitexum.coder.com Compare with others Missing or wrong data?
- Desktop app
- Mac, Windows and Linux
- Browser
- Yes
- Phone
- Phone browser
- Command line
- Yes
- Agents
- No
- Your subscription
- No
- Agents run
- On your computer and on your own server
- Laptop closed
- Keeps going
- Isolation
- Worktree and Container
- Parallel agents
- Yes
- Scheduled runs
- Yes
- Coordinator agent
- Yes
- Built-in issues
- No
- Pull requests
- Yes
- Review screen
- Yes
- Team
- Not listed
- Self-hosting
- Yes
- Licence
- AGPL-3.0
- Price from
- Free
- How it charges
- No paid plan and bring your own key
- Paid plans from
- Not listed
Receipts
- Checked
- · oldest answer 2026-11-07
- Findings
- 45 published · 24 cross-checked by a second agent · read them all
- Sources
- 46 public pages on 3 sites: xum.cdr.dev, raw.githubusercontent.com, github.com
- Screenshot
- github.com, retrieved · first party repository · shows appearance, not capability
- Data
- /products/xum.json · .md
- Method
- Same rules for all 103 researched ADEs. How we check · Report wrong data
What it does
Where you use it
Desktop, browser/mobile web, CLI and editor access are documented.
Source and scope for Where you use itAgents it runs
Xum has its own agent runtime and multiple model providers.
Source and scope for Agents it runsAccounts and subscriptions
Provider keys, local endpoints and provider-specific OAuth are distinct. Source shows Codex OAuth uses ChatGPT subscription tokens inside Xum's own agent loop rather than through the Codex CLI's login.
Source and scope for Accounts and subscriptionsWhere agents run
Local and owned-host modes are distinct from client location.
Source and scope for Where agents runHow work is kept apart
Worktree and container runtimes provide different boundaries.
Source and scope for How work is kept apartScheduled runs
Agent heartbeat tools and external CI can schedule work.
Source and scope for Scheduled runsGit and pull requests
Task branches and patch integration are native; PR operations use external tools.
Source and scope for Git and pull requestsPrice
Xum distributes its AGPL application and installers without a paid Xum tier. Users configure model API credentials or their own local endpoints; model/provider and user-host costs remain separate.
Source and scope for PriceTyped filters
Every value links to its receipt below. Read plan and surface restrictions before using a filter to decide.
| Filter | Value |
|---|---|
| Desktop OS: macOS | Yes cross-checked |
| Desktop OS: Windows | Yes cross-checked |
| Desktop OS: Linux | Yes cross-checked |
| Web client | Yes cross-checked |
| Phone access: Native iOS | No |
| Phone access: Native Android | No |
| Phone access: Phone browser | Yes cross-checked |
| CLI | Yes cross-checked |
| Coding agents: Claude Code | No |
| Coding agents: Codex | No |
| Coding agents: Cursor Agent | No |
| Coding agents: Gemini CLI | No |
| Coding agents: OpenCode | No |
| Coding agents: Pi | No |
| Coding agents: Grok | No |
| Coding agents: Aider | No |
| Coding agents: Antigravity | No |
| Use my subscription | No |
| Where agents run: On your computer | Yes |
| Where agents run: On your own server | Yes |
| Where agents run: In the vendor's cloud | No |
| Workspace isolation: Git worktree | Yes |
| Workspace isolation: Container | Yes |
| Workspace isolation: VM or microVM | No |
| Parallel runs | Yes cross-checked |
| Coordinator | Yes cross-checked |
| Native issue tracking | No |
| Unattended triggers | Yes cross-checked |
| Shared prompting | Unknown |
| Team roles | No |
| SSO | No |
| Pull request workflow | Yes cross-checked |
| Review interface | Yes cross-checked |
| Product license: Apache-2.0 | No. AGPL-3.0 cross-checked |
| Product license: MIT | No. AGPL-3.0 cross-checked |
| Product license: GPL-3.0 | No. AGPL-3.0 cross-checked |
| Product license: GPL-3.0-or-later | No. AGPL-3.0 cross-checked |
| Product license: AGPL-3.0 | Yes. AGPL-3.0 cross-checked |
| Product license: AGPL-3.0-or-later | No. AGPL-3.0 cross-checked |
| Product license: Elastic License 2.0 | No. AGPL-3.0 cross-checked |
| Product license: Custom terms | No. AGPL-3.0 cross-checked |
| Product license: Proprietary | No. AGPL-3.0 cross-checked |
| Self-hosting | Yes cross-checked |
| Telemetry opt-out | Yes cross-checked |
| Free access | Yes cross-checked |
| Starting price: Free | Yes. Free |
| Starting price: Up to $20/month | No. Free |
| Starting price: $21–40/month | No. Free |
| Starting price: $41–100/month | No. Free |
| Starting price: Over $100/month | No. Free |
| Starting price: Contact for pricing | No. Free |
| Pricing model: Free, no paid plan | Yes |
| Pricing model: Free plan | No |
| Pricing model: Subscription | No |
| Pricing model: Per seat | No |
| Pricing model: Usage-based | No |
| Pricing model: Per machine or compute | No |
| Pricing model: Bring your own key | Yes |
| Pricing model: One-time purchase | No |
| Paid plans from: No paid plan | Unknown |
| Paid plans from: $10 or less/month | Unknown |
| Paid plans from: $11–20/month | Unknown |
| Paid plans from: $21–40/month | Unknown |
| Paid plans from: $41–100/month | Unknown |
| Paid plans from: Over $100/month | Unknown |
| Paid plans from: Contact sales | Unknown |
| Lifecycle status: Active | Unknown |
| Lifecycle status: Sunsetting | Unknown |
| Keeps going with laptop closed | Yes |
| Open-source license | Yes. AGPL-3.0 cross-checked |
| Any desktop app | Yes cross-checked |
| Paid plan up to $20/month | Unknown |
| Paid plan up to $40/month | Unknown |
| Any phone client | Yes cross-checked |
Filter receipts
Desktop OS: macOS: Yes cross-checked
Desktop OS: macOS
Typed value: Yes.
Desktop, browser/mobile web, CLI and editor access are documented.
- Desktop os: macOS Intel/ARM, Linux AppImage and Windows alpha installer.
- Browser: xum server web interface.
- Mobile browser: Server can be accessed from phone browser.
- Cli: @coder/xum run/workflow/server/acp commands.
- Editor extensions: VS Code/Cursor extension and ACP editor bridge.
- Task actions: Browser manages server workspaces; server window lacks desktop-only editor/file-picker/voice/notification features.
- Notifications: Native OS completion/notify alerts.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
Desktop OS: Windows: Yes cross-checked
Desktop OS: Windows
Typed value: Yes.
Desktop, browser/mobile web, CLI and editor access are documented.
- Desktop os: macOS Intel/ARM, Linux AppImage and Windows alpha installer.
- Browser: xum server web interface.
- Mobile browser: Server can be accessed from phone browser.
- Cli: @coder/xum run/workflow/server/acp commands.
- Editor extensions: VS Code/Cursor extension and ACP editor bridge.
- Task actions: Browser manages server workspaces; server window lacks desktop-only editor/file-picker/voice/notification features.
- Notifications: Native OS completion/notify alerts.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
Desktop OS: Linux: Yes cross-checked
Desktop OS: Linux
Typed value: Yes.
Desktop, browser/mobile web, CLI and editor access are documented.
- Desktop os: macOS Intel/ARM, Linux AppImage and Windows alpha installer.
- Browser: xum server web interface.
- Mobile browser: Server can be accessed from phone browser.
- Cli: @coder/xum run/workflow/server/acp commands.
- Editor extensions: VS Code/Cursor extension and ACP editor bridge.
- Task actions: Browser manages server workspaces; server window lacks desktop-only editor/file-picker/voice/notification features.
- Notifications: Native OS completion/notify alerts.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
Web client: Yes cross-checked
Web client
Typed value: Yes.
Desktop, browser/mobile web, CLI and editor access are documented.
- Desktop os: macOS Intel/ARM, Linux AppImage and Windows alpha installer.
- Browser: xum server web interface.
- Mobile browser: Server can be accessed from phone browser.
- Cli: @coder/xum run/workflow/server/acp commands.
- Editor extensions: VS Code/Cursor extension and ACP editor bridge.
- Task actions: Browser manages server workspaces; server window lacks desktop-only editor/file-picker/voice/notification features.
- Notifications: Native OS completion/notify alerts.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
Phone access: Native iOS: No
Phone access: Native iOS
Typed value: No.
Desktop, browser/mobile web, CLI and editor access are documented.
- Desktop os: macOS Intel/ARM, Linux AppImage and Windows alpha installer.
- Browser: xum server web interface.
- Mobile browser: Server can be accessed from phone browser.
- Cli: @coder/xum run/workflow/server/acp commands.
- Editor extensions: VS Code/Cursor extension and ACP editor bridge.
- Task actions: Browser manages server workspaces; server window lacks desktop-only editor/file-picker/voice/notification features.
- Notifications: Native OS completion/notify alerts.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
Phone access: Native Android: No
Phone access: Native Android
Typed value: No.
Desktop, browser/mobile web, CLI and editor access are documented.
- Desktop os: macOS Intel/ARM, Linux AppImage and Windows alpha installer.
- Browser: xum server web interface.
- Mobile browser: Server can be accessed from phone browser.
- Cli: @coder/xum run/workflow/server/acp commands.
- Editor extensions: VS Code/Cursor extension and ACP editor bridge.
- Task actions: Browser manages server workspaces; server window lacks desktop-only editor/file-picker/voice/notification features.
- Notifications: Native OS completion/notify alerts.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
Phone access: Phone browser: Yes cross-checked
Phone access: Phone browser
Typed value: Yes.
Desktop, browser/mobile web, CLI and editor access are documented.
- Desktop os: macOS Intel/ARM, Linux AppImage and Windows alpha installer.
- Browser: xum server web interface.
- Mobile browser: Server can be accessed from phone browser.
- Cli: @coder/xum run/workflow/server/acp commands.
- Editor extensions: VS Code/Cursor extension and ACP editor bridge.
- Task actions: Browser manages server workspaces; server window lacks desktop-only editor/file-picker/voice/notification features.
- Notifications: Native OS completion/notify alerts.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
CLI: Yes cross-checked
CLI
Typed value: Yes.
Product CLI and server protocols provide programmable access.
- Cli: xum run, workflow, trust, server and acp.
- Api: Authenticated HTTP/WebSocket server serves browser, ACP and editor clients; no public API reference for create/inspect/steer/stop operations was located.
- Operations: Run request, execute explicit workflow, serve UI and ACP bridge.
- Authentication: Bearer token with explicit/generated token precedence.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/reference/cli.md
Finding: CLI runs agent requests with budget/runtime options; durable JavaScript workflows are local-only, server serves browser clients and ACP bridges editors.
Coding agents: Claude Code: No
Coding agents: Claude Code
Typed value: No.
Xum has its own agent runtime and multiple model providers.
- Mixed harness operation: The native agent loop is Xum-owned; no external coding-harness workspace adapter is present in this pinned loop.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum src/node/services/agentSession.ts
Finding: The integrated agent session uses Xum own AIService/model-provider loop and Xum workspace tools. Configurable providers and imported agent definitions do not launch Claude Code, Codex or another external coding harness as the workspace agent.
Coding agents: Codex: No
Coding agents: Codex
Typed value: No.
Xum has its own agent runtime and multiple model providers.
- Mixed harness operation: The native agent loop is Xum-owned; no external coding-harness workspace adapter is present in this pinned loop.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum src/node/services/agentSession.ts
Finding: The integrated agent session uses Xum own AIService/model-provider loop and Xum workspace tools. Configurable providers and imported agent definitions do not launch Claude Code, Codex or another external coding harness as the workspace agent.
Coding agents: Cursor Agent: No
Coding agents: Cursor Agent
Typed value: No.
Xum has its own agent runtime and multiple model providers.
- Mixed harness operation: The native agent loop is Xum-owned; no external coding-harness workspace adapter is present in this pinned loop.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum src/node/services/agentSession.ts
Finding: The integrated agent session uses Xum own AIService/model-provider loop and Xum workspace tools. Configurable providers and imported agent definitions do not launch Claude Code, Codex or another external coding harness as the workspace agent.
Coding agents: Gemini CLI: No
Coding agents: Gemini CLI
Typed value: No.
Xum has its own agent runtime and multiple model providers.
- Mixed harness operation: The native agent loop is Xum-owned; no external coding-harness workspace adapter is present in this pinned loop.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum src/node/services/agentSession.ts
Finding: The integrated agent session uses Xum own AIService/model-provider loop and Xum workspace tools. Configurable providers and imported agent definitions do not launch Claude Code, Codex or another external coding harness as the workspace agent.
Coding agents: OpenCode: No
Coding agents: OpenCode
Typed value: No.
Xum has its own agent runtime and multiple model providers.
- Mixed harness operation: The native agent loop is Xum-owned; no external coding-harness workspace adapter is present in this pinned loop.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum src/node/services/agentSession.ts
Finding: The integrated agent session uses Xum own AIService/model-provider loop and Xum workspace tools. Configurable providers and imported agent definitions do not launch Claude Code, Codex or another external coding harness as the workspace agent.
Coding agents: Pi: No
Coding agents: Pi
Typed value: No.
Xum has its own agent runtime and multiple model providers.
- Mixed harness operation: The native agent loop is Xum-owned; no external coding-harness workspace adapter is present in this pinned loop.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum src/node/services/agentSession.ts
Finding: The integrated agent session uses Xum own AIService/model-provider loop and Xum workspace tools. Configurable providers and imported agent definitions do not launch Claude Code, Codex or another external coding harness as the workspace agent.
Coding agents: Grok: No
Coding agents: Grok
Typed value: No.
Xum has its own agent runtime and multiple model providers.
- Mixed harness operation: The native agent loop is Xum-owned; no external coding-harness workspace adapter is present in this pinned loop.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum src/node/services/agentSession.ts
Finding: The integrated agent session uses Xum own AIService/model-provider loop and Xum workspace tools. Configurable providers and imported agent definitions do not launch Claude Code, Codex or another external coding harness as the workspace agent.
Coding agents: Aider: No
Coding agents: Aider
Typed value: No.
Xum has its own agent runtime and multiple model providers.
- Mixed harness operation: The native agent loop is Xum-owned; no external coding-harness workspace adapter is present in this pinned loop.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum src/node/services/agentSession.ts
Finding: The integrated agent session uses Xum own AIService/model-provider loop and Xum workspace tools. Configurable providers and imported agent definitions do not launch Claude Code, Codex or another external coding harness as the workspace agent.
Coding agents: Antigravity: No
Coding agents: Antigravity
Typed value: No.
Xum has its own agent runtime and multiple model providers.
- Mixed harness operation: The native agent loop is Xum-owned; no external coding-harness workspace adapter is present in this pinned loop.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum src/node/services/agentSession.ts
Finding: The integrated agent session uses Xum own AIService/model-provider loop and Xum workspace tools. Configurable providers and imported agent definitions do not launch Claude Code, Codex or another external coding harness as the workspace agent.
Use my subscription: No
Use my subscription
Typed value: No.
Provider keys, local endpoints and provider-specific OAuth are distinct. Source shows Codex OAuth uses ChatGPT subscription tokens inside Xum's own agent loop rather than through the Codex CLI's login.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: Xum's own agent loop can authenticate with ChatGPT subscription OAuth tokens and send requests to the ChatGPT Codex backend instead of the OpenAI API; it does not run the Codex CLI.
Where agents run: On your computer: Yes
Where agents run: On your computer
Typed value: Yes.
Local and owned-host modes are distinct from client location.
- Local: Local/worktree runtime.
- Byo remote: SSH or Coder workspace tool execution.
- Self hosted: xum server with browser access on owned infrastructure.
- Hybrid: Local backend can direct remote tool execution.
- Provisioning: npm CLI/server or configured SSH/Coder host.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/runtime/index.md
Finding: Local, worktree, SSH, Docker and devcontainer runtimes have distinct isolation/execution semantics.
-
https://xum.cdr.dev/runtime/ssh.md
Finding: Tool reads/edits/bash execute on remote host; default remote sync is Git archive plus explicit secrets, without automatic local credential forwarding.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
Where agents run: On your own server: Yes
Where agents run: On your own server
Typed value: Yes.
Local and owned-host modes are distinct from client location.
- Local: Local/worktree runtime.
- Byo remote: SSH or Coder workspace tool execution.
- Self hosted: xum server with browser access on owned infrastructure.
- Hybrid: Local backend can direct remote tool execution.
- Provisioning: npm CLI/server or configured SSH/Coder host.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/runtime/index.md
Finding: Local, worktree, SSH, Docker and devcontainer runtimes have distinct isolation/execution semantics.
-
https://xum.cdr.dev/runtime/ssh.md
Finding: Tool reads/edits/bash execute on remote host; default remote sync is Git archive plus explicit secrets, without automatic local credential forwarding.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
Where agents run: In the vendor's cloud: No
Where agents run: In the vendor's cloud
Typed value: No.
Local and owned-host modes are distinct from client location.
- Local: Local/worktree runtime.
- Byo remote: SSH or Coder workspace tool execution.
- Self hosted: xum server with browser access on owned infrastructure.
- Hybrid: Local backend can direct remote tool execution.
- Provisioning: npm CLI/server or configured SSH/Coder host.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/runtime/index.md
Finding: Local, worktree, SSH, Docker and devcontainer runtimes have distinct isolation/execution semantics.
-
Finding: Xum uses Coder workspaces as SSH hosts through the local Coder CLI (v2.25.0+) logged in to the user's own Coder deployment; it can create or reuse Coder workspaces, and a Coder registry module can run the Xum server inside a Coder workspace.
Workspace isolation: Git worktree: Yes
Workspace isolation: Git worktree
Typed value: Yes.
Worktree and container runtimes provide different boundaries.
- Branch: Per-worktree branch checkout.
- Worktree: Git worktree workspace.
- Container: Docker/Podman or devcontainer.
- Filesystem: Docker project sync to /src; devcontainer mounts host worktree.
- Secrets: Credential sharing optional; explicit project secrets.
- Security boundary: Docker limits host access; local mode shares project files.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/runtime/index.md
Finding: Local, worktree, SSH, Docker and devcontainer runtimes have distinct isolation/execution semantics.
-
https://xum.cdr.dev/runtime/docker.md
Finding: Per-workspace Docker/Podman container syncs project to /src; optional credential sharing is explicit.
-
https://xum.cdr.dev/runtime/devcontainer.md
Finding: Host worktree is mounted into devcontainer; Docker daemon/CLI/config required.
Workspace isolation: Container: Yes
Workspace isolation: Container
Typed value: Yes.
Worktree and container runtimes provide different boundaries.
- Branch: Per-worktree branch checkout.
- Worktree: Git worktree workspace.
- Container: Docker/Podman or devcontainer.
- Filesystem: Docker project sync to /src; devcontainer mounts host worktree.
- Secrets: Credential sharing optional; explicit project secrets.
- Security boundary: Docker limits host access; local mode shares project files.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/runtime/index.md
Finding: Local, worktree, SSH, Docker and devcontainer runtimes have distinct isolation/execution semantics.
-
https://xum.cdr.dev/runtime/docker.md
Finding: Per-workspace Docker/Podman container syncs project to /src; optional credential sharing is explicit.
-
https://xum.cdr.dev/runtime/devcontainer.md
Finding: Host worktree is mounted into devcontainer; Docker daemon/CLI/config required.
Workspace isolation: VM or microVM: No
Workspace isolation: VM or microVM
Typed value: No.
Worktree and container runtimes provide different boundaries.
- Vm: No product VM-isolation backend exists in the complete pinned runtime factory; SSH hosts may independently be VMs.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum src/node/runtime/runtimeFactory.ts
Finding: The complete product runtime factory implements local, worktree, SSH including user Coder workspaces, Docker and devcontainer. It has no VM-isolation backend; using an SSH machine that happens to be a VM is separate.
Parallel runs: Yes cross-checked
Parallel runs
Typed value: Yes.
Native child-workspace tasks execute concurrently.
- Concurrent sessions: Parallel native agent workspaces.
- Concurrent tasks: Task tool spawns child workspace.
- Quotas: Default 32 parallel tasks, configurable 1–256.
- Status visibility: Task reports and workspace status.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
Coordinator: Yes cross-checked
Coordinator
Typed value: Yes.
Product-owned task tools delegate and inspect child agents.
- Roles: Native parent and child-workspace agents.
- Model harness effort: Per-agent model/thinking defaults and spawn overrides.
- Messages: task_send_message and task message tools.
- Results return: agent_report incremental wakes plus final completion.
- Orchestration owner: Native Xum agent/task runtime.
- Activation: Runnable agent definition and task tool.
- Live progress: task_list/task_await and incremental reports.
- Retained results: Reported subagent can reawaken for follow-up.
- Followup: Send message to completed child.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
Native issue tracking: No
Native issue tracking
Typed value: No.
Xum tasks are agent workspaces or child-agent execution records, with session goals and todos. The pinned schema and service inspection found no independent product issue/backlog entity.
- Task session separation: No separate human issue/backlog record exists in the pinned workspace/task model.
- Inspected workspace and task schemas/services and searched issue, backlog and ticket; external tracker integrations or agent todo lists are separate.
-
Xum src/common/orpc/schemas/workspace.ts
Finding: The pinned task model stores agent workspaces, child task/workspace execution, session goals and in-session todos. Source inspection found no separate product issue/backlog schema or human issue-state workflow distinct from agent workspaces.
Unattended triggers: Yes cross-checked
Unattended triggers
Typed value: Yes.
Agent heartbeat tools and external CI can schedule work.
- Schedules: Native heartbeat tool can manage schedules; no scheduler-lifetime guarantee established.
- Events: External GitHub Actions can run xum run.
- Recurring tasks: Heartbeat and workflow tools are documented; example GitHub schedule currently disabled.
- Scheduler location: CI runs in GitHub Actions; native heartbeat host lifetime unverified.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/guides/github-actions.md
Finding: xum run can execute in GitHub Actions; the checked example has its schedule disabled pending secret replacement.
Team roles: No
Team roles
Typed value: No.
Browser sessions have revocation; organization roles are not established.
- Organization roles: Single GitHub owner allowlist; no multiple-user/organization-membership rule support.
- Unauthorized access: Configured GitHub login rejects nonmatching user.
- Revocation: Revoke one/all browser sessions.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
SSO: No
SSO
Typed value: No.
Browser sessions have revocation; organization roles are not established.
- Sso: The complete pinned server authentication model has bearer-token or single-owner GitHub login, without enterprise SSO.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum src/node/services/serverAuthService.ts
Finding: Server authentication uses a bearer token or exactly one allowed GitHub username. The owner check rejects other logins. No role, organization-membership, SAML or enterprise SSO flow exists in this authentication model.
Pull request workflow: Yes cross-checked
Pull request workflow
Typed value: Yes.
Task branches and patch integration are native; PR operations use external tools.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Xum reviewing changes workflows
Finding: Documented workflows range from agent edits only to agent commits and pushes, where you ask the Xum agent to open a PR and review it on GitHub/GitLab, given push credentials.
-
Finding: The UI detects each workspace's GitHub PR via gh pr view (branch, merge ref or commit) and caches and refreshes its status; WorkspaceLinks.tsx line 22 renders it as a PR badge.
Review interface: Yes cross-checked
Review interface
Typed value: Yes.
Review panels and rendered diffs sit beside chat.
- Change understanding: Review panel with file headers, plus the experimental Artifacts .diff/.patch viewer.
- Evidence navigation: Review panel file header opens file as artifact.
- Request changes: Plan feedback and artifact message actions.
- Keyboard: Artifact picker/navigation shortcuts.
- Narrow screen: Artifacts sidebar becomes full-screen on narrow windows.
- Retained context: Per-workspace artifacts and optional copied shelf.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
- The Artifacts tab, shelf and diff/file rendering cited here are an opt-in experiment (Settings → Experiments), not a generally available default.
-
https://xum.cdr.dev/workspaces/index.md
Finding: Workspaces isolate agent history and execution environment with central Git state.
-
https://xum.cdr.dev/agents/plan-mode.md
Finding: Plan writes are restricted to plan file; user approves/edits and later sends external edits as diff context. Structured questions behave differently in Plan and Exec.
-
https://xum.cdr.dev/workspaces/artifacts.md
Finding: Opt-in artifacts tab renders files and diffs. Project/global shelf pins copies; unpinned files have no revision history and workspace deletion removes scratch artifacts.
Product license: Apache-2.0: No. AGPL-3.0 cross-checked
Product license: Apache-2.0
Typed value: No. AGPL-3.0.
Main application is AGPL-3.0-only.
- Client license: AGPL-3.0-only.
- Server license: Same application package/server license.
- Source visibility: Public application repository.
- Source revision: 329f9cf841ff0282bd3a6ae1b56b5637a675719f.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/LICENSE
Finding: Main application repository carries GNU Affero General Public License version 3.
Product license: MIT: No. AGPL-3.0 cross-checked
Product license: MIT
Typed value: No. AGPL-3.0.
Main application is AGPL-3.0-only.
- Client license: AGPL-3.0-only.
- Server license: Same application package/server license.
- Source visibility: Public application repository.
- Source revision: 329f9cf841ff0282bd3a6ae1b56b5637a675719f.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/LICENSE
Finding: Main application repository carries GNU Affero General Public License version 3.
Product license: GPL-3.0: No. AGPL-3.0 cross-checked
Product license: GPL-3.0
Typed value: No. AGPL-3.0.
Main application is AGPL-3.0-only.
- Client license: AGPL-3.0-only.
- Server license: Same application package/server license.
- Source visibility: Public application repository.
- Source revision: 329f9cf841ff0282bd3a6ae1b56b5637a675719f.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/LICENSE
Finding: Main application repository carries GNU Affero General Public License version 3.
Product license: GPL-3.0-or-later: No. AGPL-3.0 cross-checked
Product license: GPL-3.0-or-later
Typed value: No. AGPL-3.0.
Main application is AGPL-3.0-only.
- Client license: AGPL-3.0-only.
- Server license: Same application package/server license.
- Source visibility: Public application repository.
- Source revision: 329f9cf841ff0282bd3a6ae1b56b5637a675719f.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/LICENSE
Finding: Main application repository carries GNU Affero General Public License version 3.
Product license: AGPL-3.0: Yes. AGPL-3.0 cross-checked
Product license: AGPL-3.0
Typed value: Yes. AGPL-3.0.
Main application is AGPL-3.0-only.
- Client license: AGPL-3.0-only.
- Server license: Same application package/server license.
- Source visibility: Public application repository.
- Source revision: 329f9cf841ff0282bd3a6ae1b56b5637a675719f.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/LICENSE
Finding: Main application repository carries GNU Affero General Public License version 3.
Product license: AGPL-3.0-or-later: No. AGPL-3.0 cross-checked
Product license: AGPL-3.0-or-later
Typed value: No. AGPL-3.0.
Main application is AGPL-3.0-only.
- Client license: AGPL-3.0-only.
- Server license: Same application package/server license.
- Source visibility: Public application repository.
- Source revision: 329f9cf841ff0282bd3a6ae1b56b5637a675719f.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/LICENSE
Finding: Main application repository carries GNU Affero General Public License version 3.
Product license: Elastic License 2.0: No. AGPL-3.0 cross-checked
Product license: Elastic License 2.0
Typed value: No. AGPL-3.0.
Main application is AGPL-3.0-only.
- Client license: AGPL-3.0-only.
- Server license: Same application package/server license.
- Source visibility: Public application repository.
- Source revision: 329f9cf841ff0282bd3a6ae1b56b5637a675719f.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/LICENSE
Finding: Main application repository carries GNU Affero General Public License version 3.
Product license: Custom terms: No. AGPL-3.0 cross-checked
Product license: Custom terms
Typed value: No. AGPL-3.0.
Main application is AGPL-3.0-only.
- Client license: AGPL-3.0-only.
- Server license: Same application package/server license.
- Source visibility: Public application repository.
- Source revision: 329f9cf841ff0282bd3a6ae1b56b5637a675719f.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/LICENSE
Finding: Main application repository carries GNU Affero General Public License version 3.
Product license: Proprietary: No. AGPL-3.0 cross-checked
Product license: Proprietary
Typed value: No. AGPL-3.0.
Main application is AGPL-3.0-only.
- Client license: AGPL-3.0-only.
- Server license: Same application package/server license.
- Source visibility: Public application repository.
- Source revision: 329f9cf841ff0282bd3a6ae1b56b5637a675719f.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/LICENSE
Finding: Main application repository carries GNU Affero General Public License version 3.
Self-hosting: Yes cross-checked
Self-hosting
Typed value: Yes.
The core desktop/server app can run on owned infrastructure.
- Self hosting: Complete npm server/browser app.
- Vendor dependencies: Own model provider or local endpoints; optional Coder Gateway requires separate deployment.
- Export: CLI NDJSON result events; full backup contract not checked.
- Formats: Local configuration, plans and workspace history.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: Open-source provider-agnostic Xum runs parallel agents from desktop or browser; main license is AGPL-3.0.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
Telemetry opt-out: Yes cross-checked
Telemetry opt-out
Typed value: Yes.
Anonymous telemetry has a documented backend-off control.
- Code data: Telemetry excludes code, message content and file paths.
- Credentials: Telemetry excludes API keys; runtime credentials explicitly scoped.
- Telemetry disclosure: Version/platform/Electron, random workspace IDs and rounded message length.
- Telemetry defaults: Anonymous telemetry collected by default.
- Telemetry controls: XUM_DISABLE_TELEMETRY=1 before startup.
- Provider separation: Native model calls use configured provider credentials.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/providers.md
Finding: Native Xum agents use multiple provider APIs, local model endpoints and optional provider-specific OAuth. Importing agent definitions is not running those coding harnesses.
-
https://xum.cdr.dev/config/project-secrets.md
Finding: Explicit project environment values configure runtime credentials.
-
https://xum.cdr.dev/reference/telemetry.md
Finding: Anonymous usage metadata excludes code/prompts/credentials. XUM_DISABLE_TELEMETRY=1 disables backend collection.
Free access: Yes cross-checked
Free access
Typed value: Yes.
Source and binaries are publicly available; separate costs remain unpriced. The v0.32.1 release ships free desktop builds for macOS, Linux and Windows, and the website shows no paid tier.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: The latest stable release publishes free downloadable builds for macOS, Linux and Windows.
-
Finding: The website describes Xum as open source under AGPL-3.0 and provider-agnostic, links to install docs, and shows no prices, paid plans, tiers, cloud service or native phone apps.
Starting price: Free: Yes. Free
Starting price: Free
Typed value: Yes. Free.
Source and binaries are publicly available; separate costs remain unpriced. The v0.32.1 release ships free desktop builds for macOS, Linux and Windows, and the website shows no paid tier.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: The latest stable release publishes free downloadable builds for macOS, Linux and Windows.
Starting price: Up to $20/month: No. Free
Starting price: Up to $20/month
Typed value: No. Free.
Source and binaries are publicly available; separate costs remain unpriced. The v0.32.1 release ships free desktop builds for macOS, Linux and Windows, and the website shows no paid tier.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: The latest stable release publishes free downloadable builds for macOS, Linux and Windows.
Starting price: $21–40/month: No. Free
Starting price: $21–40/month
Typed value: No. Free.
Source and binaries are publicly available; separate costs remain unpriced. The v0.32.1 release ships free desktop builds for macOS, Linux and Windows, and the website shows no paid tier.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: The latest stable release publishes free downloadable builds for macOS, Linux and Windows.
Starting price: $41–100/month: No. Free
Starting price: $41–100/month
Typed value: No. Free.
Source and binaries are publicly available; separate costs remain unpriced. The v0.32.1 release ships free desktop builds for macOS, Linux and Windows, and the website shows no paid tier.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: The latest stable release publishes free downloadable builds for macOS, Linux and Windows.
Starting price: Over $100/month: No. Free
Starting price: Over $100/month
Typed value: No. Free.
Source and binaries are publicly available; separate costs remain unpriced. The v0.32.1 release ships free desktop builds for macOS, Linux and Windows, and the website shows no paid tier.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: The latest stable release publishes free downloadable builds for macOS, Linux and Windows.
Starting price: Contact for pricing: No. Free
Starting price: Contact for pricing
Typed value: No. Free.
Source and binaries are publicly available; separate costs remain unpriced. The v0.32.1 release ships free desktop builds for macOS, Linux and Windows, and the website shows no paid tier.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: The latest stable release publishes free downloadable builds for macOS, Linux and Windows.
Pricing model: Free, no paid plan: Yes
Pricing model: Free, no paid plan
Typed value: Yes.
Xum distributes its AGPL application and installers without a paid Xum tier. Users configure model API credentials or their own local endpoints; model/provider and user-host costs remain separate.
- Included usage: The public application has no Xum billing/tier gate and no bundled vendor inference allowance; users supply model credentials.
- Model cost: Own provider API keys or local model endpoints supply model access.
- No Xum paid plan price is published. Provider/model rates and user infrastructure costs are outside the ADE price.
-
Xum pinned provider configuration
Finding: Users enter their own provider API keys or configure local model endpoints. Model calls are charged by the selected provider rather than bundled as an Xum inference allowance.
-
Finding: The pinned AGPL desktop/server distribution exposes its application operations without a paid-account or paid-feature gate. The complete local backend API has no ADE billing/payment service or tier selection. Published installers can run with user provider credentials; provider costs and user compute are separate. This finding is scoped to the public open-source distribution.
Pricing model: Free plan: No
Pricing model: Free plan
Typed value: No.
Xum distributes its AGPL application and installers without a paid Xum tier. Users configure model API credentials or their own local endpoints; model/provider and user-host costs remain separate.
- Included usage: The public application has no Xum billing/tier gate and no bundled vendor inference allowance; users supply model credentials.
- Model cost: Own provider API keys or local model endpoints supply model access.
- No Xum paid plan price is published. Provider/model rates and user infrastructure costs are outside the ADE price.
-
Xum pinned provider configuration
Finding: Users enter their own provider API keys or configure local model endpoints. Model calls are charged by the selected provider rather than bundled as an Xum inference allowance.
-
Finding: The pinned AGPL desktop/server distribution exposes its application operations without a paid-account or paid-feature gate. The complete local backend API has no ADE billing/payment service or tier selection. Published installers can run with user provider credentials; provider costs and user compute are separate. This finding is scoped to the public open-source distribution.
Pricing model: Subscription: No
Pricing model: Subscription
Typed value: No.
Xum distributes its AGPL application and installers without a paid Xum tier. Users configure model API credentials or their own local endpoints; model/provider and user-host costs remain separate.
- Included usage: The public application has no Xum billing/tier gate and no bundled vendor inference allowance; users supply model credentials.
- Model cost: Own provider API keys or local model endpoints supply model access.
- No Xum paid plan price is published. Provider/model rates and user infrastructure costs are outside the ADE price.
-
Xum pinned provider configuration
Finding: Users enter their own provider API keys or configure local model endpoints. Model calls are charged by the selected provider rather than bundled as an Xum inference allowance.
-
Finding: The pinned AGPL desktop/server distribution exposes its application operations without a paid-account or paid-feature gate. The complete local backend API has no ADE billing/payment service or tier selection. Published installers can run with user provider credentials; provider costs and user compute are separate. This finding is scoped to the public open-source distribution.
Pricing model: Per seat: No
Pricing model: Per seat
Typed value: No.
Xum distributes its AGPL application and installers without a paid Xum tier. Users configure model API credentials or their own local endpoints; model/provider and user-host costs remain separate.
- Included usage: The public application has no Xum billing/tier gate and no bundled vendor inference allowance; users supply model credentials.
- Model cost: Own provider API keys or local model endpoints supply model access.
- No Xum paid plan price is published. Provider/model rates and user infrastructure costs are outside the ADE price.
-
Xum pinned provider configuration
Finding: Users enter their own provider API keys or configure local model endpoints. Model calls are charged by the selected provider rather than bundled as an Xum inference allowance.
-
Finding: The pinned AGPL desktop/server distribution exposes its application operations without a paid-account or paid-feature gate. The complete local backend API has no ADE billing/payment service or tier selection. Published installers can run with user provider credentials; provider costs and user compute are separate. This finding is scoped to the public open-source distribution.
Pricing model: Usage-based: No
Pricing model: Usage-based
Typed value: No.
Xum distributes its AGPL application and installers without a paid Xum tier. Users configure model API credentials or their own local endpoints; model/provider and user-host costs remain separate.
- Included usage: The public application has no Xum billing/tier gate and no bundled vendor inference allowance; users supply model credentials.
- Model cost: Own provider API keys or local model endpoints supply model access.
- No Xum paid plan price is published. Provider/model rates and user infrastructure costs are outside the ADE price.
-
Xum pinned provider configuration
Finding: Users enter their own provider API keys or configure local model endpoints. Model calls are charged by the selected provider rather than bundled as an Xum inference allowance.
-
Finding: The pinned AGPL desktop/server distribution exposes its application operations without a paid-account or paid-feature gate. The complete local backend API has no ADE billing/payment service or tier selection. Published installers can run with user provider credentials; provider costs and user compute are separate. This finding is scoped to the public open-source distribution.
Pricing model: Per machine or compute: No
Pricing model: Per machine or compute
Typed value: No.
Xum distributes its AGPL application and installers without a paid Xum tier. Users configure model API credentials or their own local endpoints; model/provider and user-host costs remain separate.
- Included usage: The public application has no Xum billing/tier gate and no bundled vendor inference allowance; users supply model credentials.
- Model cost: Own provider API keys or local model endpoints supply model access.
- No Xum paid plan price is published. Provider/model rates and user infrastructure costs are outside the ADE price.
-
Xum pinned provider configuration
Finding: Users enter their own provider API keys or configure local model endpoints. Model calls are charged by the selected provider rather than bundled as an Xum inference allowance.
-
Finding: The pinned AGPL desktop/server distribution exposes its application operations without a paid-account or paid-feature gate. The complete local backend API has no ADE billing/payment service or tier selection. Published installers can run with user provider credentials; provider costs and user compute are separate. This finding is scoped to the public open-source distribution.
Pricing model: Bring your own key: Yes
Pricing model: Bring your own key
Typed value: Yes.
Xum distributes its AGPL application and installers without a paid Xum tier. Users configure model API credentials or their own local endpoints; model/provider and user-host costs remain separate.
- Included usage: The public application has no Xum billing/tier gate and no bundled vendor inference allowance; users supply model credentials.
- Model cost: Own provider API keys or local model endpoints supply model access.
- No Xum paid plan price is published. Provider/model rates and user infrastructure costs are outside the ADE price.
-
Xum pinned provider configuration
Finding: Users enter their own provider API keys or configure local model endpoints. Model calls are charged by the selected provider rather than bundled as an Xum inference allowance.
-
Finding: The pinned AGPL desktop/server distribution exposes its application operations without a paid-account or paid-feature gate. The complete local backend API has no ADE billing/payment service or tier selection. Published installers can run with user provider credentials; provider costs and user compute are separate. This finding is scoped to the public open-source distribution.
Pricing model: One-time purchase: No
Pricing model: One-time purchase
Typed value: No.
Xum distributes its AGPL application and installers without a paid Xum tier. Users configure model API credentials or their own local endpoints; model/provider and user-host costs remain separate.
- Included usage: The public application has no Xum billing/tier gate and no bundled vendor inference allowance; users supply model credentials.
- Model cost: Own provider API keys or local model endpoints supply model access.
- No Xum paid plan price is published. Provider/model rates and user infrastructure costs are outside the ADE price.
-
Xum pinned provider configuration
Finding: Users enter their own provider API keys or configure local model endpoints. Model calls are charged by the selected provider rather than bundled as an Xum inference allowance.
-
Finding: The pinned AGPL desktop/server distribution exposes its application operations without a paid-account or paid-feature gate. The complete local backend API has no ADE billing/payment service or tier selection. Published installers can run with user provider credentials; provider costs and user compute are separate. This finding is scoped to the public open-source distribution.
Keeps going with laptop closed: Yes
Keeps going with laptop closed
Typed value: Yes.
Local and owned-host modes are distinct from client location.
- Client disconnect: A standalone backend on a separate user server owns agent execution independently of browser clients.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: The standalone Xum server initializes the application backend and provider sessions before serving browser clients. Browser transport connections do not own the backend process. On a separate user server, the backend can continue while the controlling laptop is offline; local-desktop and local-backend SSH modes are different.
Open-source license: Yes. AGPL-3.0 cross-checked
Open-source license
Typed value: Yes. AGPL-3.0.
Main application is AGPL-3.0-only.
- Client license: AGPL-3.0-only.
- Server license: Same application package/server license.
- Source visibility: Public application repository.
- Source revision: 329f9cf841ff0282bd3a6ae1b56b5637a675719f.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/LICENSE
Finding: Main application repository carries GNU Affero General Public License version 3.
Any desktop app: Yes cross-checked
Any desktop app
Typed value: Yes.
Desktop, browser/mobile web, CLI and editor access are documented.
- Desktop os: macOS Intel/ARM, Linux AppImage and Windows alpha installer.
- Browser: xum server web interface.
- Mobile browser: Server can be accessed from phone browser.
- Cli: @coder/xum run/workflow/server/acp commands.
- Editor extensions: VS Code/Cursor extension and ACP editor bridge.
- Task actions: Browser manages server workspaces; server window lacks desktop-only editor/file-picker/voice/notification features.
- Notifications: Native OS completion/notify alerts.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
Any phone client: Yes cross-checked
Any phone client
Typed value: Yes.
Desktop, browser/mobile web, CLI and editor access are documented.
- Desktop os: macOS Intel/ARM, Linux AppImage and Windows alpha installer.
- Browser: xum server web interface.
- Mobile browser: Server can be accessed from phone browser.
- Cli: @coder/xum run/workflow/server/acp commands.
- Editor extensions: VS Code/Cursor extension and ACP editor bridge.
- Task actions: Browser manages server workspaces; server window lacks desktop-only editor/file-picker/voice/notification features.
- Notifications: Native OS completion/notify alerts.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
All public findings
Findings may summarize a source. They are not presented as verbatim statements.
xum:ACC-01: Desktop, browser/mobile web, CLI and editor access are documented. cross-checked
xum:ACC-01
Desktop, browser/mobile web, CLI and editor access are documented.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
-
https://xum.cdr.dev/config/notifications.md
Finding: OS notifications report response completion or explicit notify tool events, with platform-specific delivery.
-
https://xum.cdr.dev/integrations/vscode-extension.md
Finding: Extension opens Xum workspaces from VS Code/Cursor.
-
https://xum.cdr.dev/integrations/acp.md
Finding: Xum exposes its own agent through ACP to Zed, Neovim and JetBrains.
xum:ACC-02: Xum has its own agent runtime and multiple model providers.
xum:ACC-02
Xum has its own agent runtime and multiple model providers.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/providers.md
Finding: Native Xum agents use multiple provider APIs, local model endpoints and optional provider-specific OAuth. Importing agent definitions is not running those coding harnesses.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
Xum src/node/services/agentSession.ts
Finding: The integrated agent session uses Xum own AIService/model-provider loop and Xum workspace tools. Configurable providers and imported agent definitions do not launch Claude Code, Codex or another external coding harness as the workspace agent.
xum:ACC-03: Provider keys, local endpoints and provider-specific OAuth are distinct. Source shows Codex OAuth uses ChatGPT subscription tokens inside Xum's own agent loop rather than through the Codex CLI's login. cross-checked
xum:ACC-03
Provider keys, local endpoints and provider-specific OAuth are distinct. Source shows Codex OAuth uses ChatGPT subscription tokens inside Xum's own agent loop rather than through the Codex CLI's login.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/providers.md
Finding: Native Xum agents use multiple provider APIs, local model endpoints and optional provider-specific OAuth. Importing agent definitions is not running those coding harnesses.
-
Finding: Xum's own agent loop can authenticate with ChatGPT subscription OAuth tokens and send requests to the ChatGPT Codex backend instead of the OpenAI API; it does not run the Codex CLI.
xum:ACC-04: Scratch chats do not require Git; runtime prerequisites are explicit.
xum:ACC-04
Scratch chats do not require Git; runtime prerequisites are explicit.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
-
https://xum.cdr.dev/workspaces/scratch-chats.md
Finding: Durable scratch chat can start without a project or Git repository.
-
https://xum.cdr.dev/runtime/index.md
Finding: Local, worktree, SSH, Docker and devcontainer runtimes have distinct isolation/execution semantics.
-
https://xum.cdr.dev/runtime/ssh.md
Finding: Tool reads/edits/bash execute on remote host; default remote sync is Git archive plus explicit secrets, without automatic local credential forwarding.
-
Finding: Xum uses Coder workspaces as SSH hosts through the local Coder CLI (v2.25.0+) logged in to the user's own Coder deployment; it can create or reuse Coder workspaces, and a Coder registry module can run the Xum server inside a Coder workspace.
xum:ACC-05: Product CLI and server protocols provide programmable access. cross-checked
xum:ACC-05
Product CLI and server protocols provide programmable access.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/reference/cli.md
Finding: CLI runs agent requests with budget/runtime options; durable JavaScript workflows are local-only, server serves browser clients and ACP bridges editors.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
xum:ACC-06: MCP servers and reviewed plugins expose scoped tools. cross-checked
xum:ACC-06
MCP servers and reviewed plugins expose scoped tools.
- Source statements were checked; no hands-on scenario was run.
-
https://xum.cdr.dev/agents/instruction-files.md
Finding: Repository instruction files configure agent behavior.
-
https://xum.cdr.dev/agents/agent-skills.md
Finding: Skills and reviewed plugin components provide reusable context and tools.
-
https://xum.cdr.dev/config/mcp-servers.md
Finding: MCP configurations are global/repo with workspace overrides and isolated instances; managed plugins require review/trust. GitHub features require external GitHub MCP.
xum:ACC-07: Desktop uses Electron while server browser mode is separate. cross-checked
xum:ACC-07
Desktop uses Electron while server browser mode is separate.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/reference/cli.md
Finding: CLI runs agent requests with budget/runtime options; durable JavaScript workflows are local-only, server serves browser clients and ACP bridges editors.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
Finding: Stable 0.32.1 release includes Electron security update, experimental agent interface, mobile PWA fixes and subagent recovery fixes.
xum:PLAN-01: Work starts as a workspace conversation. cross-checked
xum:PLAN-01
Work starts as a workspace conversation.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/workspaces/scratch-chats.md
Finding: Durable scratch chat can start without a project or Git repository.
-
https://xum.cdr.dev/workspaces/index.md
Finding: Workspaces isolate agent history and execution environment with central Git state.
xum:PLAN-02: Plan files persist and reflect external edits. cross-checked
xum:PLAN-02
Plan files persist and reflect external edits.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/plan-mode.md
Finding: Plan writes are restricted to plan file; user approves/edits and later sends external edits as diff context. Structured questions behave differently in Plan and Exec.
xum:PLAN-03: Agent trees have a configurable nesting limit. cross-checked
xum:PLAN-03
Agent trees have a configurable nesting limit.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
xum:PLAN-04: Instructions, skills and optional session memory have explicit scopes. cross-checked
xum:PLAN-04
Instructions, skills and optional session memory have explicit scopes.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/instruction-files.md
Finding: Repository instruction files configure agent behavior.
-
https://xum.cdr.dev/agents/agent-skills.md
Finding: Skills and reviewed plugin components provide reusable context and tools.
-
https://xum.cdr.dev/adr/0007-session-memory-is-the-rollover-checkpoint.md
Finding: Token-budget mode with Agent Memory keeps per-agent session checkpoints; fresh windows retrieve rather than automatically injecting old context.
xum:PLAN-05: MCP and artifact files add context with scoped access.
xum:PLAN-05
MCP and artifact files add context with scoped access.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/mcp-servers.md
Finding: MCP configurations are global/repo with workspace overrides and isolated instances; managed plugins require review/trust. GitHub features require external GitHub MCP.
-
https://xum.cdr.dev/workspaces/artifacts.md
Finding: Opt-in artifacts tab renders files and diffs. Project/global shelf pins copies; unpinned files have no revision history and workspace deletion removes scratch artifacts.
-
Finding: Stable 0.32.1 release includes Electron security update, experimental agent interface, mobile PWA fixes and subagent recovery fixes.
xum:PLAN-06: Xum tasks are agent workspaces or child-agent execution records, with session goals and todos. The pinned schema and service inspection found no independent product issue/backlog entity.
xum:PLAN-06
Xum tasks are agent workspaces or child-agent execution records, with session goals and todos. The pinned schema and service inspection found no independent product issue/backlog entity.
- Inspected workspace and task schemas/services and searched issue, backlog and ticket; external tracker integrations or agent todo lists are separate.
-
Xum src/common/orpc/schemas/workspace.ts
Finding: The pinned task model stores agent workspaces, child task/workspace execution, session goals and in-session todos. Source inspection found no separate product issue/backlog schema or human issue-state workflow distinct from agent workspaces.
xum:COORD-01: Native child-workspace tasks execute concurrently. cross-checked
xum:COORD-01
Native child-workspace tasks execute concurrently.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
xum:COORD-02: Queues and shared locks have bounded concurrency semantics. cross-checked
xum:COORD-02
Queues and shared locks have bounded concurrency semantics.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
xum:COORD-03: Product-owned task tools delegate and inspect child agents. cross-checked
xum:COORD-03
Product-owned task tools delegate and inspect child agents.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
xum:COORD-04: Agent heartbeat tools and external CI can schedule work. cross-checked
xum:COORD-04
Agent heartbeat tools and external CI can schedule work.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/guides/github-actions.md
Finding: xum run can execute in GitHub Actions; the checked example has its schedule disabled pending secret replacement.
xum:COORD-05: Questions and stop controls have mode/process limits.
xum:COORD-05
Questions and stop controls have mode/process limits.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/agents/plan-mode.md
Finding: Plan writes are restricted to plan file; user approves/edits and later sends external edits as diff context. Structured questions behave differently in Plan and Exec.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
-
https://xum.cdr.dev/config/notifications.md
Finding: OS notifications report response completion or explicit notify tool events, with platform-specific delivery.
-
https://xum.cdr.dev/reference/debugging.md
Finding: Live backend logs and diagnostic tools support failure inspection.
xum:COORD-06: Workspace/agent views expose hierarchy and status.
xum:COORD-06
Workspace/agent views expose hierarchy and status.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: Open-source provider-agnostic Xum runs parallel agents from desktop or browser; main license is AGPL-3.0.
-
https://xum.cdr.dev/workspaces/index.md
Finding: Workspaces isolate agent history and execution environment with central Git state.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/workspaces/artifacts.md
Finding: Opt-in artifacts tab renders files and diffs. Project/global shelf pins copies; unpinned files have no revision history and workspace deletion removes scratch artifacts.
-
https://xum.cdr.dev/config/notifications.md
Finding: OS notifications report response completion or explicit notify tool events, with platform-specific delivery.
xum:COORD-07: Modes, definitions and scripted workflows are configurable. cross-checked
xum:COORD-07
Modes, definitions and scripted workflows are configurable.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/reference/cli.md
Finding: CLI runs agent requests with budget/runtime options; durable JavaScript workflows are local-only, server serves browser clients and ACP bridges editors.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/agents/plan-mode.md
Finding: Plan writes are restricted to plan file; user approves/edits and later sends external edits as diff context. Structured questions behave differently in Plan and Exec.
xum:RUN-01: Local and owned-host modes are distinct from client location.
xum:RUN-01
Local and owned-host modes are distinct from client location.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/runtime/index.md
Finding: Local, worktree, SSH, Docker and devcontainer runtimes have distinct isolation/execution semantics.
-
https://xum.cdr.dev/runtime/ssh.md
Finding: Tool reads/edits/bash execute on remote host; default remote sync is Git archive plus explicit secrets, without automatic local credential forwarding.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
-
Finding: Xum uses Coder workspaces as SSH hosts through the local Coder CLI (v2.25.0+) logged in to the user's own Coder deployment; it can create or reuse Coder workspaces, and a Coder registry module can run the Xum server inside a Coder workspace.
-
Finding: The standalone Xum server initializes the application backend and provider sessions before serving browser clients. Browser transport connections do not own the backend process. On a separate user server, the backend can continue while the controlling laptop is offline; local-desktop and local-backend SSH modes are different.
xum:RUN-02: Worktree and container runtimes provide different boundaries.
xum:RUN-02
Worktree and container runtimes provide different boundaries.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/runtime/index.md
Finding: Local, worktree, SSH, Docker and devcontainer runtimes have distinct isolation/execution semantics.
-
https://xum.cdr.dev/runtime/docker.md
Finding: Per-workspace Docker/Podman container syncs project to /src; optional credential sharing is explicit.
-
https://xum.cdr.dev/runtime/devcontainer.md
Finding: Host worktree is mounted into devcontainer; Docker daemon/CLI/config required.
-
Xum src/node/runtime/runtimeFactory.ts
Finding: The complete product runtime factory implements local, worktree, SSH including user Coder workspaces, Docker and devcontainer. It has no VM-isolation backend; using an SSH machine that happens to be a VM is separate.
xum:RUN-03: History/recovery limits are explicit across processes and context windows. cross-checked
xum:RUN-03
History/recovery limits are explicit across processes and context windows.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/workspaces/fork.md
Finding: Fork copies conversation history into an alternative workspace.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
-
https://xum.cdr.dev/adr/0007-session-memory-is-the-rollover-checkpoint.md
Finding: Token-budget mode with Agent Memory keeps per-agent session checkpoints; fresh windows retrieve rather than automatically injecting old context.
xum:RUN-04: Runtime setup can reuse project containers and init hooks.
xum:RUN-04
Runtime setup can reuse project containers and init hooks.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/runtime/ssh.md
Finding: Tool reads/edits/bash execute on remote host; default remote sync is Git archive plus explicit secrets, without automatic local credential forwarding.
-
https://xum.cdr.dev/runtime/docker.md
Finding: Per-workspace Docker/Podman container syncs project to /src; optional credential sharing is explicit.
-
https://xum.cdr.dev/runtime/devcontainer.md
Finding: Host worktree is mounted into devcontainer; Docker daemon/CLI/config required.
-
https://xum.cdr.dev/config/project-secrets.md
Finding: Explicit project environment values configure runtime credentials.
-
https://xum.cdr.dev/hooks/init.md
Finding: Project init hooks prepare environments on workspace creation.
xum:RUN-05: Agent and workflow limits are configurable.
xum:RUN-05
Agent and workflow limits are configurable.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/reference/cli.md
Finding: CLI runs agent requests with budget/runtime options; durable JavaScript workflows are local-only, server serves browser clients and ACP bridges editors.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/hooks/tools.md
Finding: Trusted experimental pre-tool scripts can block a call with nonzero exit; post-tool scripts run lint/checks.
xum:RUN-06: Local diagnostic and usage reporting have explicit scopes.
xum:RUN-06
Local diagnostic and usage reporting have explicit scopes.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/providers.md
Finding: Native Xum agents use multiple provider APIs, local model endpoints and optional provider-specific OAuth. Importing agent definitions is not running those coding harnesses.
-
https://xum.cdr.dev/reference/cli.md
Finding: CLI runs agent requests with budget/runtime options; durable JavaScript workflows are local-only, server serves browser clients and ACP bridges editors.
-
https://xum.cdr.dev/reference/debugging.md
Finding: Live backend logs and diagnostic tools support failure inspection.
-
https://xum.cdr.dev/reference/telemetry.md
Finding: Anonymous usage metadata excludes code/prompts/credentials. XUM_DISABLE_TELEMETRY=1 disables backend collection.
xum:RUN-07: Workspace costs and hard budgets include only eligible routed usage.
xum:RUN-07
Workspace costs and hard budgets include only eligible routed usage.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/providers.md
Finding: Native Xum agents use multiple provider APIs, local model endpoints and optional provider-specific OAuth. Importing agent definitions is not running those coding harnesses.
-
https://xum.cdr.dev/reference/cli.md
Finding: CLI runs agent requests with budget/runtime options; durable JavaScript workflows are local-only, server serves browser clients and ACP bridges editors.
xum:RUN-08: Linux CPU/RAM limits and task queues constrain parallel work. cross-checked
xum:RUN-08
Linux CPU/RAM limits and task queues constrain parallel work.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/config/agent-resource-limits.md
Finding: Linux cgroup v2 caps shared local/worktree agent CPU/RAM and optionally projects; remote/container runtimes and opened terminals are excluded.
xum:TEAM-01: Separate browser clients sharing one owner/server bearer credential can send instructions to the same workspace agent and receive its chat stream. One backend reuses the workspace AgentSession. The code does not establish separate human accounts, invites or an explicit multi-person workflow.
xum:TEAM-01
Separate browser clients sharing one owner/server bearer credential can send instructions to the same workspace agent and receive its chat stream. One backend reuses the workspace AgentSession. The code does not establish separate human accounts, invites or an explicit multi-person workflow.
- Shared owner-level bearer access only; no per-person identity, attribution or collaborator permission model. Source inspection, not a live multi-person test.
-
Finding: Authenticated browser clients call the same workspace sendMessage endpoint and subscribe to its chat events. WorkspaceService reuses one AgentSession per workspace and broadcasts its chat events; input is not tied to the client connection. Trusted people sharing the server bearer credential can therefore prompt the same work. Separate GitHub human identities remain restricted to one owner.
xum:TEAM-02: Browser sessions have revocation; organization roles are not established.
xum:TEAM-02
Browser sessions have revocation; organization roles are not established.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
-
Xum src/node/services/serverAuthService.ts
Finding: Server authentication uses a bearer token or exactly one allowed GitHub username. The owner check rejects other logins. No role, organization-membership, SAML or enterprise SSO flow exists in this authentication model.
xum:TEAM-03: Tool policy, project trust and session tokens bound operations.
xum:TEAM-03
Tool policy, project trust and session tokens bound operations.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/reference/cli.md
Finding: CLI runs agent requests with budget/runtime options; durable JavaScript workflows are local-only, server serves browser clients and ACP bridges editors.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/config/mcp-servers.md
Finding: MCP configurations are global/repo with workspace overrides and isolated instances; managed plugins require review/trust. GitHub features require external GitHub MCP.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
-
https://xum.cdr.dev/hooks/tools.md
Finding: Trusted experimental pre-tool scripts can block a call with nonzero exit; post-tool scripts run lint/checks.
xum:TEAM-04: History and artifact retention differ from revision history.
xum:TEAM-04
History and artifact retention differ from revision history.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
- The Artifacts tab, shelf and diff/file rendering cited here are an opt-in experiment (Settings → Experiments), not a generally available default.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
-
https://xum.cdr.dev/workspaces/artifacts.md
Finding: Opt-in artifacts tab renders files and diffs. Project/global shelf pins copies; unpinned files have no revision history and workspace deletion removes scratch artifacts.
xum:TEAM-05: Review panels and rendered diffs sit beside chat. cross-checked
xum:TEAM-05
Review panels and rendered diffs sit beside chat.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
- The Artifacts tab, shelf and diff/file rendering cited here are an opt-in experiment (Settings → Experiments), not a generally available default.
-
https://xum.cdr.dev/workspaces/index.md
Finding: Workspaces isolate agent history and execution environment with central Git state.
-
https://xum.cdr.dev/agents/plan-mode.md
Finding: Plan writes are restricted to plan file; user approves/edits and later sends external edits as diff context. Structured questions behave differently in Plan and Exec.
-
https://xum.cdr.dev/workspaces/artifacts.md
Finding: Opt-in artifacts tab renders files and diffs. Project/global shelf pins copies; unpinned files have no revision history and workspace deletion removes scratch artifacts.
xum:TEAM-06: Forking and context rollover retain bounded task context. cross-checked
xum:TEAM-06
Forking and context rollover retain bounded task context.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/workspaces/fork.md
Finding: Fork copies conversation history into an alternative workspace.
-
https://xum.cdr.dev/adr/0007-session-memory-is-the-rollover-checkpoint.md
Finding: Token-budget mode with Agent Memory keeps per-agent session checkpoints; fresh windows retrieve rather than automatically injecting old context.
xum:SHIP-01: Opt-in artifacts retain task files and copied cross-workspace shelves.
xum:SHIP-01
Opt-in artifacts retain task files and copied cross-workspace shelves.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
- The Artifacts tab, shelf and diff/file rendering cited here are an opt-in experiment (Settings → Experiments), not a generally available default.
-
https://xum.cdr.dev/workspaces/artifacts.md
Finding: Opt-in artifacts tab renders files and diffs. Project/global shelf pins copies; unpinned files have no revision history and workspace deletion removes scratch artifacts.
xum:SHIP-02: Configurable tool hooks and review agents support optional verification.
xum:SHIP-02
Configurable tool hooks and review agents support optional verification.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
- Tool hooks (pre/post scripts) are documented as experimental with possible breaking changes, and run only in trusted projects.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/agents/plan-mode.md
Finding: Plan writes are restricted to plan file; user approves/edits and later sends external edits as diff context. Structured questions behave differently in Plan and Exec.
-
https://xum.cdr.dev/hooks/tools.md
Finding: Trusted experimental pre-tool scripts can block a call with nonzero exit; post-tool scripts run lint/checks.
xum:SHIP-03: Task branches and patch integration are native; PR operations use external tools. cross-checked
xum:SHIP-03
Task branches and patch integration are native; PR operations use external tools.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: Open-source provider-agnostic Xum runs parallel agents from desktop or browser; main license is AGPL-3.0.
-
https://xum.cdr.dev/runtime/index.md
Finding: Local, worktree, SSH, Docker and devcontainer runtimes have distinct isolation/execution semantics.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/config/mcp-servers.md
Finding: MCP configurations are global/repo with workspace overrides and isolated instances; managed plugins require review/trust. GitHub features require external GitHub MCP.
-
Xum reviewing changes workflows
Finding: Documented workflows range from agent edits only to agent commits and pushes, where you ask the Xum agent to open a PR and review it on GitHub/GitLab, given push credentials.
-
Finding: The UI detects each workspace's GitHub PR via gh pr view (branch, merge ref or commit) and caches and refreshes its status; WorkspaceLinks.tsx line 22 renders it as a PR badge.
xum:SHIP-05: Workspace history and artifact copies retain bounded outputs.
xum:SHIP-05
Workspace history and artifact copies retain bounded outputs.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
- The Artifacts tab, shelf and diff/file rendering cited here are an opt-in experiment (Settings → Experiments), not a generally available default.
-
https://xum.cdr.dev/workspaces/fork.md
Finding: Fork copies conversation history into an alternative workspace.
-
https://xum.cdr.dev/workspaces/artifacts.md
Finding: Opt-in artifacts tab renders files and diffs. Project/global shelf pins copies; unpinned files have no revision history and workspace deletion removes scratch artifacts.
xum:SHIP-06: Review outputs can be retained, without an established batch shipping queue.
xum:SHIP-06
Review outputs can be retained, without an established batch shipping queue.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
- The Artifacts tab, shelf and diff/file rendering cited here are an opt-in experiment (Settings → Experiments), not a generally available default.
-
https://xum.cdr.dev/agents/index.md
Finding: Xum agent definitions control prompts/tools/models and spawn child workspaces. Default 32 parallel tasks and depth 5 are configurable; reports and follow-ups are retained.
-
https://xum.cdr.dev/workspaces/artifacts.md
Finding: Opt-in artifacts tab renders files and diffs. Project/global shelf pins copies; unpinned files have no revision history and workspace deletion removes scratch artifacts.
xum:OWN-01: Main application is AGPL-3.0-only. cross-checked
xum:OWN-01
Main application is AGPL-3.0-only.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: Open-source provider-agnostic Xum runs parallel agents from desktop or browser; main license is AGPL-3.0.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/package.json
Finding: Pinned application package is @coder/xum v0.32.1 with AGPL-3.0-only and desktop build scripts.
-
https://raw.githubusercontent.com/coder/mux/329f9cf841ff0282bd3a6ae1b56b5637a675719f/LICENSE
Finding: Main application repository carries GNU Affero General Public License version 3.
xum:OWN-02: The core desktop/server app can run on owned infrastructure. cross-checked
xum:OWN-02
The core desktop/server app can run on owned infrastructure.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: Open-source provider-agnostic Xum runs parallel agents from desktop or browser; main license is AGPL-3.0.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
-
https://xum.cdr.dev/config/providers.md
Finding: Native Xum agents use multiple provider APIs, local model endpoints and optional provider-specific OAuth. Importing agent definitions is not running those coding harnesses.
-
https://xum.cdr.dev/reference/cli.md
Finding: CLI runs agent requests with budget/runtime options; durable JavaScript workflows are local-only, server serves browser clients and ACP bridges editors.
-
https://xum.cdr.dev/agents/plan-mode.md
Finding: Plan writes are restricted to plan file; user approves/edits and later sends external edits as diff context. Structured questions behave differently in Plan and Exec.
-
https://xum.cdr.dev/config/server-access.md
Finding: Browser access uses bearer token or single-owner GitHub login. Session revocation and supervised updates are available; separate backends do not share stop/stream/queue state.
xum:OWN-03: Anonymous telemetry has a documented backend-off control. cross-checked
xum:OWN-03
Anonymous telemetry has a documented backend-off control.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
https://xum.cdr.dev/config/providers.md
Finding: Native Xum agents use multiple provider APIs, local model endpoints and optional provider-specific OAuth. Importing agent definitions is not running those coding harnesses.
-
https://xum.cdr.dev/config/project-secrets.md
Finding: Explicit project environment values configure runtime credentials.
-
https://xum.cdr.dev/reference/telemetry.md
Finding: Anonymous usage metadata excludes code/prompts/credentials. XUM_DISABLE_TELEMETRY=1 disables backend collection.
xum:OWN-04: Xum distributes its AGPL application and installers without a paid Xum tier. Users configure model API credentials or their own local endpoints; model/provider and user-host costs remain separate.
xum:OWN-04
Xum distributes its AGPL application and installers without a paid Xum tier. Users configure model API credentials or their own local endpoints; model/provider and user-host costs remain separate.
- No Xum paid plan price is published. Provider/model rates and user infrastructure costs are outside the ADE price.
-
Xum pinned provider configuration
Finding: Users enter their own provider API keys or configure local model endpoints. Model calls are charged by the selected provider rather than bundled as an Xum inference allowance.
-
Finding: The pinned AGPL desktop/server distribution exposes its application operations without a paid-account or paid-feature gate. The complete local backend API has no ADE billing/payment service or tier selection. Published installers can run with user provider credentials; provider costs and user compute are separate. This finding is scoped to the public open-source distribution.
xum:OWN-06: Stable and alpha surfaces have public release/support channels. cross-checked
xum:OWN-06
Stable and alpha surfaces have public release/support channels.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: Open-source provider-agnostic Xum runs parallel agents from desktop or browser; main license is AGPL-3.0.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
-
Finding: Stable 0.32.1 release includes Electron security update, experimental agent interface, mobile PWA fixes and subagent recovery fixes.
xum:OWN-08: Source and binaries are publicly available; separate costs remain unpriced. The v0.32.1 release ships free desktop builds for macOS, Linux and Windows, and the website shows no paid tier. cross-checked
xum:OWN-08
Source and binaries are publicly available; separate costs remain unpriced. The v0.32.1 release ships free desktop builds for macOS, Linux and Windows, and the website shows no paid tier.
- Documentation establishes only the named atomic answers; remaining questions and hands-on behavior are unverified.
-
Finding: Open-source provider-agnostic Xum runs parallel agents from desktop or browser; main license is AGPL-3.0.
-
https://xum.cdr.dev/install.md
Finding: macOS Intel/ARM and Linux releases plus Windows alpha; npm CLI/server available with supported Node requirements.
-
Finding: The latest stable release publishes free downloadable builds for macOS, Linux and Windows.
-
Finding: The website describes Xum as open source under AGPL-3.0 and provider-agnostic, links to install docs, and shows no prices, paid plans, tiers, cloud service or native phone apps.