MXE — Agentic Command Center

Orchestrate remote servers with cryptographic authority.
Ed25519-signed command execution • Rust edge workers • AI-powered triage • Real-time telemetry

Website • Install Guide • Documentation • Contact

MXE is a desktop command center for managing fleets of remote Linux servers through Ed25519-signed WebSocket channels, real-time telemetry, AI-powered log triage, and conversational command delegation.

Built with Electron + React + Tailwind (Hub) and Rust (Satellite edge workers).

Status: v0.1.0 MVP — Beta

Quick Start

# Install dependencies
just install

# Run the full Electron app with hot reload
just dev

# Or run the renderer only in a browser (fast iteration)
just dev-web

# Launch a local Satellite for testing
just run-sat

# Run all tests (JS + Rust)
just test

Architecture

┌──────────────────────────────────┐
│          Hub (Electron)          │
│  ┌──────────┐  ┌──────────────┐ │         ┌────────────────────┐
│  │ Renderer  │  │ Main Process │ │◄─ WS ──►│   Satellite (Rust) │
│  │ (React)   │◄─┤  (Node.js)  │ │  Portal  │   Edge Worker      │
│  └──────────┘  └──────────────┘ │         └────────────────────┘
│       ▲ contextBridge    │      │
│       │ (IPC only)       │      │
└──────────────────────────┼──────┘
                           │
                    ┌──────┴──────┐
                    │  Commander  │
                    │ (Claude CLI │
                    │  on VPS)    │
                    └─────────────┘

Hub — Electron desktop app. Main process holds encrypted secrets and manages portal connections. The renderer is an untrusted React SPA communicating only via contextBridge IPC.

Satellite — Rust binary deployed to remote Linux servers. Exposes a WebSocket server for stats streaming and signed command execution. Ships with a 28-pattern command blocklist, 15-second execution timeout, and rate limiting.

Commander — A root-level Claude Code instance on a VPS that orchestrates Satellites via tool delegation through the Hub's chat interface.

See ARCHITECTURE.md for the full system design, and docs/ for detailed documentation.

Core Capabilities

Security Model

MXE implements defense-in-depth across every layer:

• Cryptographic auth — Ed25519 keypair pairing with 6-digit out-of-band code, NaCl crypto_sign on every command
• Command blocklist — 28 destructive patterns blocked at the Satellite (rm -rf /, mkfs, dd, DROP TABLE, etc.)
• Execution sandbox — 15-second timeout, 1GB memory limit, ulimit wrapping, child process kill on expiry
• Rate limiting — 20 messages/sec per WebSocket connection
• Secret isolation — API keys encrypted in Electron main process, never exposed to renderer; log sanitization strips 8+ secret patterns before LLM evaluation
• Electron hardening — nodeIntegration: false, contextIsolation: true, strict CSP, no webviewTag
• Systemd hardening — NoNewPrivileges, ProtectSystem=strict, MemoryMax=256M, CPUQuota=80%

See docs/SECURITY.md for the full security whitepaper.

Project Structure

src/
  main/index.ts              Electron main process (IPC, encrypted store, SSH deploy, AI APIs)
  preload/index.ts           contextBridge IPC exposure
  renderer/src/
    App.tsx                  Dashboard: server grid, logs, modals, Commander chat
    components/              ServerCard, LogStream, CommanderChat, PairServerModal, DeployModal,
                             SettingsModal, RepoModal
    lib/
      crypto.ts              Ed25519 (TweetNaCl): sign, verify, pairing codes
      portal.ts              WebSocket Portal: pair, reconnect, signed commands, keepalive
      ai.ts                  Triage: API calls + mock fallback + response parsing
      dispatch.ts            Local script execution via IPC
      sanitize.ts            Secret redaction (8 patterns: API keys, tokens, private keys)
      react-loop.ts          ReAct depth limiter for Commander auto-reply
      icons.ts               Service/OS icon mapper
      types.ts               Shared TypeScript interfaces

packages/satellite/src/
  main.rs                    WebSocket server, pairing, stats, kill switch, OTA upgrade
  crypto.rs                  Ed25519: sign, verify, combined signatures
  execution.rs               Command blocklist (28 patterns), timeout, vault injection

scripts/
  payloads/commander_init.sh Server scanner → Master Manifest JSON
  prompts/triage_audit.md    LLM triage prompt template
  deploy_web.sh              Deploy landing page to mxe.namek.top
  publish_release.sh         Build artifacts + upload to download server

apps/web/index.html          Landing page (mxe.namek.top)

Testing

just test          # All tests (JS + Rust)
just test-watch    # Vitest watch mode
just test-sat      # Rust satellite tests only

82 tests across two stacks:

See docs/TESTING.md for detailed test documentation.

Deployment

# Deploy a Satellite to a remote server
just slide <host> [user] [key]

# Or from the GUI: click "Slide Satellite" and enter SSH details

# Tag a release — GitHub Actions builds .exe, AppImage, and Satellite
just tag-release

# Deploy the landing page
just deploy-web

See docs/DEPLOYMENT.md for the full deployment guide.

Development Commands

Documentation

• ARCHITECTURE.md — System design, IPC boundaries, protocol spec
• CHANGELOG.md — Version history
• docs/SECURITY.md — Security whitepaper
• docs/PROTOCOL.md — Portal WebSocket protocol specification
• docs/DEPLOYMENT.md — Deployment and operations guide
• docs/TESTING.md — Test suite documentation
• docs/ROADMAP.md — Future feature roadmap
• docs/features/ — Individual feature documentation

Tech Stack

• Desktop Shell: Electron 33 + electron-vite
• Frontend: React 18 + TypeScript 5.7 + Tailwind CSS 3.4
• Cryptography: TweetNaCl (JS) + ed25519-dalek (Rust)
• Edge Workers: Rust + tokio + tungstenite + sysinfo
• AI: Anthropic Claude / OpenRouter (configurable)
• Testing: Vitest + React Testing Library + Cargo test
• CI/CD: GitHub Actions (parallel JS/Rust matrix)
• Storage: electron-store (encrypted)

License

MIT License — see LICENSE for details.

Matrix eXecution Engine — mxe.namek.top — [email protected]