Kebivo 0.2.0

A new installation now gets from docker run to a routed, signed delivery by copy-paste, with no UI step and no model key.

• python -m kebivo.cli project create --name "..." creates a project and prints a feedback:gap token once (--json for scripts). bootstrap --password-stdin reads the admin password from a pipe without warnings.
• The quickstart leads with the published image, uses the real clone URL for the build path, and adds a "Route it" step: run examples/webhook_receiver.py, add a webhook destination and rule, and see the receiver verify a signed delivery. A test keeps the documented image tag in step with the package version.
• The project Connect panel has a "Send test event" button that sends a sample gap through normal intake and routing and links to its group. Inbox and dashboard empty states point to it.
• Signing in from an origin that is not allowed now returns a message that lists the configured origins instead of a bare "Invalid Origin".
• Native Slack destination: paste a Slack incoming-webhook URL and Kebivo posts a Block Kit message with the question, project, tags, occurrence count and, when PUBLIC_URL is set, a link to the group. The URL is validated to hooks.slack.com, stored encrypted and never shown again in full.
• Python client (sdk/python, standard library only) and TypeScript client (sdk/typescript, ESM, no runtime dependencies, Node 20+) for reporting gaps and corrections, with idempotency keys, bounded retries that honour Retry-After, and typed errors. An optional LangChain callback reports a gap when a retriever returns no documents. Install from Git; neither is published to a package index.
• Group detail shows when each occurrence was received.

Upgrade

One database migration runs automatically when the container starts. It rebuilds the destinations table to allow the new Slack type, and existing destinations are kept. No configuration changes are needed. Take a backup as the self-hosting guide describes, then pull the new image and recreate the container with the same volume and env file:

docker pull ghcr.io/ocnai/kebivo:0.2.0
docker rm -f kebivo
docker run -d --name kebivo --restart unless-stopped -p 127.0.0.1:8000:8000 \
  -v kebivo-data:/data --env-file kebivo.env ghcr.io/ocnai/kebivo:0.2.0

The image is ghcr.io/ocnai/kebivo:0.2.0 (also tagged latest) for linux/amd64 and linux/arm64.

Links

• Changelog: CHANGELOG.md
• Quickstart: docs.kebivo.com/quickstart

Kebivo 0.1.1

Packaging-only patch release; the application is unchanged from 0.1.0.

The MCP Registry server name is now io.github.OCNAI/kebivo, in server.json and in the image's io.modelcontextprotocol.server.name label. The registry matches the GitHub account's letter case, so it refused the lower-case name used in 0.1.0. Kebivo is now listed in the MCP Registry.

Upgrade

No migrations or configuration changes. Take a backup as the self-hosting guide describes, then pull the new image and recreate the container with the same volume and env file:

docker pull ghcr.io/ocnai/kebivo:0.1.1
docker rm -f kebivo
docker run -d --name kebivo --restart unless-stopped -p 127.0.0.1:8000:8000 \
  -v kebivo-data:/data --env-file kebivo.env ghcr.io/ocnai/kebivo:0.1.1

The image is ghcr.io/ocnai/kebivo:0.1.1 (also tagged latest) for linux/amd64 and linux/arm64. For everything in Kebivo, see the 0.1.0 release and the quickstart.

Links

• Changelog: CHANGELOG.md
• Security reports: SECURITY.md

Kebivo 0.1.0

Kebivo is a self-hosted inbox for the questions your AI agents couldn't answer. Agents report knowledge gaps and proposed corrections over REST or MCP. Kebivo groups repeat reports and routes them to the people who maintain the knowledge, through the admin inbox, email or signed webhooks. It runs as one container with one SQLite file and needs no cloud account or AI provider.

This is the first release.

Run it

(umask 077; printf 'SECRET_KEY=%s\nENCRYPTION_KEY=%s\nALLOWED_ORIGINS=http://127.0.0.1:8000\n' \
  "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > kebivo.env)
docker run -d --name kebivo --restart unless-stopped -p 127.0.0.1:8000:8000 \
  -v kebivo-data:/data --env-file kebivo.env ghcr.io/ocnai/kebivo:0.1.0
curl -fsS --retry 30 --retry-all-errors --retry-delay 1 http://127.0.0.1:8000/health/ready
docker exec -it kebivo python -m kebivo.cli bootstrap --email admin@example.org

Then open http://127.0.0.1:8000/, create a project and a token, and send your first report. Back up kebivo.env separately from the data volume; the encryption key can't be recovered. The quickstart has every step, and also shows how to build from source with Docker Compose.

The image is ghcr.io/ocnai/kebivo:0.1.0 (also tagged latest) for linux/amd64 and linux/arm64.

What's in 0.1.0

• REST intake (POST /api/v1/feedback) with project tokens, idempotency keys and rate limits.
• MCP over Streamable HTTP with two tools, report_knowledge_gap and submit_knowledge_correction.
• Exact grouping of repeat questions, and optional semantic grouping through an OpenAI-compatible, Azure OpenAI or local (Ollama, LM Studio) provider. Semantic grouping is off by default.
• Inbox triage: search, filters, statuses, notes, tags, merge, split, deletion and history.
• Routing rules with a fallback and a dry-run simulator, delivering to signed webhooks, SMTP email or the built-in inbox, with durable retries and restart recovery.
• Retention on by default (feedback 180 days, delivery details 30 days, audit records 90 days), JSON Lines export, online backup and checked restore.
• SMTP delivery tries each allowed address of the mail host in resolver order, so a refused first address (for example IPv6) falls back to the next one.

Known limits

One administrator and one instance. Delivery is at least once. MCP clients need a bearer token; OAuth-only clients can't connect. Feedback is not encrypted at rest. See the README for the full list.

Links

• Documentation: https://docs.kebivo.com
• Website and framework guides: https://kebivo.com
• Changelog: CHANGELOG.md
• Security reports: SECURITY.md

Licensed under Apache-2.0.