Stop paying six different companies for your dev stack
Git repos, pull requests, and CI/CD pipelines. WebRTC chat and calls. Issues, boards, and wikis. One self-hosted platform that replaces GitLab, Gitea, GitHub, Jira, and Slack — with ~250 AI agent tools on day one.
- 8
- containers, one stack
- 7
- package & container registries
- ~250
- AI agent tools, day one
- 0
- seats to pay for
$ curl -LO https://khub.infanyx.com/khub.zip
$ unzip khub.zip && cd khub
$ ./scripts/docker/deploy.sh --self
[+] Running 9/9
✓ running at https://localhost
✓ git remote git@localhost:2222
✓ mcp tools 247 registered
$
Everything a dev team needs. Nothing you have to stitch together.
Design goals
Built on four rules, not a feature list
Everything above follows from a small set of architectural commitments — the same four that get enforced on every pull request to the platform itself.
One authorization model
A single role and permission graph governs Git access, CI/CD, package publishing, issue tracking, and chat — not a separate ACL system per subsystem.
Everything is an API first
The web app is a client of the same REST API documented at /api/docs that every integration uses. The MCP server exposes that whole surface to agents with zero bespoke integration code.
Standards-compliant by default
OCI Distribution, SCIM 2.0, SAML 2.0, the npm registry protocol. Your existing docker, npm, and IdP tooling works against KHUB without a plugin.
Auditable by default
Every privileged mutation — permission changes, deletions, settings changes, impersonation — hits an append-only audit log, whether or not you turned logging on for it.
Platform
One platform. Every tool your team already relies on.
KHUB isn't a thin wrapper around other tools — it's a real Git server, a real CI engine, and a real chat system, built to work together from day one.
Real Git, HTTP & SSH
A genuine Git server — clone, push, pull over HTTP or SSH. No proprietary storage, no lock-in, no surprises.
Pull requests & code review
Diffs, inline comments, required reviewers, and merge queues that behave exactly the way your team already expects.
Visual CI/CD pipeline editor
Drag-and-drop pipelines with 50+ starter templates, matrix builds, approval gates, and encrypted secrets.
WebRTC chat & voice calls
Team channels, DMs, and peer-to-peer voice calls built in — no separate app, no separate bill.
Issues, boards & wikis
Kanban boards, issue tracking, releases, and wikis scoped to org, project, and team — with full audit logging.
~250 MCP tools, generated live
Every API route becomes a token-scoped tool for Claude Code, Claude Desktop, or any MCP client — automatically.
A visual CI/CD pipeline editor, not another YAML dialect
Build the job graph visually or author it as YAML — both compile to the same pipeline. Every run executes in an isolated, ephemeral container, with matrix builds, approval gates, and encrypted secrets built in.
- Matrix builds across runtimes and OS targets
- Manual approval gates before sensitive stages
- Encrypted secrets, scoped per pipeline
- Build artifacts with retention policies
- Cron triggers for scheduled jobs
- Isolated, ephemeral CI containers per run
Engineering insights, day one
Computed directly from pipeline & deployment history — no separate instrumentation.
Deployment frequency
14/day
Lead time for changes
38 min
Change failure rate
2.1%
Mean time to recovery
9 min
Registries
Seven package ecosystems. Zero storage quota.
Every organization is also a standards-compliant registry for the languages your team already ships — authenticated with the same personal access token as everything else.
$ npm publishnpm
$ docker pushOCI / Docker
$ twine uploadPyPI
$ cargo publishCargo
/packages/npm/npm
Scoped registry per organization — npm, pnpm, and yarn work unmodified.
/v2/<org>/<image>/OCI / Docker
Full Distribution Spec v2 — docker login, push, and pull, no plugin needed.
/packages/pypi/simple/PyPI
A real PEP 503 simple index — pip and twine, zero configuration beyond a token.
/packages/cargo/Cargo
crates.io's sparse protocol — cargo publish, cargo yank, all supported.
/packages/maven/maven2/Maven
Standard /maven2/ layout for Maven and Gradle, including multi-file versions.
/packages/nuget/v3/NuGet
V3 flat-container feed — dotnet nuget push and restore, out of the box.
/packages/composer/Composer
A standard composer-type repository, plus a KHUB publish endpoint.
Boards, sprints, and chat that already know who you are
No second invite system, no separate workspace to provision. Planning and chat inherit the same org and repo roles as everything else — and velocity is computed from real logged time, not story points you have to calibrate.
- Kanban boards, shared across every repo in a project
- Milestones double as sprints — no separate sprint entity to manage
- Time estimates & logged time, per issue, summed from real entries
- No-code automation rules — label, assign, and comment on triggers
- Cross-project Gantt-style roadmap, every milestone in one timeline
- Org channels, DMs, and unlimited WebRTC voice — no Huddles paywall
~250 tools, generated live from your own API
KHUB doesn't bolt on a fixed integration — it reads its own API surface and generates an MCP tool for every route, automatically, as the platform grows. Point any MCP client at your instance and it gets exactly the access its token allows.
Every tool call is authenticated with a token-scoped credential — agents only ever reach the routes they're explicitly permitted to use.
Architecture
Eight containers. One deployment.
A transparent architecture you can read, audit, and run anywhere containers run.
Caddy
Edge proxy & automatic TLS
Next.js web
Application frontend
NestJS API
Core application server
SSH daemon
Git-over-SSH transport
MCP server
AI agent tool generation
PostgreSQL
Primary datastore
Redis
Queues, cache & pub/sub
CI runner
Isolated pipeline execution
Request flow, at a glance
Every arrow above is subject to the same permission check, in the same code path — a git push over SSH, a docker push, an MCP tool call, and a click in the browser all resolve identically.
Identity & compliance
The Enterprise-tier gate, shipped in the base install
SSO, provisioning, and an audit trail are the single most common “talk to sales” upgrade across every competitor on this page. On KHUB, they're not a tier — they're just how it works.
Everywhere else: SAML SSO is a paid add-on, SCIM needs a separate license, and the full audit log is gated behind Enterprise pricing.
SAML 2.0 SSO
Standard SP-initiated flow. Point any IdP at it — Okta, Entra ID, anything SAML-capable.
SCIM 2.0 provisioning
Full user & group lifecycle at /api/scim/v2 — deactivate in your IdP, deactivated here.
LDAP / Active Directory sync
A scheduled sync reconciles users and group membership onto KHUB teams automatically.
SIEM export
A pull-based, cursor-paginated audit feed for the security tooling you already run.
Self-service GDPR tools
Every user can export or request deletion of their own data — no ticket required.
Audited impersonation
Admins can act as a user to debug an issue — every action is attributed and logged.
Security
Security & governance, by default
Not an add-on tier. Every KHUB instance ships with the same hardening, whether you run it for a team of three or three hundred.
Isolated CI containers
Every pipeline run executes in a fresh, ephemeral container with no access to other jobs or the host.
Encrypted secrets
Pipeline and repository secrets are encrypted at rest and only decrypted inside the run that needs them.
Argon2 password hashing
Credentials are hashed with Argon2, the current OWASP-recommended KDF, not a legacy scheme.
TOTP two-factor auth
Time-based one-time passcodes for every account, enforceable at the org level.
Full audit logging
Every privileged action — merges, permission changes, secret access — is logged and reviewable.
SSRF hardening
Outbound requests from webhooks and integrations are filtered against internal network ranges.
Branch protection
Required reviews, required status checks, and restricted force-pushes on the branches that matter.
Token-scoped agent access
AI agents authenticate with scoped tokens — exactly the routes they need, nothing more.
Head to head
One platform vs. a shelf of point tools
GitLab and Gitea/Forgejo cover Git. GitHub, Jira, and Slack cover the rest — for a price, and only if you stitch them together yourself.
| Capability | KHUB | GitLab / Gitea / Forgejo | GitHub + Jira + Slack |
|---|---|---|---|
| Git hosting & pull requests | |||
| Visual, drag-and-drop CI/CD editor | |||
| Built-in team chat & voice calls | |||
| Issues, boards & wikis | |||
| AI agent tools generated live from your API | |||
| One login, one audit log, across everything | |||
| SAML SSO, SCIM & LDAP sync — every tier, free | |||
| npm, OCI, PyPI, Cargo, Maven, NuGet & Composer registries | |||
| Self-hosted — data never leaves your network | |||
| Unlimited seats, no per-user billing | |||
| Open source |
Full = ships out of the box. Partial = available on some products in that category, or with added licensing. None = not offered.
Pricing
There is no pricing page
Figures below are illustrative — gathered from each vendor's general published pricing for a 25-person team. Treat this as the shape of the gap, not a quote.
The stitched-together stack
- GitHub EnterpriseSSO, SCIM, audit log$21/user/mo
- Slack Business+SAML SSO, SIEM export$12.50/user/mo
- Jira PremiumRoadmaps, unlimited storage$15.25/user/mo
$1,219/mo
≈ $14,628/yr for 25 seats — before Copilot, CI minutes, or registry storage overages.
KHUB, self-hosted
- No per-seat billing, ever
- No metered CI minutes
- No storage quota to outgrow
$0/mo
You pay for the hardware you already run KHUB on. Nothing else.
“My GitHub account was deleted over security research I'd done in good faith — and with it, years of repos, issues, and history I didn't control. I built KHUB so that never happens to my work again: infrastructure I own, running on hardware I control, that no single company can take away.”
Prepakis Georgios
Founder, KHUB · kernelstub
Frequently asked questions
Everything you need to know before you self-host.
Own your stack in three lines
Download, extract, and run the deploy script for your environment — Docker, Podman, and Kubernetes are all included.
Deploying with Podman or Kubernetes, or running on macOS? See the full install guide.