cerebro

client site
cerebro dashboard for teams
cerebro sets up a ci run
cerebro set up jira ticket after auto decomposing
telegram meet set up
teams dashboard
mail function
tele client

Inspiration

Chat agents that execute real actions are usually built with security as an afterthought, trusting the prompt to gate dangerous operations. We wanted to see what happens when a team's actual channels, Telegram and Discord, become the security boundary itself instead of just the interface.

What it does

CEREBRO is a multi-channel AI agent that runs on Telegram and Discord simultaneously, sharing one brain across both. It executes real actions against Jira, Zoom, and a self-hosted calendar. A membrane separates user populations, and privileged actions requested on one channel must be confirmed on a different channel before they execute.

How we built it

One on_message handler receives every message from every platform, with platform differences normalized before the handler sees them. A single registry.py holds every tool schema, feeding the prompt builder and the executor from one source. Verification lives in the executor, not the prompt: every privileged call checks for a matching pending intent recorded on a separate channel before it runs. The stack is Caspian SDK for routing, Featherless.ai for inference, Postgres for state and calendar storage, APScheduler for jobs, a GitHub App, Jira REST, and Zoom Server-to-Server OAuth.

Challenges we ran into

Zoom access tokens expire after one hour, and caching one at import time broke the demo silently after that window, so tokens are now fetched per call. Discord and Telegram disagree on threading, edits, and identity, which made a single unified handler harder than expected. Putting the verification gate in the executor instead of the prompt layer took longer to build but was the only version that actually held up.

Accomplishments that we're proud of

A working two-channel authorization gate that survives a compromised prompt, since the model never holds the keys, only proposes. A self-hosted calendar with an ICS feed that avoids a Google OAuth dependency entirely.

What we learned

Security that lives in the prompt is not security. Moving the gate to the executor, after the model has already decided, made the system's behavior independent of how persuasive an attacker's message was.

What's next for cerebro

Extending the membrane past two populations, adding audit trails that survive channel deletion, and shipping a portable harness for local persona and memory across deployments.