Getting Started

Installation

bash
curl -fsSL https://get.mbm.mn/install | bash
Note: If prompted for a password, enter your system password or your license key.

Platform Support

OSArchitectures
Linuxx64, arm64 (glibc & musl)
macOSIntel (x64), Apple Silicon (arm64)
Windowsx64 via Git Bash / MSYS2 / WSL

First Run

bash
mbm                    # Launch interactive TUI mbm run "Hello"       # Send a message mbm --help            # Show all commands
Tip: Run mbm in your project directory to give the AI context about your codebase automatically.

License & Activation

License Types

TierTokens / DaySessionsDevicesKey Features
Free0 (BYOK)11BYO API key, RAG, Export
Pro100K51All models, Priority Queue, API
Business150K1020Team Collab, All Features

Higher tiers available — view billing page or contact us.

Obtaining a License

  1. Sign up at console.mbm.mn/auth
  2. Navigate to License & Keys
  3. Choose a plan or apply an existing license key

Applying a License Key

License keys use the MBM-XXXX-XXXX-XXXX-XXXX format:

bash
mbm license apply MBM-XXXX-XXXX-XXXX-XXXX

Activate with a License File

bash
mbm license activate /path/to/license.license

Example output:

$ mbm license activate ./license.license
 License activated successfully.

   Device ID:  a1b2c3d4e5f6a7b8
   Tier:       pro
   Expires:    2029-12-31

Connecting with an API Key

API keys use the {prefix}-{uuid} format (mf- / mp- / mb- prefix). Apply them inside the TUI:

  1. Launch the TUI: mbm
  2. Type /connect to open the provider connection dialog
  3. Select mbm as the provider
  4. Paste your API key when prompted

Alternatively, use the CLI:

bash
mbm providers login # Select "mbm" → paste your API key (mp-abc123...)

Check License Status

bash
mbm license status
  Device ID:    a1b2c3d4e5f6a7b8
  License:      Activated
  Tier:         pro
  Expires:      2029-12-31T00:00:00.000Z
  Max Devices:  1
  Priority Queue: enabled
  API Access:     enabled

Device Binding

Each license is bound to a unique device ID derived from your hardware. If you change machines or hardware, you may need to re-activate your license.

Need help? Visit License & Keys to manage your licenses or upgrade your plan.

Providers & Models

Supported Providers

ProviderAuthModel Examples
mbm (recommended)API KeyGPT-4o, Claude, DeepSeek
AZ Network (recommended)API KeyGPT-4o, Claude, DeepSeek
OpenAIAPI Keygpt-4o, gpt-4o-mini, o3
AnthropicAPI Keyclaude-opus-4, claude-sonnet-4
Google GeminiAPI Keygemini-2.5-pro, gemini-2.5-flash
OpenRouterAPI KeyMulti-provider gateway
DeepSeekAPI Keydeepseek-chat, deepseek-reasoner
OllamaLocalllama3.2, qwen3, mistral

Connecting Providers via /connect

Use /connect inside the TUI to add any provider:

  1. Run mbm to launch the TUI
  2. Type /connect and select a provider (e.g. DeepSeek, OpenAI)
  3. Paste your API key when prompted

Example: /connect → select DeepSeek → paste sk-... API key

Adding API Keys

bash
mbm providers login

Interactive prompt: select provider → paste API key. Credentials are stored in ~/.local/share/mbm/auth.json with restrictive file permissions.

Via Config File

Add credentials to ~/.config/mbm/mbm.json:

json
{
  "provider": {
    "openai": {
      "apiKey": "sk-proj-..."
    },
    "anthropic": {
      "apiKey": "sk-ant-..."
    }
  }
}

Selecting a Model

bash
mbm models                     # List all available models mbm models openai              # Filter by provider

In the TUI: press / to open the model picker — search by name, filter by provider, select with Enter.

Ollama (Local Models)

Install:

bash
curl -fsSL https://ollama.com/install.sh | sh ollama pull llama3.2

Connect (auto-detect): If Ollama runs on localhost:11434, mbm discovers it automatically.

Custom URL (config):

json
{
  "provider": {
    "ollama": {
      "baseURL": "https://ollama2.mbm.mn/v1"
    }
  },
  "model": {
    "ollama": "qwen3.6:latest"
  }
}

Environment variable:

bash
export OLLAMA_HOST=http://your-host:11434 mbm

Agent Modes

What Are Agent Modes?

Modes control what the AI agent is allowed to do — read files, run commands, write code, or only analyze. Choose the right mode for your task to stay in control.

ModeReadWriteExecuteNetworkBest For
GeneralAskAskAskAskDaily use, mixed tasks
SAFEAllowConfirmConfirmConfirmExploring unknown code
BuildAllowAllowAllowAllowActive development
PlanAllowDenyDenyAskResearch, architecture

SAFE Mode

Requires confirmation for every write operation — file edits, bash commands, git operations. Ideal for learning or cautious exploration.

bash
mbm --safe                # Launch in SAFE mode mbm run --safe "Review the auth module"

Build Mode

Full permissions: file writes, command execution, network access. Best for active coding sessions where you want the agent to implement changes directly.

Plan Mode

Read-only mode: the agent can read files, search code, and fetch documentation — but cannot write, execute, or modify anything. Use before implementation to research and plan.

Permission Configuration

Fine-tune permissions in mbm.json:

json
{
  "permission": {
    "bash": "ask",
    "edit": "ask",
    "read": "allow",
    "webfetch": "allow",
    "mbm-rag_*": "allow"
  }
}

Values: "allow" — always permit, "deny" — always block, "ask" — confirm each time.

Key Features

RAG — Knowledge Base

Retrieval-Augmented Generation indexes your codebase and documents for semantic search. The AI can answer questions about your entire project.

Setup

bash
mbm rag setup              # Install Docker + pgvector mbm rag enable             # Enable auto-sync on git changes mbm rag index .            # Index current directory

Usage

bash
mbm rag search "how does auth work" mbm rag status             # View KB statistics mbm rag optimize           # Remove duplicates & stale entries

MCP — Model Context Protocol

Connect external tools and data sources via standardized protocol servers.

bash
mbm mcp add               # Add an MCP server
mbm mcp list              # List configured servers
mbm mcp auth <name>       # OAuth authenticate
mbm mcp debug <name>      # Test connection

Sessions

Save, share, fork, and resume conversation sessions.

bash
mbm session list          # List all sessions mbm session share         # Generate share link mbm session compact       # Summarize to reduce context mbm session export        # Export to file

Custom Agents

Create agents with specific permissions, models, and system prompts for specialized tasks.

bash
mbm agent create          # Interactive agent builder mbm agent list            # List your agents

Usage Stats

bash
mbm stats                # Token usage and cost summary

Commands Reference

Top-Level Commands

CommandDescription
mbmLaunch interactive TUI
mbm run <message>Send a message (non-interactive)
mbm models [provider]List available AI models
mbm providers loginAdd provider API credentials
mbm rag <subcommand>Manage knowledge base
mbm agent createCreate a custom agent
mbm mcp addAdd MCP server
mbm session <subcommand>Manage sessions
mbm statsView token usage and costs
mbm serveStart headless server
mbm webStart server + open web UI
mbm attachAttach to a running server
mbm plugin installInstall a plugin
mbm upgradeUpgrade to latest version
mbm uninstallRemove mbm from your system
mbm aboutVersion and installation info
mbm license statusShow license status
mbm license activateActivate offline license file
mbm license applyApply API key or license key

Global Options

OptionDescription
--safeRequires confirmation for all write operations
--print-logsPrint logs to stderr
--log-level <level>DEBUG, INFO, WARN, ERROR
--pureRun without external plugins
--help, -hShow help
--version, -vShow version

RAG Subcommands

CommandDescription
rag setupInstall Docker + pgvector infrastructure
rag enableEnable auto-sync on git changes
rag disableDisable auto-sync
rag statusShow knowledge base statistics
rag index [path]Index files into the KB
rag search <query>Semantic search the KB
rag optimizeRemove duplicates and stale entries

CLI Usage Examples

One-Shot Prompts

bash
# Run with a specific model (provider/model format) mbm run -m openai/gpt-4o "Refactor this to async/await" mbm run -m deepseek/deepseek-v4-pro "Explain quantum computing" mbm run -m ollama/llama3:8b "What is this error?" mbm run -m anthropic/claude-sonnet-4-5 "Review this architecture" # With thinking/reasoning enabled mbm run -m deepseek/deepseek-v4-pro:thinking --thinking "Solve this math problem"

Pipe & File Workflows

bash
# Pipe stdin git diff HEAD~5 | mbm run -m openai/gpt-4o "Write a PR description" cat /var/log/nginx/error.log | mbm run -m ollama/llama3:8b "Diagnose this error" # Attach files for context mbm run -m openai/gpt-4o -f src/main.ts "Find bugs in this file" mbm run -m ollama/llama3:8b -f src/*.ts "Review these files" # Batch processing for f in src/**/*.ts; do mbm run -m ollama/llama3:8b -f "$f" "Add JSDoc to untagged functions" --dangerously-skip-permissions; done

Session Management

bash
# Continue last session mbm run -c "Add error handling to the login function" mbm run --continue "Expand on the previous answer" # Resume a specific session mbm run -s sess_abc123 -m ollama/llama3:8b "Next step?" mbm run --fork -s sess_abc123 -m openai/gpt-4o "Try a different approach"

CI/CD & Automation

bash
# JSON output for CI pipelines mbm run --format json -m openai/gpt-4o "Code review" > review.jsonl # Slash command mbm run --command /review -m openai/gpt-4o src/api/ # Remote server diagnostics via SSH ssh user@server "mbm run -m ollama/llama3:8b 'Server health check' --dangerously-skip-permissions"

Permissions & Environment

bash
# Auto-approve all permissions (use with caution) mbm run -m ollama/llama3:8b --dangerously-skip-permissions "Fix all bugs" # Safe mode (read-only, no writes) MBM_SAFE_MODE=1 mbm run "Analyze project structure" # Custom Ollama host OLLAMA_HOST=http://10.0.0.5:11434 mbm run -m ollama/llama3:8b "Hello" # Configure permissions in mbm.json: #   "permission": #     "external_directory":  "/proc/*": "allow" #     "bash": "allow" #     "read": "allow"

API Keys

Key Format

API keys use the format {prefix}-{uuid}:

PrefixTierExample
mf-Freemf-a1b2c3d4e5f6...
mp-Promp-a1b2c3d4e5f6...
mb-Businessmb-a1b2c3d4e5f6...

Creating Keys

  1. Log in to console.mbm.mn
  2. Navigate to Account → API Keys
  3. Click Create Key
  4. Copy the key immediately — it is shown only once

Using Keys in CLI

bash
mbm providers login # Select "mbm" → paste your API key

Or inside the TUI: type /connect, select mbm, and paste your key.

Using Keys in API Requests (External Tools)

Your API key works with any OpenAI-compatible client. No TUI or CLI is required. Use https://proxy.mbm.mn/v1 as your base URL.

curl

bash
curl https://proxy.mbm.mn/v1/chat/completions \
  -H "Authorization: Bearer mf-abc123..." \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-4o", "messages": [{"role": "user", "content": "Hello"}]}'

OpenAI SDK (Python)

python
from openai import OpenAI

client = OpenAI(
    base_url="https://proxy.mbm.mn/v1",
    api_key="mf-abc123...",
)

response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Hello"}],
)
print(response.choices[0].message.content)

OpenAI SDK (JavaScript)

js
import OpenAI from "openai"

const client = new OpenAI({
  baseURL: "https://proxy.mbm.mn/v1",
  apiKey: "mf-abc123...",
})

const response = await client.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: "Hello" }],
})
console.log(response.choices[0].message.content)
Wallet: Paid models consume credits from your wallet. Top up via Account → Wallet using Stripe or QPay. Free-tier models ($0.00/1M tokens) do not debit your wallet.

Tier Limits

FeatureFreeProBusiness
Daily tokens0 (BYOK)100,000150,000
Monthly tokens0 (BYOK)2,000,0003,500,000
Concurrent sessions1510
Max devices1120
RAG supportYesYesYes
Security: Keys are shown only once. Store them securely. Revoke compromised keys immediately from API Keys.

Configuration

Config File

Global config: ~/.config/mbm/mbm.json
Per-project: .mbm/mbm.json (in your project root)

Full Example

json
{
  "model": {
    "default": "openai/gpt-4o",
    "openai": "gpt-4o",
    "ollama": "llama3.2:latest"
  },
  "provider": {
    "openai": {
      "apiKey": "sk-proj-..."
    },
    "ollama": {
      "baseURL": "http://localhost:11434/v1"
    }
  },
  "permission": {
    "bash": "ask",
    "edit": "ask",
    "read": "allow",
    "webfetch": "allow"
  }
}

Comprehensive Example

Full configuration with custom providers, MCP servers, and advanced options:

json
{
  "$schema": "https://get.mbm.mn/config.json",
  "provider": {
    "ollama": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Ollama (Local)",
      "options": {
        "baseURL": "http://localhost:11434/v1"
      },
      "models": {
        "qwen3-coder": {
          "name": "qwen3-coder:latest",
          "options": {
            "num_ctx": 262144,
            "stream": false,
            "tools": []
          }
        }
      }
    },
    "openai": {
      "apiKey": "sk-proj-..."
    }
  },
  "mcp": {
    "mbm-rag": {
      "type": "local",
      "command": [
        "python3",
        "~/.mbm/bin/rag/rag_mcp_server.py"
      ]
    }
  },
  "lsp": true,
  "rag_inject": true,
  "permission": {
    "bash": "ask",
    "edit": "ask",
    "read": "allow",
    "webfetch": "allow",
    "mbm-rag_*": "allow"
  }
}

Environment Variables

VariablePurpose
MBM_DIRSource / install directory
MBM_CONFIG_DIROverride config directory
MBM_CONFIGPath to a single config file
OLLAMA_HOSTOllama server address
MBM_INSTALL_SERVERInstall server URL
MBM_EXPERIMENTAL_BASH_DEFAULT_TIMEOUT_MSDefault timeout for bash commands in ms (default 120000 = 2 min)

Directory Layout

PathPurpose
~/.local/share/mbm/Data: logs, repos, DB, auth files
~/.cache/mbm/Cache: LSP binaries, skill definitions
~/.config/mbm/Config: themes, mbm.json, tui.json
~/.local/state/mbm/State: model tracking, plugin metadata
~/.mbm/bin/mbmBinary / wrapper
~/.mbm/logs/Install logs

Web UI & Team Workflow

Every mbm server ships an embedded web interface. Use it to browse sessions, continue a terminal conversation in a browser, or let non-technical teammates plan while developers implement — all on the same machine and the same project data.

Quick Start

Start the server and open the web interface in your browser:

bash
mbm web                # starts on 127.0.0.1:8027 by default

The default port is 8027 and the server binds to 127.0.0.1. Pass --port / --hostname, or configure a fixed port in ~/.config/mbm/config.json:

json
{
  "server": {
    "port": 8027,
    "hostname": "127.0.0.1"
  }
}

Serving under an Alias (e.g. /mbm)

Behind a reverse proxy, mount the UI under a base path such as /mbm. Set MBM_WEB_UI_BASE so deep links and page refreshes resolve correctly:

bash
export MBM_WEB_UI_BASE=/mbm mbm web
nginx
location = /mbm   { return 301 /mbm/; }
location ^~ /mbm/ {
  proxy_pass         http://127.0.0.1:8027/;   # trailing "/" strips /mbm
  proxy_buffering    off;                       # keeps SSE streams live
}

You then open http://<server-ip>/mbm.

Authentication

The server is protected by HTTP Basic auth. The default username is mbm and the default password is mbmTUI123 — the CLI prints this value on startup when it is used.

Change the default password. Before exposing the server on any network, set MBM_SERVER_PASSWORD to a strong random value. Keep it in the OS environment of the process so it survives restarts:
bash
export MBM_SERVER_USERNAME=admin
export MBM_SERVER_PASSWORD='correct-horse-battery-staple'
mbm web

The browser prompts for credentials on first visit. WebSocket connections reuse the same session automatically (an auth_token query parameter is attached by the UI).

Plan → Build Team Flow

A natural workflow: a manager or product owner researches and drafts a plan from the web while a developer picks up the same session on the CLI and implements it in build mode.

RoleInterfaceAgentRights
Manager / PlannerWeb UI (http://<ip>/mbm)planRead-only — no file writes, no shell, no PTY
DeveloperTerminal (TUI or mbm attach)buildFull — file writes, shell, tools

The web UI runs in plan-only mode by default (MBM_WEB_UI_PLAN_ONLY=true): non-terminal clients are forced onto the plan agent and writing tools (write, apply_patch, patch, plan_exit), the shell, and PTY endpoints are denied. This makes the web interface safe for managers — the plan agent can read code, run research, and discuss, but cannot accidentally modify anything.

Manager (web)                     Developer (CLI)
─────────────                     ────────────────

1. Open http://<ip>/mbm
   → create a session in the project
2. Describe the requirements
   → plan agent researches & drafts
   a plan (read-only, safe)
3. Hand over the session
   (copy the session id / title)    ───►
                                            4. mbm attach http://localhost:8027 --session <id>
                                               (or run mbm in the project and open the session)
                                            5. Switch to build mode: /agent build
                                            6. Developer approves & the plan is implemented
                                               with full write + shell access
5. Watch progress live on the web ◄─────     (both sides stream the same session via SSE)

Step by step on the developer side:

bash
# Attach the terminal UI to the running web server (realtime sync)
mbm attach http://localhost:8027 --session sess_abc123

# Or continue the latest session
mbm attach http://localhost:8027 --continue

# Switch to the build agent and start implementing
/agent build

In plan mode the agent records the final plan to a per-session plan file in the project's .mbm/plans/ directory and ends with plan_exit. The developer then switches to build and the AI implements that plan — the whole planning conversation stays in the same session as context.

If you trust the network and want the web UI to have full write access too, set MBM_WEB_UI_PLAN_ONLY=false and restart the server. This removes the plan-only guard, so use it only behind an SSH tunnel or a TLS reverse proxy.

Continue a Terminal Session in the Browser

From the TUI, run /share (or mbm session share) to generate a link that opens the current session in the web UI, where you can keep chatting with it.

Point share links at your own server so nothing is pushed to the remote share service. Configure share_base_url in ~/.config/mbm/config.json or set MBM_WEB_URL:

json
{
  "share_base_url": "http://localhost:8027"
}
bash
export MBM_WEB_URL=http://localhost:8027

With a base URL configured, the share link looks like http://localhost:8027/<base64-of-project-dir>/session/<session-id> and all remote sync is skipped — session data never leaves your machine.

Private Remote Access

Keep the server bound to 127.0.0.1 and reach it remotely through an SSH tunnel:

bash
# On your laptop
ssh -N -L 8027:127.0.0.1:8027 user@<server-ip>

# Now open on your laptop
http://localhost:8027
Do not expose the server publicly without TLS. Binding to 0.0.0.0 over plain HTTP sends credentials and session content in cleartext. If you must expose it, put a TLS reverse proxy (nginx / caddy) in front, keep Basic auth enabled, and set a strong password.

Environment Variables

VariablePurpose
MBM_SERVER_PASSWORDServer Basic auth password (default mbmTUI123)
MBM_SERVER_USERNAMEServer Basic auth username (default mbm)
MBM_WEB_URLBase URL used for local session share links
MBM_WEB_UI_BASEMount path for the web UI behind a reverse proxy (e.g. /mbm)
MBM_WEB_UI_PLAN_ONLYWhen true (default), the web UI is restricted to the plan agent and write/shell tools are denied
MBM_DISABLE_EMBEDDED_WEB_UIDisable the embedded web UI (assets are then proxied from the upstream CDN)
MBM_DISABLE_SHAREDisable all session sharing (local and remote)

Troubleshooting

Ollama Connection Fails

  1. Verify Ollama is running: systemctl status ollama or ollama serve
  2. Check the port: curl http://localhost:11434/api/tags
  3. Pull a model: ollama pull llama3.2
  4. If using a remote host, verify the OLLAMA_HOST env var or baseURL in config

License Invalid / Expired

  1. Check status: mbm license status
  2. Verify your device ID matches the license binding
  3. Re-apply the license key: mbm license apply MBM-XXXX-...
  4. Visit License & Keys to check your account status

Rate Limit Hit (429 Errors)

  1. Check your usage: mbm stats
  2. View daily limits at Usage dashboard
  3. Consider upgrading your plan for higher limits

RAG Not Working

  1. Ensure Docker is running: docker ps | grep mbm-rag
  2. Check setup: mbm rag setup
  3. Enable auto-sync: mbm rag enable
  4. Re-index: mbm rag index .
  5. Check status: mbm rag status

API Key Not Working

  1. Keys are shown only once at creation — if lost, revoke and create a new one
  2. Verify the key format: {prefix}-{32-char-hex}
  3. Check if the key was revoked at API Keys
  4. Ensure you have an active license for the tier
Still stuck? Visit your dashboard or contact support through the License & Keys page.