ScopeWeaver

ScopeWeaver is an LLM multi-agent system for autonomous penetration testing, with a Go backend and a Next.js frontend. Its agents plan, execute, and report on security tests, and every model call goes through an LLM profile you configure in the web UI. Any OpenAI-compatible endpoint works, including Nebul.

Prerequisites

• A running ScopeWeaver instance (it needs a PostgreSQL database; see its documentation for deployment)
• A Nebul AI Studio account with API access
• An API key for your active project
• A model ID from the Model Catalog

Connect it to Nebul

ScopeWeaver keeps model providers as LLM profiles. Create one for Nebul:

1. Open LLM in the ScopeWeaver UI and select New.
2. Give the profile a name, such as nebul.
3. Pick the format. OpenAI Chat Completions is the usual choice; OpenAI Responses and Anthropic also work against Nebul.
4. Set Base URL to https://api.inference.nebul.io/v1.
5. Paste your Nebul API key.
6. Enter the model ID, for example zai-org/GLM-5.3.
7. Set output limit and context window to match the model. Take them from /v1/model/info instead of estimating.
8. Save, then use Test connection to verify the endpoint, and Load models to pull the model list from the endpoint.
9. Activate the profile. Saved profiles are inactive until you switch to them.

The form also carries proxy, session header, retry, and concurrency settings, which you can leave at their defaults for Nebul.

Run it

Start a task from the ScopeWeaver UI in a project you are authorized to test. The main agent, judge calls, and side questions all use the active LLM profile, and usage appears under the API key's project in AI Studio. Confirmed findings land on the Findings page.

Troubleshooting

• Test connection fails with 401: the API key is wrong, revoked, or from a different project. Create a fresh key in AI Studio.
• Test connection fails with 404: the base URL must be https://api.inference.nebul.io/v1, with the /v1 suffix.
• Load models returns nothing: /v1/models only returns models enabled for the key's project. Check the project's model access in AI Studio.
• Agent runs stop mid-task: long agent sessions consume context. A model with a large context window, such as zai-org/GLM-5.3 with 1M tokens, keeps sessions going without compaction.

Data and telemetry

ScopeWeaver performs update checks and, when allowed, agent web searches, both of which reach third-party servers. Its local-only LLM network mode blocks both, along with downloads, when you enable it.

Prompts, findings, and evidence stay in your ScopeWeaver database. Model requests go only to the LLM profile you configure, which after this setup is Nebul. For how Nebul treats the requests it receives, see Privacy & Security.