Windows is supported today. macOS and Linux support is pending.
What runs on the workstation
Nexus consists of a desktop application and plugins that integrate with the engineering software installed on the same machine. The application accepts no inbound connections from the network. CAD models, simulation files, and generated code stay on the workstation.Optional connections to a Cosmon backend
By default, the desktop application can run without contacting a Cosmon backend at all. Each connection below is configured independently.Authorization
Nexus is licensed under one of three models.| Model | Backend connection? |
|---|---|
| Machine-locked license | None. The license is bound to a hardware fingerprint on the workstation. |
| Named license (SSO) | Required. The user signs in through a Cosmon SSO account. |
| Floating license pool | Required. Seats are checked out from a shared pool at runtime. (coming soon) |
LLM routing
The agent calls a large language model over HTTPS. Routing is configured per deployment.| Mode | Path | API key handling |
|---|---|---|
| Cosmon-routed | Desktop → Cosmon backend → LLM provider | Cosmon manages the API key. |
| Bring your own key (BYOK) | Desktop → customer-configured endpoint | Customer manages the API key. |
Operational telemetry
When enabled, the desktop application sends operational telemetry to the Cosmon backend. This includes usage counts, error reports, the application version, and OS metadata. It does not include conversation content or engineering data.LLM traces
When enabled, the desktop application sends LLM traces to the Cosmon backend. Traces include prompts, model responses, tool calls, and timing information. Because prompts and tool inputs may contain engineering context — model parameters, code snippets, error messages — this connection sends that content to Cosmon.Backend topology
When backend connections are enabled, the destination depends on what the customer has provisioned.| Topology | Destination | Availability |
|---|---|---|
| Shared tenant | api.cosmon.com | Default. Used by most customers. |
| Single-tenant, Cosmon-hosted | Customer-specific URL | Available to enterprise customers on request. |
| Customer-hosted | Customer-managed URL inside their network | Available to enterprise customers on request. |
Configuration spectrum
The four connections above are set independently, so deployments fall on a spectrum. Two endpoints of that spectrum:Fully airgapped
Machine-locked license, BYOK to an internal LLM endpoint, telemetry off, traces off. No outbound connections to Cosmon at any point.
Fully Cosmon-connected
Named (SSO) license, Cosmon-routed LLM, telemetry on, traces on. All connections active, against
api.cosmon.com.