JernCloudStart with GitHubJern Cloud docs
FAQ and limits.
Short answers, and the numbers behind them.
Limits every attempt runs under
| Limit | Value |
|---|---|
| Tokens per attempt | The session cap, up to the workspace maximum an admin sets under the platform ceiling |
| Agent phase | The workspace's time limit per attempt, 30 minutes by default, up to 45 minutes on trial, 4 hours on paid plans |
| Whole machine | The time limit plus setup and publication; a guard of 25 hours behind it |
| Setup command | 10 minutes |
| Processes per attempt | 128 |
| Agent output | 10 MiB per phase |
| Attempts per task | 3 |
| Machine | Shared 2 vCPU with 2 GB by default; 4 or 8 dedicated vCPU with 8 or 16 GB by choice, metered per hour |
| Evidence retention | 90 days by default, adjustable |
Can the agent merge?
No. It pushes to the session's branch and opens or updates one pull request. Merging is yours.
Can the agent reach the internet?
Not unless the baseline opens exact public hosts to it (network_allow), reached over HTTPS through the runner's proxy with every connection counted. Otherwise its only route is the relay to the Jern gateway. A setup command may reach the package registries the environment declares, in a separate domain that is destroyed before the agent starts. It can read the repository's issues through the run-scoped MCP server: the control plane fetches them with a read-only token that never enters the machine, and every read is on the receipt.
Does the agent see my API key or GitHub token?
No. The gateway holds your provider key. The checkout token is erased right after the fetch, and publication uses a token the runner obtains only after the policy checks pass.
Where does my code go?
To a machine created for the attempt and destroyed afterwards, and, as prompts, to the model provider under your own key. Evidence is encrypted before it reaches Jern's database. Conversation text is stored in plaintext so the dashboard can show it, and is redacted after the retention window.
Which languages and environments?
Python, Node, and .NET environments are available today, plus a general image with Python, Node, and a native toolchain. The .NET environment carries the .NET 10 SDK and restores from NuGet during setup. The environment is pinned per session by revision, and an admin can assign a different one per repository.
Why did my attempt fail?
The attempt card states the reason: cap exhausted, policy refusal, provider rejection, or a publication problem. An attempt that reaches its time limit is not a failure: what the agent had is published and the attempt is marked timed out. The receipt and trace have the detail. Three failed attempts mark the task exhausted.
What does it cost?
The control plane is priced per workspace per month after a 30-day free trial, and can be bought through GitHub Marketplace, billed by GitHub to the account that installed the App. Model usage is billed by your provider on your own account. See pricing.
Where do I report a security issue?
security@jern.ai, or GitHub private vulnerability reporting on the open-source repository. See the security page.