Open sourceQwenBridge 1.0 · Universal Intelligence Core

Let people search the way they talk.

QwenBridge turns a sentence typed into your search box, in any language and typos included, into validated filters and a safe search plan. No filter maze, no zero-result pages.

  • Self-hosted
  • No database required
  • Java & TypeScript SDKs
  • Apache 2.0
Failed searches 0Clicks 0Time 0:00
 

No filter maze

Shoppers say “black Nike, size 42, under 100 EUR” once. QwenBridge sets brand, color, size and price for them.

Fewer zero-result pages

Typos are corrected, other languages are understood, and empty searches get recovery and suggestions.

Safe by default

Injection, jailbreak and obfuscation attempts are stopped before they reach your index or a model.

The problem

Search boxes fail in four predictable ways.

Each scene runs the same query twice: once through plain keyword search, once through QwenBridge. Field names and statuses match the real v2 API.

Queryred wintr jaket under 100 EUR
Plain keyword search
match: wintr jaket
0 resultsNo products contain “wintr” or “jaket”. The shopper leaves.
QwenBridge spelling · SAFE_AUTO_CORRECT
wintr→winterapplied
jaket→jacketapplied
protected: 100 EUR never changed
Detector guessed Swedish; English knows more of the words, so English is used.
Red winter jacket89 EUR
Red down winter jacket96 EUR
How it works

One request, eight stages, one typed answer.

Every stage is timed, traced and reported in the response, so you can see exactly why a query produced its results.

  1. 1
    Validateinput-validation

    Size, encoding, tenant, scope and rate limits are checked before anything runs.

  2. 2
    Detect languagelanguage

    Script- and model-based detection, mixed-script segments, text direction, Unicode normalization.

  3. 3
    Correct typosspelling

    Per-language, per-tenant dictionaries. URLs, amounts, SKUs and acronyms are never touched.

  4. 4
    Expand languagesexpansion

    Optional translation into configured target languages, with identifiers preserved.

  5. 5
    Check threats & policythreat · policy

    12 threat-detector families and a central default-deny policy engine with approvals.

  6. 6
    Build QueryIRanalysis

    Intent plus grounded constraints, each quoting the original query, validated against the schema.

  7. 7
    Retrieveexecution

    Keyword, vector or hybrid (rank fusion), adaptive planning, reranking, zero-result recovery.

  8. 8
    Verify resultsconstraint-validation

    Every hit is checked against the hard constraints. Confidence and evidence are attached.

Responsestatus · intent · queryIR · results · confidence · evidence · suggestions · timings
Streamingsearch.started → search.completed | search.failed
Features

Everything between the search box and the index.

One engine for understanding, safety and retrieval, so each application does not have to rebuild it.

01

Language detection

Script and model-based detection, mixed-script segments, text direction and Unicode normalization.

02

Typo correction

Per language and per tenant. URLs, amounts, SKUs and acronyms are never changed. Four modes, from suggest-only to aggressive.

03

Multilingual expansion

Translates the query into configured languages, preserves identifiers, and fuses retrieval across them.

04

Grounded understanding

Intent and constraints in a versioned QueryIR. Every value quotes the user’s words, with confidence and evidence.

05

Threat detection & policy

12 detector families, a central default-deny policy engine, approvals, rate limits, quotas and tenant isolation.

06

Keyword, vector & hybrid

Rank fusion, adaptive planning, reranking, zero-result recovery and suggestions.

07

Domain packs

Commerce and Library packs, a connector-pack SPI, a plugin SDK, signed packs, offline licences and editions.

08

Production operations

SmallRye Health, Micrometer metrics with latency histograms, OpenTelemetry tracing and structured logs.

Developers

Integrate in an afternoon.

Call it over REST, stream it over SSE, or use an SDK. The Java SDK depends only on Jackson; the TypeScript SDK has no runtime dependencies. Both are tested against the same real server.

  • Typed errors with code, category and retryable
  • Deadlines, cancellation and heartbeats on every stream
  • Tenant-aware API keys in production
Read the quick start
curl -s http://localhost:8080/api/v2/search \
  -H 'Content-Type: application/json' \
  -d '{"query":"black running shoes under 100 EUR",
       "contract":"commerce-search/1.0"}'
Self-contained by design

Built for environments where data cannot leave.

QwenBridge runs as one process inside your network. No external AI API, no SaaS, no mandatory database. The same rules apply to every future phase.

No external AI API

Runs on a local Ollama-compatible model, or your own HTTP gateway. Nothing is sent to a third party.

Works offline

No mandatory internet connection, SaaS service or third-party MCP server.

No mandatory database

In-process index and local state by default. OpenSearch and Redis are optional.

Secure by default

Default-deny policy engine, tenant isolation, rate limits and masked secrets in every error.

Evidence, not guesses

Every extracted value quotes its source, with confidence and evidence attached to each answer.

Extensible, not coupled

Domain packs, connector SPI, plugin SDK and policy packs. The core depends only on Jackson.

What a deployment needs
QwenBridge serverQuarkus · Java 25
Required
Local model serverOllama (qwen2.5, bge-m3) or HTTP gateway
Model stages
OpenSearchAlternative retrieval backend
Optional
RedisCache, distributed rate limits
Optional
Database · cloud AI · SaaSNot used
None
How the runtime works →
2,622requests/s, cached analysis1M requests · 250 virtual users · 0 errors
119 msp95 latencySame run
1,200+requests/s, keyword retrievalOne 1 GiB container
258 / 2851.0 roadmap tasks verified27 partial, none missing

Laptop baselines from the 1.0 release notes. Measure your own environment before production.

Architecture

A small core with strict boundaries.

The engine is plain Java with no framework. Quarkus is the only application framework, and module rules are enforced by architecture tests.

qwenbridge-core

Framework-free engine: language, typos, expansion, QueryIR, policy, threats, retrieval, ranking.

Depends on: Jackson only
qwenbridge-server

Quarkus runtime: REST and SSE APIs, pipeline, AI providers, security, operations.

Depends on: core, plugin SDK, packs
qwenbridge-plugin-sdk

Public contracts for plugins and domain packs.

Depends on: JDK only
commerce-pack · library-pack

Two independent domains: schema, rules and vocabulary.

Depends on: plugin SDK
qwenbridge-java-sdk

Java 25 client.

Depends on: Jackson only
qwenbridge-typescript-sdk

Node.js 20+ and browsers. npm @qwenbridge/sdk.

Depends on: none at runtime
Vision & roadmap

From understanding queries to understanding entire systems.

Search is the first step. QwenBridge is growing into a self-contained platform that understands source code, architecture, infrastructure and incidents, one verified phase at a time.

  1. 1Available · 1.0 RC

    Universal Intelligence Core

    Understands natural-language requests in any language: typos, expansion, intent, grounded constraints (QueryIR), keyword, vector and hybrid retrieval, security and policy.

    “black nike shoes size 42 under 100 euro”
  2. 2Next

    Codebase Understanding & Memory

    Discovers modules, classes, methods, dependency injection, routes and configuration, and keeps a searchable, versioned memory that points to exact files.

    “Which classes depend on PaymentService?”
  3. 3Planned

    Architecture & Request Flow

    Module, class, call and service graphs. Circular dependencies, boundary violations, change-impact analysis and request paths from route to database.

    “What could break if this class changes?”
  4. 4Planned

    Infrastructure & Runtime Topology

    Read-only adapters for Kubernetes, Prometheus, OpenSearch, HAProxy and more: what runs where, what routes to what, and what could not be observed.

    “Which pods serve POST /api/v1/payment?”
  5. 5Planned

    Incident & Root-Cause Intelligence

    Correlates code, logs, traces, metrics, deployments and config changes into a timeline with evidence-backed hypotheses. Correlation is never presented as proof.

    “Why did the payment API return 500 at 14:30?”

What exists, where it exists, how it is connected, how it behaves, what changed, what is missing, what failed, and why.

Only phase 1 is available today. Phases 2 to 5 describe planned capabilities; each will be implemented and verified separately before it is released.

See a full request, stage by stage.

The product tour runs in your browser. No server needed.