Help us shape the future of Go! Take the 2026 Go Developer Survey

mecatl

module
v0.0.51 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 26, 2026 License: Apache-2.0

README

Mecatl

Mecatl is an open source, cloud-native agent harness. It provides the loop, tools, permissions, hooks, delegation, and service boundaries for running AI agents as production workloads on infrastructure you operate.

Mecatl keeps the agent loop independent of the client and execution environment, so the same runtime can start locally, run remotely with durable external state and a recorded event history, then scale across Kubernetes replicas without replacing the loop. It combines composable tools and skills with permissions, attribution, and audit records while keeping model providers and deployment infrastructure replaceable.

Run one of the supplied services or connect Mecatl to an existing application with the model provider, state store, filesystem, and UI that fit your workflow. These concerns connect through explicit interfaces, so changing one does not require replacing the agent loop.

Read the Mecatl documentation to get started.

What it provides

  • A streaming agent loop with tool dispatch, permissions, compaction, hooks, subagents, and teams.
  • Provider-agnostic model integration, with reference adapters and opt-in provider modules.
  • Durable sessions and append-only event logs through pluggable stores, so a deployment can recover persisted work after process replacement.
  • Client integration via gRPC and HTTP/SSE, the TypeScript SDK, and mecatui, a terminal client that can host a local server or connect to a remote one.
  • A Kubernetes-native reference runtime that combines Redis-backed state, Kubernetes session leases, drain handling, and disposable replicas.
  • Per-session execution environments, including an opt-in local microVM backend that keeps model providers and credentials on the host while filesystem tools and Bash run inside the VM.

Get started

Goal Start with
Run an agent service mecated and the deployment guide
Run agents on Kubernetes mecak8s and the Kubernetes deployment guide
Use an agent locally Install, then use mecatui — or run the offline demo from a checkout
Isolate local filesystem and Shell tools Local microVM execution (qualified on Linux amd64)
Connect an application The TypeScript SDK guides or the gRPC and HTTP/SSE integration guide
Build unattended automation mecatequi for one prompt, a patch, and a machine-readable result
Embed the runtime engine and the embedding guide

Install

Install mecatui, the terminal client, and mecated, the server, with Homebrew:

brew install stacklok/tap/mecatl

Install and verify Mecatl covers Conda-forge, release archives, verification, and source builds. Build mecademo, mecatequi, and mecak8s from a checkout with task build.

Run agents as production workloads

An agent runtime needs more than a model call to operate as a workload. A replaceable process needs durable state outside the process, a record of work that survives a restart, and a way to coordinate access when replicas share a session. Mecatl supplies the seams and reference implementations for those concerns without making them part of the agent loop.

The supplied mecak8s runtime demonstrates this deployment model. It uses Redis for session state and event logs, Kubernetes leases to ensure one writer per session, and a drain path for replacing pods. You can also embed the engine and provide the backing services and execution environment yourself. See What is a cloud-native harness? for the runtime guarantees and boundaries.

Open and modular by design

Mecatl keeps the agent loop independent of the provider and infrastructure behind it. Reference adapters support offline development, while integrations use the interfaces that match the parts of the system they connect. This lets you use the same harness with the model providers, state services, tools, and clients your system requires.

Mecatl provides the agent runtime and its contracts. Your application decides which capabilities a session receives, where code runs, and how it connects to its identity, policy, and data services.

Control and execution

Agents can act with a user's or service's authority, so Mecatl keeps the agent loop separate from the execution environment. It treats permissions and the event record as first-class runtime concerns. It includes deny-dominant permissions, approval flows, secret-scrubbed command environments, durable attribution, and an audit trail. Delegated runs receive derived capabilities that can only narrow at each in-process hop.

Caller identity and audit records are useful building blocks, not a complete tenant-isolation boundary. Cross-process cryptographic proof and authority attenuation remain active design work. See the agent identity tracker and the agent identity and authority design.

Try it locally

The offline demo runs a scripted session with tool calls, a permission approval, delegation, and usage accounting. It does not require an API key. It runs from a checkout of this repository; the Homebrew cask does not ship mecademo.

go run ./cmd/mecademo

To build every supplied runtime and client:

task build

For an embedded deployment, see the engine compatibility contract and the embedding guide.

Security: mecated is unauthenticated by default and intended for loopback, single-user use. Configure authentication and transport protection before binding it off-loopback. The deployment guide covers bearer auth, TLS/mTLS, OIDC, rate limits, and deployment posture.

Local microVM execution

For optional isolated local execution on Linux amd64, install and authenticate the release-stamped host binaries: both mecatui and mecated for interactive use, or just mecated for headless use. mecatui runs the embedded interactive server; mecated supplies local microVM administration. Follow the verified host-binary installation steps before running either command sequence:

# Interactive embedded journey: configure the operator-owned deployment setting
# in ~/.config/mecatl/settings.yaml:
#
# execution:
#   default_placement: microvm-local
mecated microvm doctor
mecatui

# Or headless, mecated-only journey:
mecated microvm doctor
mecated serve --headless --default-placement microvm-local
# --headless declares an unattended server, so child asks do not wait for a local UI.
# Ordinary POST /v1/sessions uses the deployment default; clients send no path or placement.

Release binaries verify and prepare the required runtime when the deployment selects microvm-local. Source builds do not support this profile; repository developers can use the separate developer source workflow. microvm doctor and microvm status are read-only mecated administration commands. Guest IPv4 egress is permissive by default; external IPv6 is unrouted and unsupported. The local host operator can instead select deny-all or allowlist in execution.microvm.guest_egress, or use mecated serve's --microvm-guest-egress=deny-all or --microvm-guest-egress=allowlist with repeatable --microvm-guest-allow=HOST:PORT/tcp|udp rules. The allowlist requires at least one valid hostname rule; invalid input or enforcement failure stops startup. HTTP/gRPC clients and project configuration cannot set or weaken this host-only policy. Agent edits live in an isolated session worktree, not in the original checkout. The local microVM operator guide covers verified installation, headless use, guest-egress controls, host-versus-guest boundaries, and platform limits.

User documentation

Architecture and engineering documentation

Contributing, security, and license

Contributions are welcome through pull requests. Start with CONTRIBUTING.md; coding agents should read AGENTS.md before changing the repository.

Report vulnerabilities privately through SECURITY.md.

Licensed under the Apache License 2.0. Community participation is governed by the Code of Conduct.

Directories

Path Synopsis
adapters module
authn
oidc module
cmd
mecademo command
Package main (mecademo) is the mecatl end-to-end demo driver.
 Package main (mecademo) is the mecatl end-to-end demo driver.
mecak8s command
Command mecak8s is the storage-free, Kubernetes-native mecatl agent binary: a THIN peer of cmd/mecated that composes the SAME app.Build assembly with k8s-native defaults — Redis session store + durable event log, coordination.k8s.io Lease session leasing, a dynamic /readyz (drain-gated + Redis-pinged), and a bounded GracefulStop that cancels in-flight runs on SIGTERM so a rolling update completes within terminationGracePeriodSeconds.
 Command mecak8s is the storage-free, Kubernetes-native mecatl agent binary: a THIN peer of cmd/mecated that composes the SAME app.Build assembly with k8s-native defaults — Redis session store + durable event log, coordination.k8s.io Lease session leasing, a dynamic /readyz (drain-gated + Redis-pinged), and a bounded GracefulStop that cancels in-flight runs on SIGTERM so a rolling update completes within terminationGracePeriodSeconds.
mecated command
Command mecated is the standalone mecatl server binary and a composition root: it parses the CLI/env configuration, builds the telemetry sink, delegates the engine + service assembly to internal/app (the SHARED composition layer also used by the embedded server in cmd/mecatui), and serves the resulting HarnessService over gRPC and HTTP/SSE concurrently, with graceful shutdown on SIGINT/SIGTERM.
 Command mecated is the standalone mecatl server binary and a composition root: it parses the CLI/env configuration, builds the telemetry sink, delegates the engine + service assembly to internal/app (the SHARED composition layer also used by the embedded server in cmd/mecatui), and serves the resulting HarnessService over gRPC and HTTP/SSE concurrently, with graceful shutdown on SIGINT/SIGTERM.
mecatequi command
Command mecatequi is a single-shot, headless mecatl runner for CI / batch use: it runs ONE prompt against an in-process engine assembled by internal/app, drives the run to a terminal state, and emits three artifacts — a working-tree git diff, a machine-readable run-summary JSON, and an optional durable JSONL event log — then maps the terminal stop reason to a process exit code.
 Command mecatequi is a single-shot, headless mecatl runner for CI / batch use: it runs ONE prompt against an in-process engine assembled by internal/app, drives the run to a terminal state, and emits three artifacts — a working-tree git diff, a machine-readable run-summary JSON, and an optional durable JSONL event log — then maps the terminal stop reason to a process exit code.
mecatl-execution-provider command
Command mecatl-execution-provider runs the authenticated Kubernetes execution provider.
 Command mecatl-execution-provider runs the authenticated Kubernetes execution provider.
mecatl-executor command
Command mecatl-executor runs the fixed credential-free workload helper.
 Command mecatl-executor runs the fixed credential-free workload helper.
mecatui command
login.go implements remote OIDC login and shared provider-login helpers.
 login.go implements remote OIDC login and shared provider-login helpers.
mecatui/agenthook
Package agenthook emits mecatui's session lifecycle as AGENT LIFECYCLE HOOK events, in the cross-vendor hook schema that coding-agent host tools consume.
 Package agenthook emits mecatui's session lifecycle as AGENT LIFECYCLE HOOK events, in the cross-vendor hook schema that coding-agent host tools consume.
mecatui/client
Package client is the gRPC-facing layer of mecatui: it dials mecated, creates sessions, opens the bidi Converse stream, and translates proto Events into the plain Go tea.Msg structs the ui consumes.
 Package client is the gRPC-facing layer of mecatui: it dials mecated, creates sessions, opens the bidi Converse stream, and translates proto Events into the plain Go tea.Msg structs the ui consumes.
mecatui/customization
Package customization defines the display-only, dependency-leaf presentation customization protocol shared by mecatui composition and UI status-line renderers.
 Package customization defines the display-only, dependency-leaf presentation customization protocol shared by mecatui composition and UI status-line renderers.
mecatui/embed
Package embed lets mecatui host its OWN mecated server in-process when no external one is running, so a single `mecatui` binary "just works" with no separately-spawned daemon and no TCP port.
 Package embed lets mecatui host its OWN mecated server in-process when no external one is running, so a single `mecatui` binary "just works" with no separately-spawned daemon and no TCP port.
mecatui/internal/renderfmt
Package renderfmt provides stateless formatting shared by mecatui renderers.
 Package renderfmt provides stateless formatting shared by mecatui renderers.
mecatui/internal/terminaltext
Package terminaltext provides terminal-safe plain-text rendering helpers for mecatui UI and status-line renderers.
 Package terminaltext provides terminal-safe plain-text rendering helpers for mecatui UI and status-line renderers.
mecatui/keymap
Package keymap validates rebindable-key overrides for mecatui.
 Package keymap validates rebindable-key overrides for mecatui.
mecatui/schedparse
Package schedparse is a small client-side natural-language → trigger compiler for the mecatui /schedule overlay's Create form.
 Package schedparse is a small client-side natural-language → trigger compiler for the mecatui /schedule overlay's Create form.
mecatui/sessionadapter
Package sessionadapter bridges mecatui's session interface to its gRPC client.
 Package sessionadapter bridges mecatui's session interface to its gRPC client.
mecatui/theme
Package theme is the pure styling layer for mecatui.
 Package theme is the pure styling layer for mecatui.
mecatui/ui
Package ui is the Bubble Tea (Elm) layer of mecatui: the root Model state machine, its Update reducer, the View assembly, and the conversation/block renderers.
 Package ui is the Bubble Tea (Elm) layer of mecatui: the root Model state machine, its Update reducer, the View assembly, and the conversation/block renderers.
mecatui/ui/internal/blocks
Package blocks prepares the structured, non-Markdown conversation blocks in mecatui's conversation view.
 Package blocks prepares the structured, non-Markdown conversation blocks in mecatui's conversation view.
mecatui/ui/internal/bounded
Package bounded provides pointer-owned, ANSI-aware bounded terminal controls.
 Package bounded provides pointer-owned, ANSI-aware bounded terminal controls.
mecatui/ui/internal/scrollback
Package scrollback owns Mecatui's logical conversation document.
 Package scrollback owns Mecatui's logical conversation document.
mecatui/ui/platform
Package platform reports host-platform facts the TUI adapts its presentation to.
 Package platform reports host-platform facts the TUI adapts its presentation to.
mecatui/ui/prompttextarea
Package prompttextarea owns the upstream textarea behind Mecatl's prompt-editor policy.
 Package prompttextarea owns the upstream textarea behind Mecatl's prompt-editor policy.
mecatui/ui/welcome
Package welcome renders the first-run splash for the mecatui zero-state: a faithful mascot (half-block on any truecolor terminal, a zero-dependency kitty Unicode-placeholder high-res path on capable terminals), a gradient "mecatl" wordmark, and an info block.
 Package welcome renders the first-run splash for the mecatui zero-state: a faithful mascot (half-block on any truecolor terminal, a zero-dependency kitty Unicode-placeholder high-res path on capable terminals), a gradient "mecatl" wordmark, and an info block.
contracts
gen/go/mecatl/execution/v1
gen/go/mecatl/v1
sessionaffinity
Package sessionaffinity defines the root transport contract for mecatl's optional session routing hint.
 Package sessionaffinity defines the root transport contract for mecatl's optional session routing hint.
gen/go/mecatl/driver module
deploy
execution-templates command
Command execution-templates renders and validates offline execution template values.
 Command execution-templates renders and validates offline execution template values.
engine module
environment
microvm module
examples
first-agent command
Package main demonstrates the minimal offline mecatl agent.
 Package main demonstrates the minimal offline mecatl agent.
first-agent-approval command
Package main demonstrates resolving a mecatl permission request.
 Package main demonstrates resolving a mecatl permission request.
first-agent-openrouter command
Package main demonstrates using the mecatl engine with OpenRouter.
 Package main demonstrates using the mecatl engine with OpenRouter.
first-agent-tool command
Package main demonstrates registering a custom mecatl tool.
 Package main demonstrates registering a custom mecatl tool.
internal
adapter/acp
Package acp is the Agent Client Protocol (ACP) adapter: it lets an ACP editor (Zed, and others that speak ACP) drive the mecatl harness as a subprocess over stdio.
 Package acp is the Agent Client Protocol (ACP) adapter: it lets an ACP editor (Zed, and others that speak ACP) drive the mecatl harness as a subprocess over stdio.
adapter/agentimport
Package agentimport converts local Codex and Claude Code artifacts into provider-neutral Mecatl data.
 Package agentimport converts local Codex and Claude Code artifacts into provider-neutral Mecatl data.
adapter/attemptstore
Package attemptstore persists bounded learning attempts in a crash-safe, owner-partitioned document.
 Package attemptstore persists bounded learning attempts in a crash-safe, owner-partitioned document.
adapter/authfile
Package authfile is the adapter-layer leaf for mecatl's credentials file: a settings.yaml-sibling YAML file (conventionally $XDG_CONFIG_HOME/mecatl/auth.yaml) holding per-provider secrets: an api_key for the existing keyed providers or a manually supplied OAuth access-token snapshot for openai-codex.
 Package authfile is the adapter-layer leaf for mecatl's credentials file: a settings.yaml-sibling YAML file (conventionally $XDG_CONFIG_HOME/mecatl/auth.yaml) holding per-provider secrets: an api_key for the existing keyed providers or a manually supplied OAuth access-token snapshot for openai-codex.
adapter/automaticstore
Package automaticstore persists automatic-admission accounting in one flock-serialized, crash-safe document shared by cooperating processes.
 Package automaticstore persists automatic-admission accounting in one flock-serialized, crash-safe document shared by cooperating processes.
adapter/cedarauthority
Package cedarauthority provides the optional Cedar-backed authority evaluator.
 Package cedarauthority provides the optional Cedar-backed authority evaluator.
adapter/clientauth
Package clientauth provides durable, target-bound public-client OIDC credentials.
 Package clientauth provides durable, target-bound public-client OIDC credentials.
adapter/credentialstore
Package credentialstore defines a host-internal, credential-format-agnostic port for opaque binary records and provides namespace-bound backend handles.
 Package credentialstore defines a host-internal, credential-format-agnostic port for opaque binary records and provides namespace-bound backend handles.
adapter/credentialstore/conformance
Package conformance provides the reusable contract tests for mutable credential stores.
 Package conformance provides the reusable contract tests for mutable credential stores.
adapter/daemonconfig
Package daemonconfig is a strict, versioned, operator-selected daemon configuration file loaded ONLY when `mecated serve --config PATH` is explicitly supplied.
 Package daemonconfig is a strict, versioned, operator-selected daemon configuration file loaded ONLY when `mecated serve --config PATH` is explicitly supplied.
adapter/dream
Package dream implements opt-in background memory consolidation.
 Package dream implements opt-in background memory consolidation.
adapter/envscrub
Package envscrub builds the SECRET-neutralised process environment every agent-facing command shell runs with.
 Package envscrub builds the SECRET-neutralised process environment every agent-facing command shell runs with.
adapter/executionclient
Package executionclient implements the private mTLS client and placement adapter for the independently deployed Kubernetes execution provider.
 Package executionclient implements the private mTLS client and placement adapter for the independently deployed Kubernetes execution provider.
adapter/executioncontroller
Package executioncontroller implements the authenticated provider gRPC boundary.
 Package executioncontroller implements the authenticated provider gRPC boundary.
adapter/flocklease
Package flocklease is the single-host port.SessionLease implementation.
 Package flocklease is the single-host port.SessionLease implementation.
adapter/forker
Package forker implements the default tool.EnvironmentForker used by fork-join parallelism (harness pattern 8).
 Package forker implements the default tool.EnvironmentForker used by fork-join parallelism (harness pattern 8).
adapter/gitenv
Package gitenv builds the git-neutralizing process environment shared by the forker (its own fork-time git invocations) and the sandboxed team-member command runner.
 Package gitenv builds the git-neutralizing process environment shared by the forker (its own fork-time git invocations) and the sandboxed team-member command runner.
adapter/guardraileval
Package guardraileval defines the offline-first paired guardrail measurement protocol.
 Package guardraileval defines the offline-first paired guardrail measurement protocol.
adapter/hashutil
Package hashutil is the shared, stdlib-only content-fingerprint primitive for the adapter layer.
 Package hashutil is the shared, stdlib-only content-fingerprint primitive for the adapter layer.
adapter/hookexec
Package hookexec implements port.HookRunner by running a configured shell command per lifecycle HookPhase.
 Package hookexec implements port.HookRunner by running a configured shell command per lifecycle HookPhase.
adapter/jevrouter
Package jevrouter adapts Typesafe System One decisions to Mecatl's delegated-model router.
 Package jevrouter adapts Typesafe System One decisions to Mecatl's delegated-model router.
adapter/k8slease
Package k8slease is the Kubernetes-backed port.SessionLease: cross-process, cross-HOST single-writer enforcement for the multi-replica cloud-native posture, backed by a coordination.k8s.io/v1 Lease object per session id.
 Package k8slease is the Kubernetes-backed port.SessionLease: cross-process, cross-HOST single-writer enforcement for the multi-replica cloud-native posture, backed by a coordination.k8s.io/v1 Lease object per session id.
adapter/llmendpoint
Package llmendpoint validates host-internal native LLM endpoint identities and confines gateway request URLs before credential retrieval.
 Package llmendpoint validates host-internal native LLM endpoint identities and confines gateway request URLs before credential retrieval.
adapter/llmresilience
Package llmresilience provides a harness-level resilience decorator around any port.LLMProvider.
 Package llmresilience provides a harness-level resilience decorator around any port.LLMProvider.
adapter/managedtemp
Package managedtemp owns the private Unix filesystem namespace used by managed command temporary storage.
 Package managedtemp owns the private Unix filesystem namespace used by managed command temporary storage.
adapter/mcp
Package mcp adapts tools served by external Model Context Protocol (MCP) servers into the harness's tool.Tool interface, so the agent loop can call remote MCP tools exactly as it calls built-in ones.
 Package mcp adapts tools served by external Model Context Protocol (MCP) servers into the harness's tool.Tool interface, so the agent loop can call remote MCP tools exactly as it calls built-in ones.
adapter/mcp/jq
Package jq is a sandboxed wrapper around github.com/itchyny/gojq that evaluates a jq filter against a JSON input and returns the JSON-stringified result.
 Package jq is a sandboxed wrapper around github.com/itchyny/gojq that evaluates a jq filter against a JSON input and returns the JSON-stringified result.
adapter/mcp/source
Package source is the pluggable EXTENSIBILITY POINT for WHERE the harness's MCP server configs come from.
 Package source is the pluggable EXTENSIBILITY POINT for WHERE the harness's MCP server configs come from.
adapter/mcpauthority
Package mcpauthority carries the exclusive MCP construction selection between command-side profile loading and application composition.
 Package mcpauthority carries the exclusive MCP construction selection between command-side profile loading and application composition.
adapter/mcpbroker
Package mcpbroker implements the in-process, session-scoped MCP broker.
 Package mcpbroker implements the in-process, session-scoped MCP broker.
adapter/mcpbroker/credentialenvelope
Package credentialenvelope implements the persisted credential envelope format.
 Package credentialenvelope implements the persisted credential envelope format.
adapter/mcpbroker/sealedauthstorage
Package sealedauthstorage seals secret fields of ToolHive's auth-server storage before they reach Redis.
 Package sealedauthstorage seals secret fields of ToolHive's auth-server storage before they reach Redis.
adapter/mcpcredential
Package mcpcredential provides the small, root-pinned custody seam used by local MCP onboarding.
 Package mcpcredential provides the small, root-pinned custody seam used by local MCP onboarding.
adapter/mcplifecycle
Package mcplifecycle contains the reusable, non-UI part of direct MCP profile lifecycle operations.
 Package mcplifecycle contains the reusable, non-UI part of direct MCP profile lifecycle operations.
adapter/mcpperf
Package mcpperf serves this Go process's runtime performance data over a read-only Model Context Protocol (MCP) server, so an agent can introspect the harness's own latency, memory, goroutine, and profile state through MCP tools and resources instead of a human reading raw /metrics or /debug/pprof.
 Package mcpperf serves this Go process's runtime performance data over a read-only Model Context Protocol (MCP) server, so an agent can introspect the harness's own latency, memory, goroutine, and profile state through MCP tools and resources instead of a human reading raw /metrics or /debug/pprof.
adapter/mcpsecretfile
Package mcpsecretfile reads bounded operator-owned OAuth client secrets.
 Package mcpsecretfile reads bounded operator-owned OAuth client secrets.
adapter/memory
Package memory implements harness pattern 3 (tiered memory): a conservative, cross-session memory facility exposed to the model as two tools (Remember and Recall) backed by a pluggable tool.MemoryStore.
 Package memory implements harness pattern 3 (tiered memory): a conservative, cross-session memory facility exposed to the model as two tools (Remember and Recall) backed by a pluggable tool.MemoryStore.
adapter/microvm
Package microvm provides the root module's thin UDS adapter for microvmd.
 Package microvm provides the root module's thin UDS adapter for microvmd.
adapter/microvmmanager
Package microvmmanager owns idempotent readiness and explicit diagnostics for the user-local microvmd lifecycle.
 Package microvmmanager owns idempotent readiness and explicit diagnostics for the user-local microvmd lifecycle.
adapter/mockscript
Package mockscript loads bounded deterministic mock LLM response scripts.
 Package mockscript loads bounded deterministic mock LLM response scripts.
adapter/modelhook
Package modelhook contains the contextual guardrail rule matcher, exact-action grant store, and the narrow verdict checker retained for path-escape policy.
 Package modelhook contains the contextual guardrail rule matcher, exact-action grant store, and the narrow verdict checker retained for path-escape policy.
adapter/modeltext
Package modeltext contains protocol-neutral hygiene for model catalog text.
 Package modeltext contains protocol-neutral hygiene for model catalog text.
adapter/oidcclient
Package oidcclient contains target-independent host-side OIDC public-client mechanics.
 Package oidcclient contains target-independent host-side OIDC public-client mechanics.
adapter/openaibearer
Package openaibearer injects rotating file-backed credentials into OpenAI requests.
 Package openaibearer injects rotating file-backed credentials into OpenAI requests.
adapter/openaicodex
Package openaicodex supplies the credential and HTTP request policy for the experimental ChatGPT Codex backend.
 Package openaicodex supplies the credential and HTTP request policy for the experimental ChatGPT Codex backend.
adapter/openaicompat
Package openaicompat is a stdlib-only LEAF adapter that fetches a LIVE model catalog from any endpoint speaking the OpenAI-shaped GET /v1/models protocol — it names the PROTOCOL, not a specific vendor.
 Package openaicompat is a stdlib-only LEAF adapter that fetches a LIVE model catalog from any endpoint speaking the OpenAI-shaped GET /v1/models protocol — it names the PROTOCOL, not a specific vendor.
adapter/openrouter
Package openrouter is a stdlib-only LEAF adapter that fetches the LIVE OpenRouter model catalog from the public, UNAUTHENTICATED models endpoint and maps it into a neutral, package-own result type.
 Package openrouter is a stdlib-only LEAF adapter that fetches the LIVE OpenRouter model catalog from the public, UNAUTHENTICATED models endpoint and maps it into a neutral, package-own result type.
adapter/osfs
Package osfs implements tool.FileSystem over the real operating-system filesystem and a tool.Workspace that scopes every path under a single session root.
 Package osfs implements tool.FileSystem over the real operating-system filesystem and a tool.Workspace that scopes every path under a single session root.
adapter/permclassify
Package permclassify provides an OPTIONAL layer-2 model-based command/tool risk classifier, implemented as a pluggable decorator over a layer-1 port.PermissionPolicy.
 Package permclassify provides an OPTIONAL layer-2 model-based command/tool risk classifier, implemented as a pluggable decorator over a layer-1 port.PermissionPolicy.
adapter/permconfig
Package permconfig is the file-based permission-config adapter (issue #13).
 Package permconfig is the file-based permission-config adapter (issue #13).
adapter/privatefile
Package privatefile updates small owner-private files by atomic replacement.
 Package privatefile updates small owner-private files by atomic replacement.
adapter/procgroup
Package procgroup puts a child process in its own process group so a context cancellation kills the WHOLE group — not just the direct child.
 Package procgroup puts a child process in its own process group so a context cancellation kills the WHOLE group — not just the direct child.
adapter/productmetrics
Package productmetrics is a fully independent, opt-out-by-default OTel metrics adapter reporting bounded adoption/usage counters to Stacklok's public metrics collector.
 Package productmetrics is a fully independent, opt-out-by-default OTel metrics adapter reporting bounded adoption/usage counters to Stacklok's public metrics collector.
adapter/providercatalog
Package providercatalog is a stdlib-only LEAF DATA adapter exposing a pinned, embed-vendored subset of the models.dev model catalog as a typed, read-only Go API.
 Package providercatalog is a stdlib-only LEAF DATA adapter exposing a pinned, embed-vendored subset of the models.dev model catalog as a typed, read-only Go API.
adapter/providerid
Package providerid owns the root-internal provider identifier grammar shared by operator configuration and credential persistence.
 Package providerid owns the root-internal provider identifier grammar shared by operator configuration and credential persistence.
adapter/reflectionstore
Package reflectionstore persists bounded learning proposals in a crash-safe, principal/project-partitioned document.
 Package reflectionstore persists bounded learning proposals in a crash-safe, principal/project-partitioned document.
adapter/remoteenv
Package remoteenv is a deterministic, in-process, protocol-level reference fake of a REMOTE execution environment (issue #462 phase 3).
 Package remoteenv is a deterministic, in-process, protocol-level reference fake of a REMOTE execution environment (issue #462 phase 3).
adapter/resourceurl
Package resourceurl defines the canonical protected-resource URL identity shared by the server, enrollment registry, and discovery client.
 Package resourceurl defines the canonical protected-resource URL identity shared by the server, enrollment registry, and discovery client.
adapter/scheduler
Package scheduler is the in-process tick loop for the scheduled-tasks feature (issue #189).
 Package scheduler is the in-process tick loop for the scheduled-tasks feature (issue #189).
adapter/server
Package server is the API adapter for mecatl: it exposes the agent loop over two network surfaces that share one domain Event taxonomy.
 Package server is the API adapter for mecatl: it exposes the agent loop over two network surfaces that share one domain Event taxonomy.
adapter/sessiondebug
Package sessiondebug provides the target-bound, read-only evidence tool used by dedicated debug sessions.
 Package sessiondebug provides the target-bound, read-only evidence tool used by dedicated debug sessions.
adapter/skills
Package skills is the in-repo adapter for Agent Skills.
 Package skills is the in-repo adapter for Agent Skills.
adapter/skillstore
Package skillstore persists agent-owned skill lifecycle records in a flocked, crash-safe manifest with immutable content-addressed SKILL.md files.
 Package skillstore persists agent-owned skill lifecycle records in a flocked, crash-safe manifest with immutable content-addressed SKILL.md files.
adapter/slogdiag
Package slogdiag is an outbound adapter implementing port.Diagnostics over the standard library's log/slog.
 Package slogdiag is an outbound adapter implementing port.Diagnostics over the standard library's log/slog.
adapter/soul
Package soul implements issue #14: a user-scoped, agent-READ-ONLY persona/"soul" fragment loaded into the turn-0 conversation as data.
 Package soul implements issue #14: a user-scoped, agent-READ-ONLY persona/"soul" fragment loaded into the turn-0 conversation as data.
adapter/telemetry
Package telemetry is an outbound adapter that derives OpenTelemetry traces and Prometheus metrics from the harness's domain event stream.
 Package telemetry is an outbound adapter that derives OpenTelemetry traces and Prometheus metrics from the harness's domain event stream.
adapter/tlsreload
Package tlsreload owns hot reload and expiry observation for a server TLS certificate.
 Package tlsreload owns hot reload and expiry observation for a server TLS certificate.
adapter/tokenizer
Package tokenizer provides a tiktoken-backed agent.TokenCounter.
 Package tokenizer provides a tiktoken-backed agent.TokenCounter.
adapter/toolhivellm
Package toolhivellm is the ToolHive-aware code in mecatl (issue #262 + #265): it detects, by reading ToolHive's OWN on-disk config file, whether a ToolHive LLM gateway proxy is set up for this user — and, if so, what LOOPBACK port it listens on — and (issue #265, tokensource.go) builds an in-process OIDC token source so both ToolHive protocol providers can talk DIRECTLY to the real gateway_url with no local proxy hop.
 Package toolhivellm is the ToolHive-aware code in mecatl (issue #262 + #265): it detects, by reading ToolHive's OWN on-disk config file, whether a ToolHive LLM gateway proxy is set up for this user — and, if so, what LOOPBACK port it listens on — and (issue #265, tokensource.go) builds an in-process OIDC token source so both ToolHive protocol providers can talk DIRECTLY to the real gateway_url with no local proxy hop.
adapter/toolkit
Package toolkit holds the small, tool-agnostic helpers shared by the adapter-layer tool packages (internal/adapter/tools and internal/adapter/memory).
 Package toolkit holds the small, tool-agnostic helpers shared by the adapter-layer tool packages (internal/adapter/tools and internal/adapter/memory).
adapter/tools
Package tools composes the model-facing tool catalog of the mecatl kit.
 Package tools composes the model-facing tool catalog of the mecatl kit.
adapter/workspacetrust
Package workspacetrust is the adapter-layer reader/writer for workspace trust (Workspace-Trust feature).
 Package workspacetrust is the adapter-layer reader/writer for workspace trust (Workspace-Trust feature).
adapter/xdgconfig
Package xdgconfig is the shared adapter-layer seam for resolving user-global configuration locations against the process environment.
 Package xdgconfig is the shared adapter-layer seam for resolving user-global configuration locations against the process environment.
adapter/yamldiag
Package yamldiag classifies goccy YAML parser errors without exposing YAML content.
 Package yamldiag classifies goccy YAML parser errors without exposing YAML content.
app
Package app is the SHARED composition layer for the mecatl server: the one place that wires concrete adapters (LLM provider, tool catalog, permission policy, hooks, session store, MCP, skills) into an agent.Engine and exposes it as a server.Service.
 Package app is the SHARED composition layer for the mecatl server: the one place that wires concrete adapters (LLM provider, tool catalog, permission policy, hooks, session store, MCP, skills) into an agent.Engine and exposes it as a server.Service.
buildinfo
Package buildinfo exposes the safe, build-time identity shared by shipped binaries.
 Package buildinfo exposes the safe, build-time identity shared by shipped binaries.
cliconfig
Package cliconfig holds the small slices of CLI/composition wiring that the four command mains (cmd/mecated, cmd/mecatui, cmd/mecatequi, cmd/mecak8s) would otherwise copy-paste — extracted here so they cannot drift apart.
 Package cliconfig holds the small slices of CLI/composition wiring that the four command mains (cmd/mecated, cmd/mecatui, cmd/mecatequi, cmd/mecak8s) would otherwise copy-paste — extracted here so they cannot drift apart.
configgen
Package configgen is the SINGLE SOURCE OF TRUTH for the operator settings.yaml surface (issue #140).
 Package configgen is the SINGLE SOURCE OF TRUTH for the operator settings.yaml surface (issue #140).
configgen/cmd/configref command
Command configref is the BUILD-TIME generator (issue #140) that emits the two committed configuration artifacts from the permconfig YAML schema:
 Command configref is the BUILD-TIME generator (issue #140) that emits the two committed configuration artifacts from the permconfig YAML schema:
creatediag
Package creatediag records content-free, request-scoped remote-create progress.
 Package creatediag records content-free, request-scoped remote-create progress.
executionenv
Package executionenv defines the private, versioned host-side execution-provider protocol.
 Package executionenv defines the private, versioned host-side execution-provider protocol.
executionexecutor
Package executionexecutor is the fixed, credential-free workload helper.
 Package executionexecutor is the fixed, credential-free workload helper.
flaghelp
Package flaghelp renders flag usage with the conventional CLI spelling: --name for multi-character names and -n for one-character aliases.
 Package flaghelp renders flag usage with the conventional CLI spelling: --name for multi-character names and -n for one-character aliases.
identitybroker
Package identitybroker is the in-process core of the agent identity broker.
 Package identitybroker is the in-process core of the agent identity broker.
identitybroker/conformance
Package conformance provides the contract tests every identity broker implementation, an identitybroker.Core and identitybroker.CredentialVerifier, passes.
 Package conformance provides the contract tests every identity broker implementation, an identitybroker.Core and identitybroker.CredentialVerifier, passes.
mcpbroker
Package mcpbroker defines the consumer-facing boundary to an MCP broker.
 Package mcpbroker defines the consumer-facing boundary to an MCP broker.
microvmcmd
Package microvmcmd implements the canonical mecated local microVM lifecycle administration command.
 Package microvmcmd implements the canonical mecated local microVM lifecycle administration command.
sessionretention
Package sessionretention contains the side-effect-free retention selection policy.
 Package sessionretention contains the side-effect-free retention selection policy.
syscaller
Package syscaller stamps the EXPLICIT system principal on the root context of every internal goroutine that has no caller.
 Package syscaller stamps the EXPLICIT system principal on the root context of every internal goroutine that has no caller.
testutil/codextest
Package codextest creates synthetic, non-secret manual-token fixtures.
 Package codextest creates synthetic, non-secret manual-token fixtures.
testutil/identityharness
Package identityharness stands in, offline, for the external parties of the agent identity credential flow: the upstream company IdP and AS-1, Mecatl's sign-in authorization server.
 Package identityharness stands in, offline, for the external parties of the agent identity credential flow: the upstream company IdP and AS-1, Mecatl's sign-in authorization server.
testutil/oauthbrowser
Package oauthbrowser drives explicit browser consent in offline OAuth fixtures.
 Package oauthbrowser drives explicit browser consent in offline OAuth fixtures.
testutil/recoveryhost
Package recoveryhost contains offline fixtures for command-root recovery proofs.
 Package recoveryhost contains offline fixtures for command-root recovery proofs.
testutil/testhome
Package testhome isolates process-wide config discovery in command tests.
 Package testhome isolates process-wide config discovery in command tests.
adaptersupport module
mcp
oauthlogin
Package oauthlogin provides an opt-in, host-side OAuth loopback login runtime.
 Package oauthlogin provides an opt-in, host-side OAuth loopback login runtime.
perf
cmd/allocsgate command
Command allocsgate is the allocs/op regression gate for the perf CI workflow (docs/perf-tracking.md "Regression gating"; .github/workflows/perf.yml).
 Command allocsgate is the allocs/op regression gate for the perf CI workflow (docs/perf-tracking.md "Regression gating"; .github/workflows/perf.yml).
cmd/benchtrend command
Command benchtrend keeps the github-action-benchmark microbenchmark history compact without sacrificing commit granularity.
 Command benchtrend keeps the github-action-benchmark microbenchmark history compact without sacrificing commit granularity.
cmd/perfconvert command
Command perfconvert turns the offline scenario harness's per-scenario JSON KPIs (the []kpi.ScenarioResult that `task perf:scenarios` writes to $MECATL_PERF_JSON) into the THREE github-action-benchmark custom-format files the perf workflow feeds to the trend dashboard + alert gate.
 Command perfconvert turns the offline scenario harness's per-scenario JSON KPIs (the []kpi.ScenarioResult that `task perf:scenarios` writes to $MECATL_PERF_JSON) into the THREE github-action-benchmark custom-format files the perf workflow feeds to the trend dashboard + alert gate.
kpi
Package kpi is the stdlib-only KPI-capture support for the offline performance scenario harness (perf-tracking.md "The benchmark harness").
 Package kpi is the stdlib-only KPI-capture support for the offline performance scenario harness (perf-tracking.md "The benchmark harness").
provider
anthropic module
openai module
openaichat module
ssefilter module
sdk
typescript/e2e/fixturedaemon command
Command fixturedaemon serves the real Mecatl wire adapters with an in-process OAuth-protected MCP broker.
 Command fixturedaemon serves the real Mecatl wire adapters with an in-process OAuth-protected MCP broker.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.