Mecatl: Open-Source Cloud-Native AI Agent Runtime with Durable Sessions and MicroVM Isolation

Mecatl is an open-source, cloud-native runtime designed to run AI agents as production workloads on self-hosted infrastructure. The architecture separates the agent loop from the execution environment, allowing for scalable deployment via Kubernetes while maintaining strict control over tools, permissions, and state.

Core Architecture and Modularity The system is built on composable layers with explicit interfaces, allowing the model provider, deployment infrastructure, and client integrations to be swapped without modifying the core agent loop. It supports provider-agnostic model integration through reference adapters and opt-in modules. Key features include a streaming agent loop that handles tool dispatch, permissions, compaction, hooks, subagents, and team coordination.

State Management and Durability Mecatl emphasizes durable sessions using append-only event logs. This allows persisted work to be recovered after process replacements via pluggable state stores. The Kubernetes-native reference runtime utilizes Redis-backed state, Kubernetes session leases, and disposable replicas to manage lifecycle and drain paths.

Security and Isolation The runtime implements a deny-dominant permission model with approval flows, secret-scrubbed command environments, and durable attribution for audit trails. Delegation is handled through derived capabilities that narrow permissions at each in-process hop. For enhanced isolation, Mecatl offers an opt-in local microVM backend (verified on Linux amd64) where filesystem and Shell tools run in isolated environments, while model provider credentials remain on the host. Network policies for microVM guests can be configured via execution.microvm.guest_egress flags, supporting deny-all or specific allowlists for TCP/UDP traffic.

Components and Deployment The project includes several components:

• mecated: The server, which defaults to unauthenticated loopback mode for single-user use; off-loopback deployments require explicit authentication (bearer, TLS/mTLS, OIDC) and rate limiting.
• mecak8s: Kubernetes deployment tools.
• mecatui: A terminal UI for interactive sessions.
• sdk/typescript: A TypeScript SDK supporting Node.js, Bun, and browsers.
• mecademo: An offline demo scriptable session that runs without API keys, demonstrating tool calls, permissions, and delegation (not included in Homebrew).

The project is licensed under Apache License 2.0. Current repository statistics show 268 stars and 22 forks. Note that cross-process cryptographic attestation and capability attenuation are currently in active design, meaning caller identity and audit records are building blocks rather than complete tenant-isolation boundaries.