Architecture
Architecture
Mentu is a CLI and a cloud API. The CLI runs everything locally. The cloud handles auth and metering.
Local-first
CIR, vault, scripts, temporals, and sentinels all run on your machine. No data leaves unless you explicitly send it (webhooks, workers, MCP server calls). The CLI is the single entry point for all operations.
Cloud API
The cloud at api.mentu.ai handles two things:
- Authentication (registration, API keys)
- Usage metering and quotas
The CLI talks to the cloud during mentu auth login and when deploying workers to managed edge. Everything else is local.
VM isolation (optional)
When you pass --vm, tool calls run inside a sandboxed macOS VM managed by the mentu-runtime daemon. The agent stays on the host. See VM Isolation.
Scripts SDK
Scripts are TypeScript programs that run inside a V8 sandbox. The sandbox has no filesystem access, no network access, and no eval. Scripts interact with mentu through the mentu SDK object.
Scripts run in the sandbox with a 300s default timeout. Each SDK call has a 30s timeout. Code size is capped at 50KB, output at 10MB.
See Scripts SDK Overview for details.