One loop, any backend
Anthropic over raw HTTP, or anything OpenAI-compatible — llama-server, vLLM, Ollama. Transient failures are classified and retried; a retry never duplicates work already shown or acted on.
Injection resistance, enforced structurally
Tools declare capabilities, and the loop refuses to send anything outward once private and untrusted data are both in the conversation. It sits ahead of the human approver, because a person clicking yes is what an injection is trying to engineer.
A path jail, not a prompt
Every model-supplied path is canonicalized and proven to be inside the workspace before any filesystem call. Confinement for shell comes from bubblewrap or docker, and a sandbox that does not work stops the run rather than falling back.
Tools, subagents, and MCP
Built-in file and shell tools, plus any MCP server over stdio. Servers get a cleared environment and a named allowlist, so a third-party server cannot quietly read your provider keys.
Rules that keep earning their seat
mecha mines the moments you stepped in and consolidates them into rules. A validation ledger measures each one, and a rule that accumulates attributed regressions is proposed for retirement — measured harm, not a model's opinion.
Graded on the trace, not the claim
The eval rig checks the tool calls first and the prose second, runs a verify command for ground truth, and reports pass^k beside pass@k. Everything a model says about its own work is hearsay.
Run it
One binary, four front ends. mecha run answers and exits; mecha tui keeps the input line live, so you can redirect a run without stopping it.
mecha tools # no provider needed: lists the surface
mecha run "summarise the notes directory"
mecha tui # full screen; steer a run in flight
mecha trigger add briefing --cron "0 7 * * *" \
--prompt "What is on my calendar today?"
Embed it
mecha-core is a plain Rust library. Implement Tool to add a tool, Provider to add a backend, Approver to decide what needs permission.
[dependencies]
mecha-core = { git = "https://github.com/ljchang/mecha" }
# The loop never learns which provider is behind it,
# or where a tool came from. Both are trait objects.