Meclaw turns Linux folders into a mutable runtime for persistent agents

Why it matters

Meclaw tests whether agent infrastructure can shrink from a hosted orchestration stack into inspectable files and one Linux binary while retaining persistent state, runtime mutation and documented boundaries around untrusted code.

Marcus Meyer is building Meclaw, a persistent AI-agent runtime that turns a Linux directory tree into a running network of actors. The Meclaw repository packages the runtime in one statically linked Rust binary and lets agents alter that network while it is running.

Meyer is an independent founder-builder and open-source maintainer in Berlin who describes his work as building AI systems.

Each folder represents a cell or actor, its config.json file defines its behavior, and edges between folders determine where messages travel. According to the project's repository, its example assistant is assembled from templates, while a grow.json file applies node and edge mutations through POST /colony/mutations. Adding a tool or agent changes the topology without restarting the runtime.

The project's Linux architecture document describes a static Rust binary and says cells run as asynchronous Tokio tasks. The project's documentation presents this as its runtime design, rather than an independently tested performance or scaling result.

A filesystem becomes the harness

Most agent frameworks wrap a recurring sequence in application code: call a model, inspect its requested tool action, run the tool and return the result to the model. Meclaw instead separates those functions into cells and routes messages between them. According to the Meclaw repository, an llm cell makes one provider call for each inference message.

Because those routes and cells are files, an agent can propose changes using the same bounded vocabulary available to a human operator. Meclaw validates the resulting manifest before applying it to the running colony. The project ships 38 templates that Meyer says require no additional Rust.

Meclaw-os sits above that substrate as a small, experimental operating layer. Its templates cover constructs that persistent assistants repeatedly need, including conversations, memory, secrets and organizational boundaries. The repository says the shipped assistant uses a fast model for conversation and a separate model for reasoning.

Memory also lives outside the model's context window. Meclaw's memory design stores conversation records and assembles a budgeted context for each turn, allowing messages to persist across sessions while the model receives a selected working context.

The current source describes a Linux Rust binary that runs a directory tree as a colony of filesystem-backed cells. Its state and authority boundaries vary by cell type. The cell-types documentation says store cells have their own cell.db, while hive nodes act as routing and authority boundaries without a database or mailbox. The project applies sandboxing to cell types that execute foreign code.

Meyer's second agent OS architecture this year

Meclaw follows an earlier experiment in which Meyer pushed the runtime in a different direction. Meclaw-pg, which his public profile dates to March 2026, placed an agent operating system inside PostgreSQL.

The Meclaw-pg repository credits Meyer with designing the architecture and making its major decisions. Its README describes trigger chains, graph-shaped routing and an append-only event log, with PostgreSQL functioning as the message queue and runtime. Those are the project's descriptions of its implementation, rather than independently audited findings.

The two projects test the same underlying question through different substrates: how little conventional application machinery does a persistent agent system need? PostgreSQL offered transactions and an event-driven execution model. Rust and the filesystem give the newer project a smaller installation surface and direct access to Linux security controls.

The sandbox claim has boundaries

Meclaw's Linux security design says the runtime uses Landlock for filesystem restrictions, network namespaces for network denial, cgroup v2 for resource limits and seccomp-bpf for blocking selected system calls. The same document says restrictions fail closed: if the host cannot enforce a requested boundary, the child process fails to start. These are documented design claims; the project has not disclosed an independent security audit.

The security document also says the binary provides no web authentication and binds no port by default. When operators expose its HTTP interface, the documentation assigns access control to a reverse proxy.

The repository labels Meclaw a 0.x proof of concept and warns against unsupervised production use. Its controls describe the intended security architecture at that experimental stage.

Meyer reports more than 6,600 tests. As of September 6th, 2026, the GitHub repository showed 15 stars and three forks, modest activity for a project that had reached version v0.30.1. Those figures do not establish outside adoption, operational scale or commercial demand.

Neither the public repository nor the project site identifies an incorporated operating company, employees, customers, paid deployments or outside investors. The source is dual-licensed under MIT and Apache 2.0, and no paid pricing was disclosed. The available evidence supports treating Meclaw as a solo-led open-source project rather than a funded infrastructure company.

Meclaw's daily cost claim needs its denominator

Meclaw reports an observed operating cost of EUR 0.32 per day for one configured conversational workload. The project presents that figure as a workload-specific calculation, not an independent benchmark or general rate card.

The available documentation does not establish that another deployment would reproduce the same cost. Conversation volume, model prices, context sizes and topology can all change the result.

A small project enters a heavily funded layer

Agent execution and sandboxing have become a well-financed infrastructure category. In its May financing announcement, Modal said it raised $355 million at a $4.65 billion post-money valuation and that its Sandboxes product drove more than one-third of revenue. Modal had already acquired Butter's team in April for its work on agent harnesses, deterministic memory and lightweight virtualized sandboxes.

Other providers approach the same technical layer through hosted infrastructure. E2B focuses on cloud sandboxes for AI-generated code using Firecracker microVMs. Daytona offers programmable environments spanning containers, virtual machines, Windows and GPU sandboxes. Blaxel hosts agents and MCP servers, including warm-standby sandboxes. The available reporting does not establish that each is a direct substitute for Meclaw.

Meclaw uses a different deployment model. Modal sells elastic hosted compute and sandbox capacity. Meyer offers source code that operators can run as a Linux daemon on their own machines. The project distinguishes itself through filesystem-native topology, runtime mutation and Linux-kernel controls in a single Rust process. That positioning comes from Meclaw's own architecture documents and has not been independently benchmarked.

Meclaw has no verified evidence yet of the scale, performance or independent security validation expected from commercial infrastructure. Its contribution is a concrete architectural proposition: a persistent agent organization can be represented as a mutable directory tree, with the operating system supplying much of the isolation.

Public evidence does not yet establish users, customers, paid deployments or outside contributors. The repository describes the project as unfinished and lists example colonies, template cells and documentation fixes as areas where community contributions would help. It also says the unattended self-improvement loop remains disabled.