{"slug": "show-hn-melra-pause-ambiguous-mcp-writes-instead-of-blindly-retrying", "title": "Show HN: Melra – pause ambiguous MCP writes instead of blindly retrying", "summary": "XAGI-Lab released MELRA, an open-source local execution runtime that governs AI agent tool calls routed through it by checking each call against policy, requesting approval when needed, verifying declared evidence, and keeping a redacted receipt of what runs to an outcome. MELRA dispatches mutations at most once per task and parks uncertain outcomes for reconciliation instead of replaying them, though the project states exactly-once external effects still depend on the provider and calls made through other tools remain outside MELRA's control. The alpha software requires Node.js 22.13 or newer, or 23.4 or newer, installs via `npx @melra/cli@alpha setup`, and writes itself into the config of a detected MCP client such as Claude Code, Cursor, or Gemini CLI, with APIs subject to change before version 1.0.", "body_md": "**M** odular **E** xecution **L** ayer for **R** eliable **A** utonomy\n\n### Your AI agent decides what to do. MELRA governs how tool calls are authorized, verified, and recovered.\n\nAn open-source local execution runtime for agent tool calls you route through MELRA. It checks each call against policy, requests approval when needed, verifies declared evidence, and keeps a redacted receipt of what runs to an outcome. For each task, MELRA dispatches mutations at most once; uncertain outcomes are parked for reconciliation instead of replay. Exactly-once external effects still depend on the provider. Calls made through other tools remain outside MELRA's control.\n\n[**26-second demo**](#26-second-demo)  ·  [** Quick start**](#quick-start)  ·  [** How it works**](#how-it-works)  ·  [** See what it is doing**](#see-what-it-is-doing)  ·  [** Docs**](#documentation)  ·  [** Contribute**](#contributing)  ·  [** Discussions**](https://github.com/XAGI-Lab/melra/discussions)  ·  **Product Hunt launch**\n\n## melra-product-demo.mp4\n\nWarning\n\n**MELRA is alpha software.** The local runtime is tested end to end, but APIs may\nchange before `1.0`. Use an isolated workspace, keep domain and command allowlists\nnarrow, and read every approval before you give it.\n\nYou need **Node.js 22.13 or newer, or 23.4 or newer**. From the project the agent\nshould work in, one command sets everything up:\n\n```\ncd ~/project\nnpx @melra/cli@alpha setup\n```\n\nThat directory becomes the agent's workspace, the boundary for its file and command\noperations. `setup` shows it, and asks before making your home directory, a directory\nholding it, or `/` the workspace; set `MELRA_WORKSPACE` to choose another.\n\nIn a terminal, `setup` is a short wizard. It writes a safe local policy, finds the\nagent apps on your machine, asks which one should use MELRA, and writes MELRA into\nthat app's own config file, keeping everything else in it (and saving a `.bak` first):\n\n```\nWhich MCP client should use MELRA?\n\n  1)   Claude Code                      detected: 'claude' on PATH\n  2)   Cursor                           detected: config file found\n  3)   Gemini CLI                       detected: config folder found\n  ...\n\nChoose 1-26 [1]: 1\nWrite it into ~/project/.mcp.json? [Y/n]\n\n  ✓  Workspace    ~/project\n  ✓  Policy       ~/.melra/policy.json\n  ✓  Claude Code  ~/project/.mcp.json\n\nNext: Start claude in this workspace and approve the 'melra' server when it asks; 'claude mcp list' then shows it connected.\n```\n\nThen restart your agent app (Claude Code asks you to approve a project's server\nonce) and ask it to do something, for example *\"use melra to\nshow me the system info\"*. That's it.\n\n## **Prefer flags, a container, or building from source?**\n\n| How | Command | \n|---|---|\n| One client, no questions | `npx @melra/cli@alpha setup --client cursor --write` | \n| Print the config instead of writing it | `npx @melra/cli@alpha setup --client codex` | \n| Install globally | `npm install -g @melra/cli@alpha && melra setup` | \n| Container (no Node needed) | `docker run --rm ghcr.io/xagi-lab/melra:alpha doctor` | \n| Prebuilt release | download from [releases](https://github.com/XAGI-Lab/melra/releases) , verify against`SHA256SUMS` , then`node melra/dist/bin.js doctor` | \n| From source | `git clone https://github.com/XAGI-Lab/melra.git && cd melra && corepack enable && pnpm install --frozen-lockfile && pnpm build && pnpm melra setup` | \n| One file, no Node needed *(experimental)* | from a checkout: `pnpm build:sea` , then`./dist-sea/melra setup` ; see[single executable](https://github.com/XAGI-Lab/melra/blob/main/docs/INSTALLATION.md#single-executable-experimental) | \n| Check what you installed | `npm audit signatures` verifies registry signatures; npm provenance links each package to its GitHub Actions build (see[npm packages](https://github.com/XAGI-Lab/melra/blob/main/docs/INSTALLATION.md#npm) ) | \n\nEvery command prints readable output in a terminal and plain JSON when piped or with\n`--json`, so scripts keep working. MELRA creates `<MELRA_HOME>/payload.key` with\nprivate permissions on first start; back it up with the SQLite files, because losing\nit makes persisted payloads unreadable. See [installation](https://github.com/XAGI-Lab/melra/blob/main/docs/INSTALLATION.md) for\nevery install path, environment variable, and the hardened Docker invocation.\n\nCaution\n\nThis project publishes only under the `@melra/` npm scope (`@melra/cli` is the CLI)\nand on its [releases](https://github.com/XAGI-Lab/melra/releases), where the Python\nSDK's wheel is. An **unscoped** npm package `melra` or a PyPI package `melra` is\n**not this project's**. Install from that scope, from this repository, or from the\nreleases.\n\nIf MELRA helps, [star the repository](https://github.com/XAGI-Lab/melra) so other\nagent builders can find it. Trying it in Cursor or another client? Share the client\nand its version, your OS, and your MELRA version (`npx @melra/cli@alpha version`) in\n[issue #184](https://github.com/XAGI-Lab/melra/issues/184); partial test results are\nuseful too.\n\nAI agents no longer just talk. They edit files, run commands, click through websites and call APIs on your behalf. Four questions come with that, and most agents answer them differently, or not at all:\n\n| Every action MELRA receives is checked against **your** policy, and checked again at the moment it runs. Risky changes wait for your exact approval. | \"No error\" is not success. An action counts only when the **evidence you declared** holds: the file exists, the exit code is 0, the page says what it should. | Every mutation MELRA dispatches is **recorded before it runs** and runs**at most once** . After a crash, MELRA settles it from its evidence or the provider; what it cannot settle waits in`recovery_required` and is never replayed. | Every action MELRA runs to an outcome leaves a **redacted, hash-linked receipt** , so you can audit what ran, who asked, and why it was allowed. | \n\nMELRA answers those questions in one place for tool calls routed through it, across supported agents. It sits underneath your agent for those calls, the way an operating system sits underneath your apps:\n\n**The LLM reasons. The harness manages the loop. MELRA governs the effect lifecycle\nfor calls routed through it.** Swap the model or the agent; MELRA's policies,\napprovals, credentials, history and receipts can stay in place.\n\nMELRA speaks the [Model Context Protocol](https://modelcontextprotocol.io), so any MCP\nclient can use it. For these, `melra setup --client <name>` writes the config in the\nclient's own format and location, and `melra doctor` tells you whether each one is\npointed at MELRA:\n\n| Agent | `--client` | Config it writes | \n|---|---|---|\n|  **Claude Code** | `claude-code` | `<project>/.mcp.json` | \n|  **Claude Desktop** | `claude-desktop` | `claude_desktop_config.json` | \n|  **OpenAI Codex CLI** | `codex` | `~/.codex/config.toml` | \n|  **Cursor** | `cursor` | `~/.cursor/mcp.json` | \n| 🟦 **VS Code** (Copilot agent mode) | `vscode` | `<project>/.vscode/mcp.json` | \n|  **Gemini CLI** | `gemini` | `~/.gemini/settings.json` | \n|  **Windsurf** | `windsurf` | `~/.codeium/windsurf/mcp_config.json` | \n|  **Zed** | `zed` | Zed `settings.json` (comments kept) | \n| 🧩 **Cline** | `cline` | Cline's `cline_mcp_settings.json` | \n| ⬛ **OpenCode** | `opencode` | `~/.config/opencode/opencode.json` | \n| 👻 **Kiro** | `kiro` | `~/.kiro/settings/mcp.json` | \n| 🪿 **Goose** | `goose` | `~/.config/goose/config.yaml` | \n| **Continue** | `continue` | `<project>/.continue/mcpServers/melra.yaml` | \n| ⚡ **Amp** | `amp` | `~/.config/amp/settings.json` | \n| 🦞 **OpenClaw** | `openclaw` | `~/.openclaw/openclaw.json` (`mcp.servers` ) | \n| ⚕️ **Hermes Agent** (Nous Research) | `hermes` | `~/.hermes/config.yaml` (`mcp_servers` ) | \n|  **GitHub Copilot CLI** | `copilot` | `~/.copilot/mcp-config.json` | \n| 🐉 **Qwen Code** | `qwen` | `~/.qwen/settings.json` | \n| **Auggie** (Augment) | `auggie` | `~/.augment/settings.json` | \n|  **Warp** | `warp` | `~/.warp/.mcp.json` | \n|  **Junie** (JetBrains) | `junie` | `~/.junie/mcp/mcp.json` | \n| 🤖 **Factory Droid** | `droid` | `~/.factory/mcp.json` | \n| 🌙 **Kimi Code** | `kimi` | `~/.kimi-code/mcp.json` | \n| 🪁 **Kilo Code** | `kilo` | `~/.config/kilo/kilo.jsonc` (comments kept) | \n| 🧪 **LM Studio** | `lmstudio` | `~/.lmstudio/mcp.json` | \n| 🔌 **Anything else** | `generic` | prints the standard `mcpServers` block | \n\nBuilding your own agent? Use the [TypeScript SDK](https://github.com/XAGI-Lab/melra/blob/main/packages/sdk-ts) or the\n[Python SDK](https://github.com/XAGI-Lab/melra/blob/main/sdk-py). Both can spawn MELRA or connect to one that is already running\nover loopback HTTP or a private Unix socket. For agent frameworks, see the\n[framework examples](https://github.com/XAGI-Lab/melra/blob/main/examples/frameworks/README.md): LangChain / LangGraph, the\nOpenAI Agents SDK, the Vercel AI SDK, and the official MCP SDKs.\n\nNote\n\nA named client is marked **verified** only after the *released package*, not a\nsource checkout, passes discovery, planning, approval, execution, cancellation and\nreceipt retrieval in that client. Per-client status lives in\n[COMPATIBILITY.md](https://github.com/XAGI-Lab/melra/blob/main/docs/COMPATIBILITY.md).\n\nAn **effect** is one bounded operation an agent routes through MELRA: `file.write`,\n`terminal.run`, `browser.click`, `http.request`, and so on. MELRA handles each routed\neffect in nine stages, split between a plan step and an execute step (for a single\ntask, `melra_plan` then `melra_execute`) so that **nothing runs at planning time**:\n\nHere is one change from start to finish, in developer mode. In\n[enforced mode](https://github.com/XAGI-Lab/melra/blob/main/docs/INSTALLATION.md#deployment-modes) the challenge carries no\nphrase: you approve with `melra approve <task-id>` outside the conversation,\nand the agent's `melra_execute` sends no approval at all.\n\n```\nsequenceDiagram\n    autonumber\n    participant A as Your agent\n    participant M as MELRA\n    participant You\n    participant W as Your system\n    A->>M: melra_plan: write notes.md, evidence \"file contains 'done'\"\n    M->>M: type, classify, check policy, record\n    M-->>A: awaiting_approval + challenge \"APPROVE 3f9c…\"\n    A->>You: May I write notes.md?\n    You-->>A: yes\n    A->>M: melra_execute with the exact phrase\n    M->>M: policy again, not already done?\n    M->>W: write the file (under a budget)\n    M->>W: read it back, independently\n    M-->>A: verified_success + receipt\n```\n\n**What the final status means**, and what an agent should do next:\n\n| Status | Meaning | Next step | \n|---|---|---|\n| 🟢 `verified_success` | It ran and every declared check passed | Done | \n| 🟡 `partial` | It ran, but the evidence did not hold | Look at the evidence, then decide | \n| 🔴 `policy_blocked` | Refused before anything ran | Read the reason; the same request will be refused again | \n| 🔵 `awaiting_approval` | A change is waiting for your approval | Developer mode: approve it from the agent that planned it. Enforced mode: `melra approve <task-id>` | \n| 🟣 `recovery_required` | A change may or may not have happened | **Check the world first** ; never re-run blindly | \n| ⚪ `failed` ·`cancelled` ·`budget_exhausted` | It did not complete | Safe to plan again | \n\n## **Show the request an agent actually sends**\n\nThe agent resolves \"run the checks\" into one bounded operation, plus the evidence that would prove it worked:\n\n```\n{\n  \"goal\": \"Run the repository checks\",\n  \"operation\": { \"kind\": \"terminal\", \"action\": \"run\", \"command\": \"pnpm\", \"args\": [\"check\"] },\n  \"requiredEvidence\": [{ \"type\": \"exit_code\", \"value\": 0 }]\n}\n```\n\nThe task reaches `verified_success` only if the process exits `0`. A process that runs\nand exits `1` completed the action but failed the evidence, so it is reported as\n`partial`. MELRA never receives a goal like *\"fix the production server\"*: that needs\njudgement, which belongs to the model. A kernel that interpreted sentences would be a\nkernel whose guarantees depended on a model.\n\nWhen an agent connects, MELRA also sends it a short guide to this loop (the MCP\nserver's `instructions`), so a model knows to declare evidence, read the status, and\nnever blindly retry an unknown outcome, without anyone prompt-engineering it.\n\nYou can see each action MELRA handled and its policy decision, and, for each that ran to an outcome, its evidence and receipt, from the terminal or the browser. Nothing here can approve or start work, and approval phrases are never displayed.\n\n| **From the terminal** \n\n``` bash\n$ melra status\nMELRA 0.3.0-alpha.14  developer mode\n  Tasks       3 total: 1 awaiting_approval,\n              1 policy_blocked, 1 verified_success\n  Waiting     1 waiting for approval\n  HTTP        127.0.0.1:7457 not running\n\n$ melra tasks\nID        STATUS             OPERATION     UPDATED\n64199678  awaiting_approval  file.write    0s ago\nca4aec7a  policy_blocked     terminal.run  1s ago\na1285e0f  verified_success   system.info   1s ago\n\n$ melra watch          # live, until Ctrl-C\n6:07:21 PM  task 882cf55c  verified_success\n6:07:22 PM  task f813364c  awaiting_approval\n```\n\n `melra doctor` checks Node, SQLite, the browser and policy, and reports which of your agent apps point at MELRA, with the one command that fixes anything wrong. | **In the browser:**`melra serve --http --open`  An overview, a searchable task list, and durable workflows with a live event stream. It works at phone width and in light and dark, and it is served with a strict Content-Security-Policy. | \n\n|  | Default | \n|---|---|\n| 🏠 | **Local only.** stdio, loopback HTTP behind a token, or a mode-`0600` Unix socket only your OS user can open. No account and no hosted service. | \n| 📴 | **Telemetry is off.** | \n| ✍️ | **Changes need two things:** declared evidence*and* an exact, expiring, task-scoped approval: a phrase in developer mode, an operator's`melra approve` in enforced mode. | \n| 📁 | **Paths stay inside your workspace** , including terminal working directories; symlink escapes are refused. | \n| 🚫 | **Shells, `sudo`/` su` and arbitrary desktop key names are denied.** Terminal commands must be on the allowlist by name. | \n| 🌐 | **Private, link-local and cloud-metadata addresses are blocked** by the browser and HTTP adapters themselves, after DNS resolution, before any allowlist is consulted; loopback too in enforced mode, unless the policy opens it. | \n|  | **Web page content is marked untrusted** and can never change policy. | \n| 🔑 | **Secrets are redacted** before anything is stored, and agents get capabilities, never your raw credentials. | \n| ⏱️ | **Every call is bounded** by a budget and a cancel signal; a stalled browser fails with a clear error instead of hanging. | \n\n## **Unsafe-local mode and the two deployment modes**\n\nEvery row above can be switched off at once with `melra serve --unsafe-local` (or\n`MELRA_UNHINGED=1`): no policy, no approvals, no evidence requirement, no workspace\nconfinement, no destination checks. The agent gets exactly the reach your OS user has.\nThe mode announces itself on stderr, in `melra doctor` and in `melra_capabilities`,\nand receipts still record what ran. See\n[unsafe-local mode](https://github.com/XAGI-Lab/melra/blob/main/docs/INSTALLATION.md#unsafe-local-mode).\n\nThe honest gap in a default install is that MELRA governs the effects it is *asked\nfor*. An agent holding both a MELRA terminal and a native one makes the kernel\noptional. `MELRA_MODE` is where you say which situation you are in:\n\n| Mode | Meaning | \n|---|---|\n| `developer` (default) | MELRA governs what it is asked for; the agent may have another path, and you accept that. This is why MELRA can be tried in thirty seconds. | \n| `enforced` | You assert the alternative is gone: the agent is sandboxed, holds no privileged secrets, and reaches these systems only through here. | \n\nMELRA cannot verify that assertion from inside its own process, and it does not\npretend to; the isolation is the operating system's job. What enforced mode does is\nclose every door MELRA owns: `--unsafe-local` is refused outright, nothing binds\noutside loopback (a `0600` Unix socket is allowed), no client can register itself, and\n`mode` is stamped on every receipt. For the operating-system side,\n[examples/deploy](https://github.com/XAGI-Lab/melra/blob/main/examples/deploy/README.md) has a hardened Docker run and systemd\nunit, each checked in CI, and `melra doctor` reports which restrictions are actually in\neffect. See\n[deployment modes](https://github.com/XAGI-Lab/melra/blob/main/docs/INSTALLATION.md#deployment-modes),\nthe [threat model](https://github.com/XAGI-Lab/melra/blob/main/docs/THREAT_MODEL.md) and the [security policy](https://github.com/XAGI-Lab/melra/blob/main/SECURITY.md).\n\nAn LLM decides *what* to do. A harness runs the loop that gets it there. Something\nstill has to decide whether the resulting effect is allowed, avoid replaying uncertain\nmutations, prove what happened, and survive a crash in the middle. Today that machinery\nis rebuilt inside every agent harness, and it dies with the harness. MELRA is that machinery,\nfactored out and made agent-independent.\n\n| 🚫 Typical tool server | ✅ MELRA | \n|---|---|\n|  |  | \n\nNext to the two layers it is most often mistaken for:\n\n|  | Agent harness | MCP server | MELRA | \n|---|---|---|---|\n| Model loop and reasoning | ✓ | ✗ | ✗ | \n| Tools | ✓ | ✓ | via adapters | \n| Agent-independent policy | usually ✗ | possible | **core** | \n| Durable effect state | sometimes | rarely | **core** | \n| Idempotency across restarts | varies | rare | **core** | \n| Crash recovery without replay | varies | rare | **core** | \n| Independent verification | uncommon | possible | **core** | \n| Evidence receipts | uncommon | possible | **core** | \n| Works across agents | ✗ | ✓ | ✓ | \n| Credential isolation | varies | varies | **core** | \n| Hard capability boundary | varies | usually ✗ | *partly shipped* | \n\nPlenty of MCP servers *can* do these things; this is not a claim that none of them do.\nThe difference is that in MELRA they are the execution contract rather than a per-tool\noption. The boundary is *partly shipped*: `MELRA_MODE=enforced` closes every door\nMELRA owns, but the OS isolation that stops a harness reaching the filesystem *around*\nthe kernel is the operator's to build; runnable hardened deployment recipes are still\nto come ([#52](https://github.com/XAGI-Lab/melra/issues/52)).\n\n**The feature test.** Anything that would still make sense if the request came from\nordinary deterministic software belongs in MELRA: authorisation, idempotency,\ncredential isolation, recovery, verification, effect history. Prompt optimisation, LLM\nmemory, model selection, a planner and agent personality belong to the harness above.\nThat is why nothing in MELRA's execution path ever calls a model.\n\nThe kernel is the contract; these are its shipped implementations. Every one passes through the same policy, approval, budget, verification, receipt and certificate pipeline; an adapter that skipped it would not be an adapter.\n\n|  | Adapter | What is implemented | \n|---|---|---|\n| 🗂️ | **Files** | Root-confined read, hash, atomic write, move, mkdir and delete, with symlink-escape defenses | \n| 💻 | **Terminal** | Shell-free foreground and supervised background processes with allowlists, traits, timeouts, interactive input, cancellation and redaction | \n| 🌐 | **Browser** | Isolated Playwright sessions, semantic DOM targets, bounded artifacts, network and popup policy, opt-in profiles, condition-based settling, and every browser call bounded so a stalled page fails clearly | \n| 🖥️ | **Computer** | Capability discovery, accessibility-tree and OCR inspection, and governed screenshot, pointer, drag, keyboard and scroll on macOS, Windows and supported Linux/X11 setups | \n| 📡 | **HTTP** | `GET` /`HEAD` as reads and every other method as an approval-gated at-most-once mutation, pinned to the address the destination check resolved, with credentials injected by the kernel rather than handed to the caller | \n| 🧠 | **Operational memory** | A kernel service, not an adapter: scoped SQLite storage of what MELRA knows about its own effects, with hybrid ranking, freshness, expiry, supersession, provenance and redaction | \n\nDatabase, cloud and SaaS adapters are designed and on the [roadmap](https://github.com/XAGI-Lab/melra/blob/main/ROADMAP.md), not\nshipped today. Semantic memory about the *user* (preferences, conversation history)\nbelongs to the harness, not here.\n\nEleven tools in front of the adapters and one durable workflow controller. The CLI, both SDKs, loopback HTTP and the Unix socket reach the same eleven operations; this list is the kernel contract, not an MCP-specific API.\n\n| Tool | Purpose | \n|---|---|\n| `melra_capabilities` | Discover operations, platform support, limits and policy posture | \n| `melra_plan` | Validate, persist and policy-check one bounded operation | \n| `melra_execute` | Execute an approved plan and verify the declared outcome | \n| `melra_task_status` | Read durable task state | \n| `melra_task_cancel` | Cooperatively cancel pending or running work | \n| `melra_receipt` | Retrieve redacted evidence and the execution certificate | \n| `melra_workflow_plan` | Validate, preflight, encrypt and persist a bounded workflow | \n| `melra_workflow_advance` | Execute one ready scheduling wave | \n| `melra_workflow_status` | Read the durable workflow projection | \n| `melra_workflow_cancel` | Cooperatively cancel nonterminal workflow work | \n| `melra_workflow_control` | Pause, resume or suspend a run without losing its place | \n\nPrefer tool names your model already knows? Set `MELRA_HARNESS_TOOLS=1` and thirteen\nmore appear alongside these (`read_file`, `write_file`, `run_command`, `browser_click`,\n`approve`, …). They are not a second path: each one builds an ordinary task and runs\nthe same pipeline. See [ordinary tool names](https://github.com/XAGI-Lab/melra/blob/main/docs/INSTALLATION.md#ordinary-tool-names).\n\nWorkflows compose `operation`, `approval`, `condition`, `parallel`, `bounded_loop`,\n`checkpoint`, `compensation`, `human_input` and `delegation` nodes, and every effect\nstill travels through the task pipeline. Each CLI call below is a new process, so this\nexercises restart persistence with no daemon:\n\n```\nmelra workflow plan --definition examples/workflows/restart-safe.json   # save the id\nmelra workflow advance <workflow-id>\nmelra workflow advance <workflow-id>          # exits 3 with the write's approval challenge\n# developer mode echoes the phrase; enforced mode runs `melra approve <task-id>` instead\nmelra workflow advance <workflow-id> --approval '<approval-id>:<exact phrase>'\nmelra workflow advance <workflow-id>\nplanned            stateVersion=2\nrunning            stateVersion=4   inspect=verified_complete\nawaiting_approval  stateVersion=7   phrase=\"APPROVE <digest prefix>\"   (developer mode)\nrunning            stateVersion=10  write=verified_complete\nverified_complete  stateVersion=14  checkpoint=verified_complete\n```\n\nStop the process after any line and the next command resumes from the same\n`MELRA_HOME`. Interrupted reads may retry; interrupted changes are never silently\nrepeated. They are settled by re-observation, or they park in `recovery_required`.\n\n## **Everything shipped in this release**\n\n| Shipped in `0.3.0-alpha.11` and`0.3.0-alpha.12` | Evidence | \n|---|---|\n| Restart-safe bounded workflows across nine node kinds | A real MCP process is stopped, replaced and resumed in E2E | \n| Encrypted exact task, workflow and result payloads | AES-256-GCM storage plus plaintext-leak checks across SQLite/WAL and public projections | \n| Recovery without silent mutation replay | 8/8 deterministic recovery scenarios, zero duplicates, zero false success | \n| Loopback HTTP, a `0600` Unix socket, an event stream and a read-only console | Same runtime as stdio, token on every route, `405` on any non-`GET` to the JSON API | \n| A client authenticates itself and is named on every receipt | OAuth 2.1 registration through approval to a token | \n| Two deployment modes | `--unsafe-local` and a non-loopback bind are refused under`MELRA_MODE=enforced` | \n| HTTP and API calls as a first-class effect | A mutation whose reply never arrived is reported unknown, not failed | \n| Agents receive capabilities, not credentials | The kernel holds the secret and scopes it by host and capability; grants carry a size and an expiry | \n| Evidence says how it is known | `execution` /`state` /`independent` /`semantic` strength on every evidence item | \n| Independent-channel verification | `http_resource_matches` executes through`POST` and verifies through a separate`GET` | \n| Your own evidence types | A registered verifier answers `{ \"type\": \"custom\" }` evidence; planning refuses an unregistered one, and custom evidence is always the weakest strength | \n| Setup for 26 agent apps | `melra setup` writes each app's own format; Claude Code, OpenCode, and Hermes Agent connected to a packed release on a real Mac | \n| OS isolation you can check | `melra doctor` reports capabilities,`no_new_privs` , seccomp, and a read-only root; CI runs it under the hardened Docker and systemd recipes | \n| A self-authored governance benchmark | GovBench: 362 cases through the real runtime, safety `312/312` , utility`50/50` | \n\nSee the full [CHANGELOG](https://github.com/XAGI-Lab/melra/blob/main/CHANGELOG.md).\n\nNumbers come from committed scripts and JSON artifacts, with dataset hashes and claim\nboundaries. They are **component measurements**, not a claim that MELRA is \"the best\"\nor that unlike benchmarks are comparable.\n\n|  | What | Result | What it means | \n|---|---|---|---|\n| ✅ | Safety and execution evals | **52/52** | Deterministic policy, capability-grant, credential-scope, traversal, terminal, memory, computer, HTTP, cancellation and verification scenarios | \n| 🔁 | Durable Core eval | **8/8** | 100% expected recovery, 0 duplicate execution, 0 false success, 100% event consistency | \n| 🛡️ | [GovBench](https://github.com/XAGI-Lab/melra/blob/main/docs/research/GOVBENCH.md) (self-authored) | **312/312** safety,**50/50** utility | 362 model-free cases through the real runtime: containment, approval integrity, verification honesty, exactly-once, redaction, and false positives on legitimate work. Its first run found two real bugs (293/307), both fixed; governance adds about 0.5–1.4 ms per action | \n| 🧠 | LoCoMo retrieval | **0.7597** coverage@20 | 1,982 evidence-bearing questions with zero model, embedding or network calls; re-run on 2026-10-14 and identical on every metric | \n| 🧠 | Synthetic recall | **100/100** Recall@1 | Planted-fact regression over 1,000 records | \n| 🌐 | Static-page settle | **183.7 ms** p50 vs 301.3 ms | 39% less waiting with identical 10/10 correct reads | \n| 🌐 | Slow-render settle | **10/10** vs 0/10 correct | Condition-based waiting sees the final DOM; a fixed 300 ms wait reads too early | \n| 💻 | Terminal | **30/30** verified | Shell-free process launch, 48.1 ms p50 on the measured machine | \n| 🖥️ | Computer control plane | **30/30** probes | 0.032 ms p50 adapter discovery; this is *not* a desktop task-success score | \n\nRaw artifacts: [core microbenchmarks](https://github.com/XAGI-Lab/melra/blob/main/docs/research/results/core-microbenchmarks.json),\n[LoCoMo](https://github.com/XAGI-Lab/melra/blob/main/docs/research/results/locomo-retrieval.json) and\n[GovBench](https://github.com/XAGI-Lab/melra/blob/main/docs/research/results/govbench-0.3.0-alpha.12-2026-10-14.json).\n\nThe repository also contains a pre-registered browser-agent harness (MiniWoB-125 and\nthe WebArena-Verified Hard-30 registered subset) whose task IDs, upstream revisions and\ndataset hashes are frozen. Its score is **not yet claimed**: it will be published only\nafter a full fixed-denominator run passes the publication gate. MELRA has **not** run\nan official OSWorld, WebArena or LongMemEval submission.\n\n## **Reproduce the scores**\n\n```\n# the full validation gate\npnpm check && pnpm evals && pnpm e2e && pnpm pack:check && pnpm security:audit\npnpm --filter @melra/evals evaluate:durable-core -- --publishable\n\n# memory, browser, terminal and computer microbenchmarks\npnpm benchmark:core\n\n# governance benchmark: 362 model-free cases, loopback fixtures only\npnpm benchmark:govbench\n\n# LoCoMo (dataset not vendored: CC BY-NC 4.0)\ngit clone https://github.com/snap-research/locomo.git /tmp/locomo\npnpm benchmark:locomo -- --dataset /tmp/locomo/data/locomo10.json \\\n  --output docs/research/results/locomo-retrieval.json\n\n# browser-agent harness contract checks (no model, no network)\npnpm benchmark:browser:check\npnpm benchmark:browser:verify-upstream\n\n# hardened container and a real MCP smoke test\ndocker build -t melra:local . && docker run --rm melra:local doctor && pnpm docker:smoke\n```\n\nThe MiniWoB suite also needs the pinned MiniWoB++ assets and an agent configuration;\nsee [the research index](https://github.com/XAGI-Lab/melra/blob/main/docs/research/README.md) and the\n[methodology](https://github.com/XAGI-Lab/melra/blob/main/docs/research/METHODOLOGY.md). Run outputs (HAR, screenshots, video,\ntranscripts) are git-ignored and must never be committed.\n\n| **SDKs** Both SDKs spawn a local server or connect to a running one over HTTP or a Unix socket. The token is always passed explicitly, and plain HTTP to a remote host is refused unless you opt in. | **CLI at a glance** | \n\n|  | Package | \n|---|---|\n|  [TypeScript](https://camo.githubusercontent.com/5d834fe2323dcb6410f02ff43d268073724a7402676a1bbb7829c2eeabedf701/68747470733a2f2f63646e2e73696d706c6569636f6e732e6f72672f74797065736372697074) | [`@melra/sdk`](https://github.com/XAGI-Lab/melra/blob/main/packages/sdk-ts) | \n|  [Python](https://camo.githubusercontent.com/a1e513fed558ebbe4d2baecb724cd6e821fa1e91cd706801d62adc06815fcb1a/68747470733a2f2f63646e2e73696d706c6569636f6e732e6f72672f707974686f6e) | [`melra`](https://github.com/XAGI-Lab/melra/blob/main/sdk-py) (typed, 3.11–3.14) | \n| 📜 JSON contracts | [`@melra/protocol`](https://github.com/XAGI-Lab/melra/blob/main/packages/protocol) ,[`@melra/receipt-schema`](https://github.com/XAGI-Lab/melra/blob/main/packages/receipt-schema) | \n\n| Goal | Command | \n|---|---|\n| Guided setup | `melra setup` | \n| Check this machine | `melra doctor` | \n| Serve (stdio / HTTP / socket) | `melra serve` ·`--http --open` ·`--socket <path>` | \n| See activity | `melra tasks` ·`watch` ·`status` | \n| Run one task | `melra run --request task.json` | \n| Approve a task an agent planned | `melra approve <task-id>` · in a browser:`melra console` | \n| Inspect a receipt | `melra inspect <task-id>` | \n| Test a policy | `melra policy test --request task.json` | \n| Check conformance | `melra conformance` | \n\n## **Repository map**\n\n```\napps/cli/                   CLI and stdio entrypoint\n\nkernel services\npackages/protocol/          strict task, workflow, event and operation schemas\npackages/runtime-core/      task/workflow lifecycle, events, recovery\npackages/policy-core/       local policy and scoped approvals\npackages/storage-sqlite/    transactional tasks, workflows, events, evidence\npackages/verifier-core/     deterministic evidence predicates\npackages/receipt-schema/    receipts and execution certificates\npackages/memory/            operational memory: scoped retrieval and lifecycle\npackages/server/            runtime composition, MCP, loopback HTTP and Unix socket\n\nreference effect adapters\npackages/file-runtime/      confined filesystem operations\npackages/terminal-runtime/  shell-free process supervision\npackages/browser-runtime/   isolated browser automation and stable-DOM wait\npackages/computer-runtime/  governed local computer-use adapters\npackages/http-runtime/      governed HTTP and API calls\n\nclients and evidence\npackages/sdk-ts/            TypeScript client SDK\nsdk-py/                     Python client SDK\nbenchmarks/browser-agent/   pre-registered browser-agent evaluation harness\nevals/                      safety and durable crash-recovery evaluations\nscripts/                    benchmark and release checks\ndocs/research/              methods, findings and raw results\nexamples/                   runnable task examples\n```\n\nMELRA is capability-driven, not language-restricted: Rust, Go, Swift, C# or another language can be added when measurement shows a real benefit and the same conformance suite passes.\n\nRunnable [examples](https://github.com/XAGI-Lab/melra/blob/main/examples/README.md) cover a read-only system task, a verified file\nwrite, a terminal check, browser inspection, scoped memory, computer capability\ndiscovery, a governed API call, independent verification, and a restart-safe workflow.\n\nCode, adapters, client integrations, benchmark harnesses, verifier predicates, documentation and threat analysis are all welcome.\n\n| Start here | What it is | \n|---|---|\n| [good first issue](https://github.com/XAGI-Lab/melra/labels/good%20first%20issue) | Scoped, with the files to touch named in the issue | \n| [help wanted](https://github.com/XAGI-Lab/melra/labels/help%20wanted) | Larger, still well defined | \n| [Open design proposals](https://github.com/XAGI-Lab/melra/issues?q=is%3Aissue+is%3Aopen+label%3Aproposal) | Comment on open questions before implementation; see [semantic verification #54](https://github.com/XAGI-Lab/melra/issues/54) | \n| [Contributing guide](https://github.com/XAGI-Lab/melra/blob/main/docs/CONTRIBUTING_GUIDE.md) | How the pipeline fits together and which files one change touches | \n\n1. Read [CONTRIBUTING.md](https://github.com/XAGI-Lab/melra/blob/main/CONTRIBUTING.md) and the[Code of Conduct](https://github.com/XAGI-Lab/melra/blob/main/CODE_OF_CONDUCT.md) .\n2. Sign your commits under the DCO (`git commit -s` ).\n3. Run `pnpm check` before opening a pull request; it also checks links, the\nenvironment-variable table and the CHANGELOG shape.\n4. Report vulnerabilities through\n[private vulnerability reporting](https://github.com/XAGI-Lab/melra/security/advisories/new) ,\nnever in a public issue.\n\nSoftware and documentation are licensed under the [Apache License 2.0](https://github.com/XAGI-Lab/melra/blob/main/LICENSE). The\nofficial logo and hero artwork are licensed under\n[CC BY-ND 4.0](https://github.com/XAGI-Lab/melra/blob/main/LICENSES/CC-BY-ND-4.0.txt). Third-party benchmark datasets keep their\nown licenses and are not included in this repository.\n\n**Built in the open by [XAGI Labs](https://github.com/XAGI-Lab).**\n\n<sub>MELRA brand assets © XAGI Labs Private Limited, licensed CC BY-ND 4.0.</sub>", "url": "https://wpnews.pro/news/show-hn-melra-pause-ambiguous-mcp-writes-instead-of-blindly-retrying", "canonical_source": "https://github.com/XAGI-Lab/melra", "published_at": "2026-10-20 22:43:02+00:00", "updated_at": "2026-10-20 22:48:14.543332+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-tools", "developer-tools", "ai-safety"], "entities": ["MELRA", "XAGI-Lab", "Claude Code", "Cursor", "Gemini CLI", "Node.js", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-melra-pause-ambiguous-mcp-writes-instead-of-blindly-retrying", "markdown": "https://wpnews.pro/news/show-hn-melra-pause-ambiguous-mcp-writes-instead-of-blindly-retrying.md", "text": "https://wpnews.pro/news/show-hn-melra-pause-ambiguous-mcp-writes-instead-of-blindly-retrying.txt", "jsonld": "https://wpnews.pro/news/show-hn-melra-pause-ambiguous-mcp-writes-instead-of-blindly-retrying.jsonld"}}