Skip to main content
RunMesh is the private network that lets Runtools reach your registered devices and sandboxes with nothing facing the public internet. It’s what makes a local-device agent possible: your Mac joins the mesh as an approved node over WireGuard, and the platform routes a run to it — no open ports, no tunneling service. RunMesh is not a replacement for API authentication. API calls still use normal session tokens or API keys. RunMesh gives an approved device a private node identity in the user’s mesh and lets the platform route work to it.

​
What RunMesh Connects

​
Local Device Agents

A local device agent (local-mac execution mode) is bound to one of the agent owner’s registered RunMesh devices. The agent can be started from the desktop app, dashboard, iOS, CLI, or SDK, but execution happens on the bound device.
When the desktop app itself starts a run, /v1/run registers the cloud thread and returns runId, threadId, and rolloutId; the local sidecar then executes on the device and publishes thread events back to the platform. When another client starts the same local device agent, the orchestrator dispatches the run over RunMesh to the target device.

​
Device Linking

The desktop app starts a device-link request, the user approves it in the dashboard, then the app polls until it receives the approved node identity, device token, dispatch secret, and peer config.
  1. App creates a link code with its public key.
  2. User approves the code in the dashboard.
  3. App receives node config, stores device credentials locally, and starts the local helper.
  4. The device appears in RunMesh nodes and can be used by local-mac agents.

​
What Stays Private

RunMesh exposes private node names and peer config to the owning user. Org admins can list broader node inventory for administration. It does not expose platform-owned provider credentials, internal model routing, or raw infrastructure topology in customer-facing APIs.

RunMesh API

Device link, node list, config, audit, and revoke endpoints.

Agents

local-mac, managed, and in_sandbox execution modes.