Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.runtools.ai/llms.txt

Use this file to discover all available pages before exploring further.

​
Overview

RunMesh is the private network layer that lets Runtools reach registered devices and sandboxes without exposing raw services to the public internet. It is used for local Mac agents, device inventory, peer configuration, and cross-resource dispatch. RunMesh is not a replacement for API authentication. API calls still use normal session tokens or API keys. RunMesh gives an approved device a private node identity and lets the platform route work to it.

​
What RunMesh Connects

Node typeUse
Registered MacRuns local Mac agents through the Autopilot sidecar
Firecracker sandboxGives sandboxes private mesh identity for platform dispatch and access
Future devicesAdditional runtimes can join the same org-scoped mesh when supported

​
Local Mac Agents

A local-mac agent is bound to one registered RunMesh device. The agent can be started from the Mac app, dashboard, iOS, CLI, or SDK, but execution happens on the bound Mac. 
await rt.agent.run('code-on-my-mac', 'Inspect this local repo', {
  thread: true,
});
When the Mac app itself starts a run, /v1/run registers the cloud thread and returns runId, threadId, and rolloutId; the Mac sidecar then executes locally and publishes thread events back to the platform. When another client starts the same local Mac agent, the orchestrator dispatches the run over RunMesh to the target device.

​
Device Linking

The Mac app starts a device-link request, the user approves it in the dashboard, then the app polls until it receives the approved node identity.
  1. App creates a link code with its public key.
  2. User approves the code in the dashboard.
  3. App receives node config and starts the local helper.
  4. The device appears in RunMesh nodes and can be used by local-mac agents.

​
What Stays Private

RunMesh exposes private node names and peer config to authorized org members. It does not expose platform-owned provider credentials, internal model routing, or raw infrastructure topology in customer-facing APIs.

RunMesh API

Device link, node list, config, audit, and revoke endpoints.

Agents

local-mac, managed, and in_sandbox execution modes.