AI agents can change
production now.
Govern every move.
Your AI agents get real access to production.
They never hold the keys.
Every move is policy-checked, approved, and audited.
Bring your own agent.
$ meho login https://meho.your-org.internal
↳ authenticated as sre-oncall · Keycloak OIDC
$ meho operation call \
--connector vmware-rest-9.0 \
--op host.evacuate --target esxi-prod-03
One narrow surface of ~17 meta-tools — CLI or MCP, same dispatch path. Every action policy-gated, credential-federated, server-reduced, and audited before it returns.
One governed seam. Every agent action under control.
MEHO gives agents a tiny, stable surface over huge vendor APIs — and wraps every call in the controls you would demand of any operator: authorization, expiring credentials, and a complete audit trail.
Generic and typed connectors — both first-class
Point MEHO at any API that publishes a spec (OpenAPI, GraphQL, WSDL, proto) and it ingests every operation automatically — full parameter and response schemas, no code. Where a vendor SDK or a real operational sequence is needed — pyvmomi, SSH, a host.evacuate composite — hand-typed connectors cover it. Agents call both kinds through one identical surface and never see the difference.
The right connector picked for every target
Each target is fingerprinted — vendor, product, version, build — and matched to a connector implementation at dispatch time. So vmware-pyvmomi-7.0 and vmware-rest-9.0 coexist, and the correct one runs per target with no manual wiring. When several match, tenant or operator preference breaks the tie.
Agents never drown in raw API output
A vCenter surface has ~3,000 paths and responses run to megabytes. Set-shaped results come back as a compact handle, not a firehose — agents drill in with query, aggregate, and export instead of burning their context window on a raw dump. The big payload stays on the server; the agent sees only what it asked for.
Deterministic monitoring, no LLM in the loop
Pin an operation, an assertion, a cadence, and a severity to a Sensor and MEHO watches your estate — degraded and critical thresholds, dashboards that roll up state, and notifications on every transition. No model runs in the hot path. A satellite runner executes checks inside networks the central instance can never reach.
Every action on the record, as it happens
An operation does not return success until its immutable audit row commits to PostgreSQL, attributed to the calling principal. The same action publishes to a real-time broadcast feed — so other agents and operators can watch what is happening across the estate live, and after the fact the audit trail is complete and append-only.
One backplane for operators and agents
Everything an agent can do over MCP, an operator can do with the meho CLI — one dispatch path, one policy, credential, and audit seam behind both. Neither front is a thin wrapper for the other, so there is no separate agent API to trust and no drift between what humans and agents are allowed to do.
The whole agent surface is ~17 tools
Watch an agent narrow thousands of vCenter endpoints to a single governed call — then drill into the reduced result. Same trace whether the caller is an MCP client or the CLI.
Illustrative trace. The agent only ever sees the ~17 meta-tools — never a vendor-specific tool per endpoint. Real calls run against your own self-hosted backplane under your identity.
Ingest a spec. Let the agent discover. Call through the seam.
No per-endpoint tools to register, no admin token handed to the agent, no raw firehose. Three moves from a vendor API to a governed, audited operation.
Register a connector
Feed MEHO an OpenAPI, GraphQL, WSDL, or proto spec and it ingests every operation into one table — full parameter and response schemas, LLM-summarised operation groups an operator reviews before enabling. Or register a typed connector coded against a vendor SDK. Both land as versioned connectors that advertise the product and version ranges they support.
The agent discovers what it needs
Your agent never faces 3,000 raw endpoints. It searches connectors, lists operation groups, then searches operations — scoped and ranked — until it holds the one call it needs. The surface is the same handful of meta-tools for every connector and every product version, so nothing about the vendor leaks into the agent's tool list.
↳ vmware-rest-9.0 · vmware-pyvmomi-7.0
↳ inventory · vm · storage · networking · lifecycle · …
↳ host.evacuate — drains every VM off a host
Call it through the governed seam
call_operation resolves the implementation from the target's fingerprint, authorizes the caller against role and per-target grants, exchanges a short-lived identity for a just-in-time backend credential, runs the operation, reduces the result to a handle, and commits an immutable audit row plus a broadcast event — all before it returns. The agent never holds a backend secret and never sees a raw multi-MB response.
Self-hosted in your cluster
Deploy the backplane, then point your agent at it. Nothing is exposed publicly — MEHO runs inside your network, under your own Keycloak and Vault. The full install trail lives in the docs.
# Local dev loop (~5 min) — kind
$ kind create cluster --name meho-dev
# Install the backplane from its signed OCI chart
$ helm install meho \
oci://ghcr.io/evoila/meho-chart \
-f values-kind.yaml
# Log in via your Keycloak (device-code flow)
$ meho login https://meho.your-org.internal{
"mcpServers": {
"meho": {
"type": "http",
"url": "https://meho.your-org.internal/mcp",
"headers": {
"Authorization": "Bearer ${MEHO_MCP_TOKEN}"
}
}
}
}The token comes from meho login — the agent never holds a backend credential. Desktop clients use the mcp-remote stdio variant.
Connect a clientProduction runs on Kubernetes with PostgreSQL, Keycloak, and Vault (or Google Secret Manager). See the kind quickstart and your first operations.
Open source, Apache-2.0.
No tiers, no connector paywalls, no license key. Run all of MEHO on your own infrastructure — and talk to evoila when you want a hand operating it at scale.
Free and open source
The complete backplane, every connector, the Helm chart, and the CLI — self-hosted, bring-your-own-agent, no artificial limits.
Star on GitHubSupport & VCF depth
Deploying MEHO across a real estate — VMware/VCF, NSX, cloud — and want deployment help, connector depth, and support? Talk to the team that builds it.
Contact evoilaFrequently asked questions
What does Apache-2.0 mean for us?
It is a permissive licence. Use, modify, and run MEHO on your own infrastructure with no licence key, no per-connector paywall, and no copyleft obligation to publish your changes when you offer it as a service. The whole backplane, every connector, the Helm chart, and the CLI are covered.
Is MEHO a hosted service?
No. MEHO is self-hosted — you run the backplane, PostgreSQL, Keycloak, and Vault (or Google Secret Manager) inside your own network. It is not exposed publicly by default, and your audit trail stays in systems you control.
Does MEHO run the AI agent?
No. Bring your own MCP client — Claude Code, Cursor, Cline, or a custom runtime. MEHO governs what the agent is allowed to do; it does not run the model. The same identity, policy, and audit trail apply whether the caller is a local session or a 24/7 hosted agent.
Which systems can it govern?
Anything with a usable spec (OpenAPI, GraphQL, WSDL, proto) through generic connectors, plus typed connectors that encode real operator fluency for VMware/VCF, NSX, Kubernetes, Vault, cloud, and network appliances — all behind the same policy and audit seam.