AI agents can change
production now.
Govern every move.
Your AI agents get real access to production.
They never hold the keys.
Every move is policy-checked, approved, and audited.
Bring your own agent.
$ meho login https://meho.your-org.internal
↳ authenticated as sre-oncall · Keycloak OIDC
$ meho operation call \
vmware-rest-9.0 host.evacuate \
--target esxi-prod-03
One narrow surface of 25 meta-tools — CLI or MCP, same dispatch path. Every action policy-gated, credential-federated, server-reduced, and audited before it returns.
What's new.
MEHO is under active development. A sample of what landed in recent releases:
A release spent hardening the gate.
One coordinated pass in v0.34.0 closed dozens of dispatch, audit, and credential paths so they fail closed. A write cannot report success unless its audit row has committed, and the append-only ledger is enforced by the database itself.
Governance reaches Linux hosts.
Files, services, sysctl, the firewall, and scripted steps on any Linux host over SSH — each one a governed operation. A script can receive a secret at run time without the secret ever landing on the host.
vSphere 8 and 9, side by side.
MEHO fingerprints each vCenter and resolves the matching connector version per target. An 8.0 vCenter is never served through the 9.0 catalog, and a mixed estate runs under one set of controls.
One-command install.
Point Claude Code or Claude Desktop at your own backplane in a single step — a plugin for one, a one-click bundle for the other. Nothing is exposed to the internet.
The AI cannot approve itself.
Approving an action, rejecting it, or granting an agent more access have no path an agent can call. A parked action waits for a human at the console or CLI.
Governed deletes, with a blast-radius preview.
A permanent delete — a VM, a DNS record, a firewall rule, a secret — runs only after a preview shows exactly what it removes and a human approves.
Governance reaches the Microsoft estate.
New connectors for Windows Server, Active Directory, SQL Server, failover clustering, and Hyper-V — the Windows and SQL half of the datacenter, under the same controls.
VMware Cloud Foundation, deployed through the backplane.
A management-domain bring-up runs as governed, approval-gated steps — including air-gapped installs and recovery from a failed run. Proven in our own lab.
A complete, redaction-safe record of every action.
Each agent call is captured at the vendor-API level, with secrets stripped, and can be read back by operators and by the agent itself.
Governed writes reach isolated networks.
A remote runner executes policy-checked, audited writes inside networks the central instance cannot dial.
The person who approves is not the one who acts.
A dedicated approve-only role can clear the approval queue without any power to run an operation — separation of duties for regulated teams.
Alerts become governed action.
An authenticated webhook from your monitoring stack can fire a governed agent run on match, under the same policy, approval, and audit path.
Built in a live datacenter.
MEHO started as the tools we needed to run our own infrastructure. evoila operates a real VMware Cloud Foundation lab on bare metal, every day, with AI agents doing the work. We hit these problems there first, then built the product for them. The lab is MEHO's first and permanent customer.
We hit these problems in a live datacenter before we wrote a product for them.
Every release is re-checked against the lab.
Each build is deployed there and its open findings are re-run before the release counts as validated.
VMware Cloud Foundation, brought up through the backplane.
A management domain is stood up through governed steps, with a human approving the point of no return.
A delete a person still owns.
When an environment is retired, every permanent delete runs on the governed-delete tier: it parks for a human, shows exactly what it would remove, and fails closed until someone approves. The AI cannot wave its own delete through.
What breaks in the lab is fixed first.
Findings flow back into the product and are re-verified closed before anyone else sees them.
Each part of MEHO carries an explicit maturity label — generally available, beta, or experimental — published and kept honest in the docs. We do not call anything generally available before it earns it. MEHO is under continuous development, and its releases are signed.
One governed seam. Every agent action under control.
MEHO gives agents a tiny, stable surface over huge vendor APIs — and wraps every call in the controls you would demand of any operator: authorization, expiring credentials, and a complete audit trail.
Generic and typed connectors — both first-class
Point MEHO at any API that publishes a spec (OpenAPI, GraphQL, WSDL, proto) and it ingests every operation automatically — full parameter and response schemas, no code. Where a vendor SDK or a real operational sequence is needed — pyvmomi, SSH, a host.evacuate composite — hand-typed connectors cover it. Agents call both kinds through one identical surface and never see the difference.
The right connector picked for every target
Each target is fingerprinted — vendor, product, version, build — and matched to a connector implementation at dispatch time. So sddc-rest-9.0 for a VCF 9 SDDC Manager and sddc-vcf5-5.0 for a VCF 5.x one coexist, and the correct one runs per target with no manual wiring. When several match, tenant or operator preference breaks the tie.
Agents never drown in raw API output
A vCenter surface has ~3,000 API paths, and the hand-curated command-line tools operators reach for cover only a few hundred of them. MEHO ingests the whole surface, and responses that run to megabytes come back as a compact handle, not a firehose — agents get a short summary, a sample of rows, and the total count, then page through the rest on demand instead of burning their context window on a raw dump. The big payload stays on the server; the agent sees only what it asked for.
Deterministic monitoring, no LLM in the loop
Pin an operation, an assertion, a cadence, and a severity to a Sensor and MEHO watches your estate — degraded and critical thresholds, dashboards that roll up state, and notifications on every transition. No model runs in the hot path. A satellite runner executes checks inside networks the central instance can never reach.
Every action on the record, as it happens
An operation does not return success until its immutable audit row commits to PostgreSQL, attributed to the calling principal. The same action publishes to a real-time broadcast feed — so other agents and operators can watch what is happening across the estate live, and after the fact the audit trail is complete and append-only.
One backplane for operators and agents
Everything an agent can do over MCP, an operator can do with the meho CLI — one dispatch path, one policy, credential, and audit seam behind both. Neither front is a thin wrapper for the other, so there is no separate agent API to trust and no drift between what humans and agents are allowed to do.
What MEHO can talk to.
MEHO ships dozens of connector implementations. Each gives agents and operators the same governed controls — for VMware and the systems around it. New connectors arrive by ingesting a vendor spec or by hand-coding a typed implementation, and both land behind the same policy and audit seam.
VMware / VMware Cloud Foundation
vCenter and vSphere, NSX, SDDC Manager, VCF Automation, Fleet and Lifecycle, Operations and Operations for Logs, VCF Installer bring-up, Cloud Director; older VCF and Aria versions covered too, so one estate spanning old and new resolves to the right implementation per system.
Microsoft estate
Windows Server, Active Directory, DNS, Failover Clustering, SQL Server, Hyper-V.
Linux and Unix hosts
Generic Linux hosts over SSH — files, services, sysctl, firewall, and scripted steps, all governed.
Kubernetes and containers
Any conformant cluster, RKE2, Argo CD, Harbor.
Databases and messaging
PostgreSQL, MongoDB, RabbitMQ.
Identity and secrets
HashiCorp Vault, Keycloak.
Network and DNS
pfSense, BIND, Windows DNS, plus built-in connectivity checks.
Cloud and hosting
Google Cloud, Hetzner bare metal, Proxmox.
Observability
Prometheus, Loki, Tempo, read-only.
Connectors are at different stages of hardening. The maturity of each subsystem is tracked in the docs.
The whole agent surface is 25 tools
Watch an agent narrow thousands of vCenter endpoints to a single governed call — then drill into the reduced result. Same trace whether the caller is an MCP client or the CLI.
Illustrative trace. The agent only ever sees the 25 meta-tools — never a vendor-specific tool per endpoint. Real calls run against your own self-hosted backplane under your identity.
Ingest a spec. Let the agent discover. Call through the seam.
No per-endpoint tools to register, no admin token handed to the agent, no raw firehose. Three moves from a vendor API to a governed, audited operation.
Register a connector
Feed MEHO an OpenAPI, GraphQL, WSDL, or proto spec and it ingests every operation into one table — full parameter and response schemas, LLM-summarised operation groups an operator reviews before enabling. Or register a typed connector coded against a vendor SDK. Both land as versioned connectors that advertise the product and version ranges they support.
The agent discovers what it needs
Your agent never faces 3,000 raw endpoints. It lists connectors, lists operation groups, then searches operations — scoped and ranked — until it holds the one call it needs. The surface is the same handful of meta-tools for every connector and every product version, so nothing about the vendor leaks into the agent's tool list.
↳ vmware-rest-9.0 · nsx-rest-9.0 · k8s-1.x · …
↳ inventory · vm · storage · networking · lifecycle · …
↳ host.evacuate — drains every VM off a host
Call it through the governed seam
call_operation resolves the implementation from the target's fingerprint, authorizes the caller against role and per-target grants, exchanges a short-lived identity for a just-in-time backend credential, runs the operation, reduces the result to a handle, and commits an immutable audit row plus a broadcast event — all before it returns. The agent never holds a backend secret and never sees a raw multi-MB response.
Self-hosted in your cluster
Deploy the backplane, then point your agent at it. Nothing is exposed publicly — MEHO runs inside your network, under your own Keycloak and Vault. The full install trail lives in the docs.
# Local dev loop (~5 min) — kind
$ kind create cluster --name meho-dev
# Install the backplane from its signed OCI chart
$ helm install meho \
oci://ghcr.io/evoila/meho-chart \
--version <chart-version> \
-f values-kind.yaml
# Log in via your Keycloak (device-code flow)
$ meho login https://meho.your-org.internal{
"mcpServers": {
"meho": {
"type": "http",
"url": "https://meho.your-org.internal/mcp",
"oauth": {
"clientId": "meho-mcp",
"callbackPort": 8456,
"scopes": "mcp:read mcp:execute"
}
}
}
}Your client signs in through your Keycloak (OAuth 2.1) and holds only a short-lived token — never a backend credential. Desktop clients use the mcp-remote stdio variant.
Connect a clientConnect Claude Code, Claude Desktop, or any MCP client — or drive the same governed operations from the meho CLI.
Production runs on Kubernetes with PostgreSQL, Keycloak, and Vault (or Google Secret Manager). See the kind quickstart and your first operations.
Add-ons.
An add-on is a separate product that runs alongside the backplane and shares its policy, approvals, and audit. The backplane is complete on its own. An add-on extends what a team can hand to an agent without changing the rules an agent works under. Each add-on carries its own maturity label.
Automation on the same governed path.
The backplane governs one operation at a time. The automation add-on runs whole sequences of them — stand up an environment, retire one, build a workload — as a single durable job. An AI helps draft the workflow once. The steps are then frozen into a versioned blueprint, and a plain engine runs them with no model in the loop, so every run is reproducible and can be audited. Risky steps pause for a person to approve and resume where they stopped. It runs as its own service, next to the backplane, under a scoped identity that starts with no blanket access, and it shares the backplane's policy, approvals, and audit trail. We run it in our own datacenter lab, where it built the nested hosts for a VMware Cloud Foundation environment through governed runs, with a person approving each risky step. It is a separate product from the Apache-2.0 backplane.
Answers from your own documents, with sources.
MEHO Knowledge is a retrieval service you run yourself. Add your documents in common formats — runbooks, vendor documentation, internal standards — and it ingests and indexes them, then answers questions with a citation for every claim. When the documents do not cover a question, it says so instead of inventing an answer. Operators use it directly, and agents reach it through the backplane under the same tenant scope, policy, and audit as any other operation, so a team can build its own corpus and put it behind the same controls. We run one ourselves for the VMware estate. MEHO Knowledge is a separate product from the Apache-2.0 backplane, and it is experimental today.
The backplane is complete without either add-on.
Open source, Apache-2.0.
Self-hosted, with no license key. Run the core on your own infrastructure — and talk to evoila when you want a hand operating it at scale.
Free and open source
The complete backplane, the Helm chart, and the CLI — self-hosted, bring-your-own-agent.
Star on GitHubSupport & VCF depth
Deploying MEHO across a real estate — VMware/VCF, NSX, cloud — and want deployment help, connector depth, and support? Talk to the team that builds it.
Contact evoilaFrequently asked questions
What does Apache-2.0 mean for us?
It is a permissive licence. Use, modify, and run MEHO on your own infrastructure with no licence key and no copyleft obligation to publish your changes when you offer it as a service. The core backplane, the Helm chart, and the CLI are covered.
Is MEHO a hosted service?
No. MEHO is self-hosted — you run the backplane, PostgreSQL, Keycloak, and Vault (or Google Secret Manager) inside your own network. It is not exposed publicly by default, and your audit trail stays in systems you control.
Does MEHO run the AI agent?
No. Bring your own MCP client — Claude Code, Cursor, Cline, or a custom runtime. MEHO governs what the agent is allowed to do; it does not run the model. The same identity, policy, and audit trail apply whether the caller is a local session or a 24/7 hosted agent.
Which systems can it govern?
Anything with a usable spec (OpenAPI, GraphQL, WSDL, proto) through generic connectors, plus typed connectors that encode real operator fluency for VMware/VCF, NSX, Kubernetes, the Microsoft estate — Windows Server, Active Directory, SQL Server, failover clustering, Hyper-V — generic Linux hosts, Vault, cloud, and network appliances — all behind the same policy and audit seam.