Loomcycle

The agentic runtime, in a sidecar. One Go binary alongside your application. Hardened agent loop, MCP on both sides, multi-replica HA. Apache-2.0.

🌐 loomcycle.dev  ·  📝 Engineering blog  ·  📐 Architecture

---

> 🌳 v1.0 is here. loomcycle 1.0 is released — the feature set is complete and the runtime is hardened and distribution-ready. The core primitives stabilised across the v0.8 → v0.23 line (multi-replica HA; the substrate Defs Agent/Skill/MCPServer/Schedule/Webhook/MemoryBackend/A2A; A2A interoperability; inbound webhooks; pluggable memory + a memory layer; the synthetic code-js provider; and OSS multi-tenant authorization in v0.17.0 — per-principal bearer tokens + a role-aware Web UI). The v0.24 → v0.37 line was a hardening + operability run: the interactive terminal, pause/resume/snapshot + cross-instance resume, the context-compaction subsystem, context-transform plugins, external fan-out on every transport, and slow-local-model robustness. 1.0 itself is a pure hardening + distribution milestone — no new primitives — wired to Homebrew, multi-arch Docker, and the Claude Code plugin. 8-hour stability soak: 1.27M circuits, 3.8M agent runs, 100% completion across 468 waves, zero leaks. Apache-2.0. We welcome bug reports, security disclosures, feature contributions, downstream consumers, and forks. See [CONTRIBUTING.md](CONTRIBUTING.md).

---

What it is

The agentic runtime, in a sidecar. loomcycle is one Go binary, ~50 MB. It runs alongside your application, not inside it. Your app calls loomcycle over HTTP, gRPC, MCP, the TypeScript adapter, or the Python adapter. The agent loop, multi-provider routing, memory and channel primitives, MCP server identity, OpenTelemetry traces, and multi-replica coordination all live in the binary. Your application stays in whatever language you wrote it in.

The shape that's different. Today's agentic-systems market gives you three options. One: embed a Python or TypeScript library inside your application process. Two: rent a managed cloud service tied to one vendor's IAM. Three: proxy your model calls through a gateway that doesn't actually run agents.

loomcycle is a fourth option. A lightweight self-hostable runtime that owns the loop and speaks every wire format your stack already uses.

What's shipped

| Release | Highlights | |---|---| | v0.4 → v0.26.x foundation | Everything the runtime is built on, condensed. Seven inference modes: Anthropic, OpenAI, DeepSeek, Gemini, Ollama (cloud + local), plus the synthetic code-js provider and a mock provider. The hardened model → tool_use → tool_result loop. 19 built-in tools with Claude Code parity (Read, Write, Edit, Grep, Glob, NotebookEdit), plus HTTP, WebFetch, WebSearch, Bash, Agent, Skill, Memory, Channel, AgentDef, SkillDef, Evaluation, Interruption, Context. The content-addressed, runtime-mutable substrate (Agent / Skill / MCPServer / Schedule / Webhook / MemoryBackend / A2A defs). Vector Memory (sqlite-vec / pgvector) on a pluggable MemoryBackend, with a memory layer above. MCP on both sides. The LLM Gateway + OpenAI-compatible shims. A2A interop. Input webhooks. Ensemble-sync primitives (RFC S). OTEL + per-tenant fairness + Pause / Resume / Snapshot + multi-replica HA. Per-run named credentials + tool-use hooks. OSS multi-tenant authorization (RFC L, v0.17.0) across both the state and definition planes. The embedded React Web UI + the interactive terminal. TS + Python + n8n adapters. Homebrew + Docker distribution. Per-version detail: [REVISIONS.md](REVISIONS.md). | | v0.27.0 | Interactive runs survive leaving the terminal. Background-goroutine execution under context.WithoutCancel, re-attach via GET /v1/runs/{run_id}/stream (replay-from-?from_seq + live-tail). Context op=self reports the resolved provider + model. | | v0.28.0 | Per-agent LLM sampling (temperature / topp / topk / penalties / seed / stop, set via yaml or AgentDef overlay or per-run). And pause cooperative quiesce: the loop parks at an iteration boundary and Pause() waits for in-flight runs, so a mid-run snapshot is reliable. | | v0.29.0 | Web UI + operability. Agent-editor sampling controls + a collapsible advanced JSON/YAML overlay, terminal message-echo + a context-size gauge, and soft reclaim of a retired agent name (no new runtime primitives). | | v0.30.0 | Cross-instance resume of a snapshotted mid-run (RFC X Phase 2). A paused run is re-dispatched by reconstructing its loop from the transcript, fired after a snapshot restore and at boot (crash recovery, cluster-gated). | | v0.31.0 | Park + resume a fan-out parent blocked in Agent.parallel_spawn (RFC X Phase 3). Pause-watcher + a no-schema-change spawn ledger, gated behind LOOMCYCLE_RESUME_FANOUT. | | v0.32.0 | Context-compaction subsystem. Replace older turns with a summary + keep-last-N verbatim (clean user-turn boundary, non-destructive). Manual / auto / self triggers and a per-agent compaction block that flows down the spawn tree. | | v0.33.0 | External fan-out and the run-mutation surface on every transport. POST /v1/runs:batch, a spawn_runs MCP tool (≤32 server-concurrent), a SpawnRunBatch RPC. compact_run / CompactRun. Per-run sampling + compaction on MCP/gRPC. @loomcycle/client 0.33.0. | | v0.34.0 | Context-transform plugins (RFC Z Phase 1a, with the redact outbound-secret-scrub plugin), an exp7 self-review hardening pass, and a cross-provider thinking-model fallback downgrade (reasoner → chat). | | v0.34.1 | Hardening + branding (no new features). A central tenant-scoping store accessor closing three live cross-tenant read gaps (security review S2), plus the new loomcycle brand logo and favicon in the Web UI. | | v0.34.2 | Web UI design system + theming. A tokenized --lc-* design system (spacing / type / radius / shadow / fonts + semantic colors), light + dark themes (OS default + a persistent topbar toggle), bundled brand fonts (Outfit / Inter / JetBrains Mono), and the loom-wood #56c596 accent. Plus a loop fix (interactive runs unbounded by default; no more stop-at-16) and a -race test de-flake. | | v0.34.3 | Patch. Context op=self reports a fresh context footprint right after a compaction. It had kept showing the stale pre-compaction size (e.g. 164k / 82%) for one turn even though the wire request had already shrunk. The loop now refreshes lastCtxTokens at every compaction site. | | v0.34.4 | Patch. Interactive-terminal UX + local-model fixes: a collapsible interactive-sessions switcher on the run page (and interactive tags on the runs page), a flashing waiting indicator in the terminal, the Ollama context gauge backed by num_ctx, generous ollama-local timeouts (300s), relative sandbox paths anchored to the root (not the process cwd), and the static agent base re-surfaced in the Library when no dynamic version is active. | | v0.34.5 | Patch. Ollama now reports the model's actual loaded context window (read from /api/ps at the stream's done frame) instead of only a pinned num_ctx — so the gauge is truthful for local models loaded at the server's OLLAMA_CONTEXT_LENGTH; plus docs (the architecture diagram + ARCHITECTURE.md show the context-transform plugin layer; a README v1.0 voice refresh). | | v0.35.0 | Model aliases in tier candidates. A models: alias (e.g. local-gemma) now resolves anywhere a tier candidate is accepted — per-agent models:, user_tiers, and the library tiers: — not only in an agent pin, closing the "pin expands aliases but tier candidates don't" 503. A candidate can be written as a bare alias string (- local-gemma); config-load validation and the Web UI Library editor know aliases too. | | v0.36.0 | Jailed agents can see their sandbox. The Read/Write/Edit/Bash path docs now instruct relative paths (they wrongly said "Absolute file path," so agents passed host paths that resolve outside the jail), and Context op=self reports the sandbox roots (read_root/write_root/bash_cwd) + the effective host allowlist. Plus a collapsible left column on the run page so the live terminal can use the full width. | | v0.37.0 | Slow-local-model robustness. Two loop fixes that keep an interactive run on a slow local model alive for hours: a run-lifetime heartbeat (a long prefill / retry no longer gets reaped as a crashed run) and a compaction window cap (auto-compaction always fits the model's window instead of "succeeding" yet still overflowing). Plus an aliases-first loomcycle.example.yaml, a "Local models (Ollama)" config guide + a loomcycle.local-interactive.example.yaml. Validated by a 133-min standalone local run. | | v1.0.0 | 🌳 1.0 — feature-complete, hardened, distribution-ready. The milestone the roadmap pointed at: no new primitives, the culmination of the v0.8→v0.37 primitive + hardening line. Apache-2.0, wired to Homebrew / multi-arch Docker / the Claude Code plugin. Same codebase as v0.37.0, tagged as the stable 1.0. | | v1.0.1 | 🔐 substrate:tenant — the tenant-operator scope (RFC AF). A security patch: a new closed-catalog scope giving a tenant FULL power WITHIN its own tenant — authoring all 8 substrate Def families (incl. the _mcpserverdef dynamic-MCP-ingestion surface) + registering tool-use hooks — WITHOUT substrate:admin (the cross-tenant superuser), so two tenants never both need admin. The route gate (HTTP + gRPC) moves the def + hook plane to substrate:tenant; minting (_operatortokendef), the MCP-server transport (/v1/_mcp), and runtime admin STAY admin-only. Includes a hooks tenant-isolation pass (the registry was global: a hook fired on every tenant — now Tenant-stamped, tenant-filtered Match, scoped List/Delete; migration 0047). | | v1.0.2 | 🌐 Permitted host-widen grants work with no static allowlist. A patch: when the operator runs no static LOOMCYCLE_HTTP_HOST_ALLOWLIST and relies on a permitted Pre-hook (hooks.permit_host_widen.owners) to grant hosts per call, the grant now takes effect. The HTTP/WebFetch tool used to short-circuit on an empty allowlist before consulting the per-call grant, so permit_host_widen was dead without a static floor; it now refuses only when the floor is empty and there's no permitted grant (the per-host check + dial-time SSRF guard still apply). Surfaced by the JobEmber VPS deploy. | | v1.1.0 | 📁 Filesystem Volumes — per-agent ro/rw filesystem scopes (RFC AH, Phases 1→5). ⚠️ BREAKING: the legacy single jail (LOOMCYCLE_READ_ROOT/WRITE_ROOT/BASH_CWD) is retired — an agent gets filesystem access only via a volumes: binding (sandbox-by-default, mirroring "no allowed_hosts → no egress"); a default rw volume restores the old single-jail behaviour, and a deploy still setting the retired env vars now fails at config-load with a migration hint. Adds named, per-agent ro/rw Volume roots for Read/Write/Edit/Glob/Grep/Bash (the resolveInsideRoot confinement reused unchanged; spawn narrow-only child⊆parent); a runtime-mutable, tenant-scoped VolumeDef substrate (flat create/delete/purge, persistent + run-scoped ephemeral auto-purged on run completion, fenced os.RemoveAll); a Web UI Volumes tab; and cross-transport parity (gRPC / MCP / TS @loomcycle/client / Python). Plus two exp8 finding fixes: Context op=tools now lists the Agent tool (F45), and POST /v1/runs accepts a top-level prompt string + rejects empty input with a clear 400 (F47). | | v1.1.1 | 🗣️ Interactive agentic sessions over gRPC + TS (RFC AI). The interactive session — a run that parks at end_turn for operator steering, survives client disconnect, and is re-attachable by run_id — was wired only over HTTP+SSE and driven only by the Web UI. v1.1.1 surfaces it on the official adapters: an interactive flag + RunInput/StreamRun (gRPC) → run_input()/stream_run() (Python) and sendRunInput/streamRunByID + a high-level InteractiveSession driver (TS). Steering + re-attach are lifted onto the Connector so a gRPC steer reaches the same in-process registry an HTTP run uses; the re-attach stream now replays the operator's own turns so a cold client (another device) reconstructs the whole conversation. Additive wire surface. Adapters realign to 1.1.1: @loomcycle/client@1.1.1 (npm, on this tag — also shipping the v0.35.0 volume surface) + loomcycle 1.1.1 (PyPI, on python-v1.1.1). | | v1.2.0 | 🗃️ SQL Memory — a per-scope SQL database for agents (RFC AA). A third facet of the Memory tool: authorized agents run arbitrary SQL (sql_query/sql_exec) against a per-scope database the runtime hosts, isolated from the main store — relational tables/joins/aggregates without the Bash + sqlite3 process-isolation hole. Default-deny sql_scopes gate; durable per-(tenant, scope, scope_id) + ephemeral per-run scopes; statement timeouts, byte quotas, optional TTL/size GC, full audit. sqlite tier (file-per-scope, statement-allowlist hardened) + postgres tier (schema-per-scope in a SEPARATE aux DB, isolated by a per-scope least-privilege LOGIN role). Plus explicit + nested transactions (sql_begin/commit/rollback, SAVEPOINT nesting); vector columns (pgvector + server-side $embed); snapshot/backup integration (tier-tagged logical per-scope dump) + a per-scope cap; operator-defined read-only shared schemas. Additive + off-by-default — no breaking changes, no new wire RPCs (SQL is an in-band Memory-tool capability; the MCP memory tool exposes it directly). Adapters unchanged since v1.1.1. | | v1.3.0 | 🧰 Bashbox — a TRUE in-process shell sandbox + operator host-command fallback (RFC AJ). A new opt-in tool that runs shell commands in-process via gbash (pure-Go): no OS process, every path rooted at the bound volume, no network. Unlike the Bash tool ("restricted, not isolated" — os/exec), its isolation is real, so it honors read-only volumes — a ro binding mounts under an in-RAM write overlay, so writes succeed in-run but never touch the host (the asymmetry RFC AH left open). Opt-in like Bash (LOOMCYCLE_BASHBOX_ENABLED=1 + allowed_tools:[Bashbox]); bundles pure-Go awk/jq on top of gbash's coreutils (~97% /bin/sh parity). Plus an operator host-command fallback (§13): allowlist specific host commands gbash lacks (LOOMCYCLE_BASHBOX_FALLBACK_COMMANDS=git,gh) to fall through to the real host shell — only those names escape, everything else stays sandboxed (no smuggling); rw-only, cwd-contained, with credentials via LOOMCYCLE_BASHBOX_FALLBACK_ALLOWED_ENV injected into the host child only (model-invisible). gbash is alpha + pinned; the per-agent gate is the escape hatch. Additive + off-by-default — no breaking changes, no new wire RPCs. Adapters unchanged since v1.1.1. | | v1.4.0 | 🗂️ Path + 📄 Document — a Unix-like VFS and chunked-graph documents, on every transport (RFC AL + RFC AK). Path is a tenant-rooted, scope-aware VFS over Memory / Volumes / Documents: address resources by paths (/docs/launch) via a dirents inode/dirent table; six ops (resolve/ls/stat/mkdir/mv/rm), .. rejected, tenant-isolated; a dirent is a name, not an authority grant. Document is a chunked graph — each chunk a first-class unit (UUID, hierarchy, type, fields, edges, Markdown body); bodies in Memory, structure in SQL Memory (queryable), 13 ops with optimistic revision concurrency and atomic/bidirectional deletes; named in the Path tree. Both are now first-class off-run on all surfaces — POST /v1/_path + `/v1/document

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: denn-gubsky
• Source: denn-gubsky/loomcycle
• License: Apache-2.0
• Homepage: https://loomcycle.dev

Install and usage instructions live in the source repository linked above.