meclaw: a Rust binary builds agents with a kernel sandbox, and its creator deliberately switches off self-improvement

By Zendoric · September 7, 2026.

A developer who identifies himself on GitHub as mmeyerlein has released meclaw, an open-source project (MIT/Apache 2.0 license) proposing a different way to build AI agent systems. According to its own repository, the entire system runs from a single binary compiled in Rust, designed for Linux only, and each agent lives in its own folder with a configuration file, a SQLite database and a kernel-enforced sandbox: Landlock (file access restriction), isolated network namespaces, cgroup v2 (resource limits) and seccomp (system call filtering). The connections between agents are the routes a message can travel along, and any change to the running system is applied by sending a "diff" (a patch of changes) to a single API endpoint, without restarting anything and leaving a record in an auditable log.

The most striking design decision is what the project does NOT do. Most current agentic frameworks —LangChain, AutoGPT and their many descendants— are built around an explicit loop that the developer programs: call the model, run a tool, return the result, repeat until a condition says stop. meclaw removes that loop as a fixed component: according to its documentation, it does not ship "a loop"; rather, a loop is simply a connection that points back to a model-agent. The advantage its author claims is that, with orchestration living in files rather than in code, the swarm of agents can rewrite the way it works while running, using the same system tools (list, search, compare) a human would use.

More interesting still is what the project describes as "ready for recursive self-improvement, but not enabled". The repository acknowledges that it already has the necessary pieces —hot mutation of the system, a component that turns a request into a plan of changes, a mechanism to keep or roll back based on measured results, and a receipt for every action taken— but explicitly states that the loop that would connect them into an autonomous improvement cycle is deliberately disabled. "No blind RSI" (no recursive self-improvement carried out blindly), as the project's own text sums it up.

It is worth putting this in its real scale: this is an experimental project under intense development, with 28 stars and 4 forks on GitHub at the time of publication, which reached Hacker News with just 7 points and 6 comments. The author himself warns that it is not ready for production without supervision and puts the cost of a production install at 0.32 euros a day, according to his own cost documentation. It is, by every measure, an early experiment, not a consolidated platform or an industry benchmark.

And yet, the design choice it makes —leaving the self-improvement capabilities built but refusing to close the circuit— matters beyond its size. In general, the debate about autonomous agents capable of modifying themselves tends to be framed as a matter for the big AI companies and their research labs; here the same tension appears, consciously resolved, in the code of a small, experimental project. It is a useful reminder that the governance of agentic systems does not depend only on the policies announced by OpenAI, Anthropic or Google DeepMind: it is also decided, line by line, in how anyone building infrastructure for agents chooses to close —or not close— that loop.

Our reading is that projects like this are the symptom, not the news. The proliferation of open-source agentic frameworks —and meclaw is one more in a growing wave— confirms that the "operating system for agents" layer is being contested outside the big labs, with the cost and control advantages we already defend as an underlying thesis: the more agentic infrastructure stays in open, auditable hands, the less the next wave of automation will depend on a handful of closed providers. But the security of that layer is not automatic. meclaw itself proves it by showing its self-improvement primitives and refusing, for now, to switch them on: the relevant question for any agentic system —large or small, funded or independent— is not whether it can improve itself, but who decides when it is allowed to, and what receipt remains of every step it takes. That is exactly the kind of short-term friction —slow, manual, full of conservative decisions like this one— that is best seen not as a brake on progress, but as the scaffolding that makes it possible for the delegation of ever more complex tasks to agents not to be paid for, later on, with a crisis of trust.