Capabilities and limits
Check the supported scope of a workflow before building on it.
Mango is alpha. There is no supported stable runtime release or production
distribution, and the API may change on /v1. The tables below describe current
behavior, not a promise that every combination is production-ready.
- Supported: implemented and exercised end to end for the stated scope.
- Limited: usable with constraints that affect applications or operations.
- Preview: implemented, but broader provider or production evidence is incomplete.
Choose an execution path
All Environments are self_hosted. The first-party launcher runs on Docker;
other launchers are not yet provided.
| Capability | Current behavior |
|---|---|
| Text-only model turns and application-owned custom tools | Available without an Environment worker. |
| Shell and file tools | Six core tools; Bash preserves process state within one Work activation. |
| Custom Skills | Immutable pins are downloaded, verified, and prepared before execution. |
| Memory Store attachments | Downloaded and synchronized through scoped Session APIs. |
| File and public Git inputs | Operator stages them in the worker workspace; Docker supports --workspace-root for direct file access. No automatic control-plane mount. |
| Automatic output publication | Not implemented; workspace files stay with the operator. |
| Web Search / Web Fetch | Run at a supporting model endpoint, with always_allow. |
| Remote MCP | Runs through the orchestration runtime. |
The Docker worker's workspace (named volume or --workspace-root directory) persists between activations, but its Bash
process does not. File tools reject writes to read-only Memory roots; Bash
access still depends on the sandbox boundary.
Capability summary
| Capability | Status | Scope and principal limits |
|---|---|---|
| Agents | Supported | Versioned definitions, immutable Session snapshots, updates, archive, filters, and pagination. |
| SDKs | Preview | Go, Python sync/async, and TypeScript resource clients cover the OpenAPI operations. Alpha 2 supports source or inspected candidate packages; registry publication is pending. Published alpha 1 has an earlier interface. |
| Sessions | Supported | Persistent work, shared budgets, usage, updates, interrupts, archive, and deletion. Archive retains history; automatic idle reclamation is not implemented. |
| Events and actions | Limited | Messages, tool/approval barriers, outcomes, retries, and interrupts. Approval and execution results are separate. File messages support bounded UTF-8 documents, not images or PDFs. |
| Event streams | Supported | Durable history plus live Session/Thread SSE and optional ephemeral previews. Streams do not replay history or interpret Last-Event-ID. |
| Terminal Session connection | Limited | Primary history/live events, messages, relayed child tool/MCP approvals, and explicit Session-wide interrupts. Reconciles history after read disconnects; uncertain writes stop without retry. Line interface only; no sandbox shell or full child-conversation viewer. |
| Outcome evaluation | Limited | Text/File rubrics and bounded grading/iteration. The grader does not independently execute tests or inspect output artifacts; validate deliverables separately. |
| Model and context | Limited | Durable transcripts, model-window profiles, usage-based estimates, request admission, and compaction. Exact provider token counts, complete request audit records, and equivalent Outcome/Advisor overflow recovery remain open. |
| Shell and file tools | Limited | bash, read, write, edit, glob, and grep; read is capped at 64 KiB. No host-process fallback. See the execution-path table above. |
| Tool permissions | Preview | Fixed policies and opt-in model-evaluated auto for six self-hosted tools and remote MCP. Durable allow/ask/deny, usage, confirmation recovery, and interrupt fences; model judgment needs workload qualification. Provider-native Web requires always_allow. |
| MCP | Limited | Streamable HTTP, permissions, journaled calls, and Vault bearer/OAuth authentication. Large textual results retain a complete File up to 32 MiB with Files storage configured; native Go workers prepare it before tool dispatch; binary content, private-network connectivity, deprecated SSE, MCP resources, and prompts are unsupported. |
| Files | Limited | S3-compatible immutable upload/download, Workspace isolation, and lifecycle recovery, including retained cleanup records when failed-upload deletion must be retried. Applications explicitly transfer workspace deliverables. File-sourced images/PDFs and broader multi-replica operating evidence remain open. Active-upload cleanup is fenced across API processes; generated MCP publication uses distinct internal attempt keys, and unknown remote writes retain durable guards through publication and deletion. |
| Session Resources | Limited | Create-time Memory Store attachments. File/Git staging is operator-owned. |
| Skills | Limited | Validated bundles, typed immutable references, exact expanded-size admission, Agent-scoped pins, and instruction loading. External catalogs and repository discovery are not implemented. |
| Memory | Limited | Versioned UTF-8 files, optimistic preconditions, and attached-Store synchronization. Automatic retention and non-Docker self-hosted launchers are not implemented. |
| Vaults | Limited | Encrypted credentials, Session attachment, OAuth validation/refresh, and rotation. Environment-variable secret egress and refresh-failure notifications are not implemented. |
| Webhooks | Limited | Signed Session and Deployment Run lifecycle delivery, with three at-least-once attempts. No delivery-log API or configurable sustained-failure threshold. |
| Deployments | Limited | Pinned templates, manual and cron runs, Memory Store templates, budgets, leases, and Run records. Agent-archive propagation remains open. |
| Environment Work | Limited | Poll/Ack, bounded renewable leases, reclaim, scoped Work credentials, and permanent-input failure. Environment-scoped supervisor keys with issue/list/revoke/rotation; bounded healthcheck Work proves sandbox execution without a Session/model and stores durable success, failure, timeout, or cancellation. |
| API health | Supported | Public process liveness and bounded PostgreSQL readiness, including read-only rejection and recovery. Does not certify worker execution. |
| Multi-agent | Limited | Persistent child Threads, primary-only Advisor consultations, shared budgets, follow-ups, reports, and lifecycle controls. Broader repeated provider evidence and targeted interruption timing remain open. |
Product and operational boundaries
- Identity: Workspace API keys, Environment-scoped supervisor keys, and scoped Work credentials are implemented. Your application owns end-user identity and authorization; general roles, enterprise key lifecycle, quota, and billing are incomplete.
- Isolation: Docker shares the host kernel. The local stack and reference worker are not hardened boundaries for hostile tenants. The supervisor has Docker daemon authority; network egress policy is operator-owned.
- Deployment: the local Compose stack is reproducible, but supported
production Compose and Kubernetes distributions are not available. The
Helm candidate has role-separated Secrets, an initial
schema hook, probes and bounded temporary storage. Isolated Kubernetes 1.37.0
install, pending-action replacement, external Docker execution and same-release
quiesced restore are tested with source inputs and actual release artifacts.
Artifact acceptance uses a matched packaged chart, native supervisor and OCI
images; the candidate workflow runs that lifecycle before upload. Publication
remains pending. The
development schema baseline
requires a fresh database when replacing the historical chain or version-1
development baseline;
mango migrateperforms explicit schema initialization, and normal process startup only checks the migration ledger. Local Compose orders application startup after successful migration. Versioned distribution upgrades and rollback procedures remain open. - Scaling and recovery: API and orchestration roles can run separately. Files/Skills upload leases and atomic cleanup claims protect another API process's active uploads, with two-service PostgreSQL/object-store tests. Quiesced restore tests additionally cover Mango/Temporal databases, File/Skill bytes, Memory Versions and the original encryption keyring on one isolated Kubernetes topology. See operator recovery and the current assessment. Worker Versioning, heterogeneous-worker routing, broader rollout evidence, automated backup, audit, and observability still need work.
- Docker ownership: the operator-run supervisor has Docker daemon authority; keep it outside untrusted Session containers and apply ordinary Docker host hardening.
Mango owns its API and does not promise drop-in use with a hosted agent service or third-party SDK. Product direction describes the release and design policy.
Verification boundary
Mango's HTTP/SDK tests establish request and response behavior. PostgreSQL, Temporal, and Docker integration tests cover persistence, recovery, and execution. Opt-in real-model journeys establish narrower workflow evidence; they do not establish general production readiness. See CONTRIBUTING.md for the test layers.
Runtime releases will appear in GitHub Releases. Until a supported release exists, match the SDK to the server checkout and use the API reference for its current contract.