Introduction

Mochabug envisions software that’s fully transparent and trivially integrable. mochabug Adapt is our first product built on top of our distributed operating system. It lets you connect applications to one another, with full control over which data they share. Just like an smartphone, but the apps talk to each other natively, with full control. With or without AI, It’s up to you.

Why mochabug Adapt

mochabug Adapt provides a thin, trusted core: our distributed OS, a type system, a permission model, a credential proxy and a session lifecycle. Nothing else. Everything you’d expect a platform to “have built in” (flow control, AI agents, forms, dashboards, connectors, email) is an application running on top, just as applications run on an operating system. The same reason an operating system doesn’t ship a spreadsheet is the reason mochabug Adapt doesn’t ship connectors. Keeping the core thin is what lets the ecosystem build without the platform becoming a bottleneck.

Your data isn’t there to breach. mochabug Adapt separates configuration from session data. Configuration persists. The data a live session works with is encrypted, distributed, and deleted the moment the session ends. By default, there’s no historical runtime archive and nothing at rest beyond configuration. When you do need an audit trail, turn on application traces and decide how long to keep them. Traces contain all communication (I/O), CPU usage, memory usage and wall time. Compliance becomes something you compose, not something you inherit and work around. For additional traces, connect an audit application and store them however you want.

Credentials never leave the trust boundary. An application determines which services it requires.

• The full OAuth2 protocol
• HTTP proxy
• TCP proxy
• RFC 9221/datagram proxy
• Variables

Each proxy asks for your permission to let the application connect to a specific host using the credentials you supplied. The application never sees the credentials used in the request. It’s restricted to a specific host or IP address and can’t change that itself.

Variables are a different thing. They aren’t credentials and don’t go through the proxy: they are shared directly with the application, so use them only for non-sensitive information.

We handle your OAuth2 credentials. Only the token, with the exact scope needed for the task, is shared with the application, whether you use client credentials or authorization code grants.

It can’t quietly break. Every connection between nodes is a typed contract, statically validated before a project is ever published. A saved graph is structurally guaranteed not to crash on a type mismatch. And once a project is published, no one outside your tenant can change what it does. Application updates don’t propagate to it. Deprecation or even deletion of applications by their authors doesn’t break it. You update in draft, test, and republish when you decide.

It fits work that isn’t a straight line. A session holds state across time, devices, and gaps in human interaction. It can run for milliseconds or run forever, fork across multiple devices, host live UIs and streams, and hand off to a person along the way. A short automation, an always-on dashboard and a human-in-the-loop process that lasts for days aren’t three different products. The platform adapts to fit whatever you need.

It runs your languages and your protocols. Our custom runtime executes TypeScript and JavaScript natively and will soon run anything that compiles to binary. It supports HTTP, TCP/UDP and streaming. Your team writes logic in the language it already knows, against the protocols its systems actually use, without operating any infrastructure.