README

Governed AI agents that actually do the work

Melaya is a governed platform for AI agents that do real work — in the cloud or on your own machine — across your business systems, your browser, and real mobile apps.

Website · Documentation · MCP Server · Agent Skill · Discord

This public repository contains the official SDKs and public developer documentation. The hosted platform, agent runtime, Device Control service and Browser Control service are proprietary and are not included here.

Looking for the remote MCP server? It lives at melaya-labs/melaya-mcp — one endpoint, https://api.melaya.org/mcp.

The products

	Melaya Agents — available now A visual builder for high-trust AI workflows: tools, models, memory, subagents, knowledge, evaluations, schedules, cost limits and human approvals, composed as a pipeline. Melaya Agents product page · Docs
	Melaya Assistant — available now Work across your approved business systems in natural language, with permissions, execution and approvals still under your control. Melaya Assistant product page
	Device Control — flagship, available now Let an AI operate real Android apps the way a person does: tapping, typing, swiping and navigating through the visible interface. No vendor API, no integration. Per-app permissions and approval before sensitive actions. Device Control product page · Docs
	Browser Control — available now The same governed execution in real browser tabs, with live visibility and a human stop control. Ships as a browser extension for Chrome, Edge, Brave, Opera and Firefox. Browser Control product page · Firefox add-on
	MCP Server — available now Give Claude, Codex, Cursor, ChatGPT or any compatible client access to Melaya's execution layer through one remote endpoint. 88 scoped tools across 9 permission domains, OAuth 2.1 + PKCE, no API key to paste. MCP Server product page · Repo · Docs · Agent Skill
	Melaya Marketing — available now One AI-native marketing cockpit. Connects your ads, search consoles, analytics, DNS and site, reads your real numbers server-side, and runs actions that do the work — SEO and page-speed audits, DNS hardening, wasted-spend cleanup — pausing for your approval before anything touches real money or your live site. Melaya Marketing product page

The catalog


8,222	103	48
scoped tools	specialized subagents	AI providers
88	9	9
MCP tools	official SDKs	MCP permission domains

Runtime catalog endpoints remain the source of truth; the numbers above move as the catalog grows.

Bring your own model

48 providers, chosen per agent. Credentials stay in encrypted Connectors, never in prompts or pipeline JSON.

Local and self-hosted

Models on your own machine or your own server, reached through the Melaya runner. The data never leaves your network.

_Ollama

_{LM Studio}

_{OpenAI-Compatible}

_{LiteLLM Proxy}

CLIs on your runner

Use the AI subscription you already pay for: the runner drives the official command-line tool on your machine.

_{Claude Code}

_Codex

_{GitHub Copilot}

Cloud

Frontier labs, open-model hosts and gateways. Bring your key, or use Melaya AI with no key at all.

_{Melaya AI}	_{Amazon Bedrock}	_Anthropic	_Avis	_{Azure AI Foundry}	_Baseten
_{Braintrust AI Gateway}	_Cerebras	_Chutes	_Cohere	_DeepInfra	_DeepSeek
_Featherless	_{Fireworks AI}	_FriendliAI	_Gonka	_{Google Gemini}	_{Grok (xAI)}
_Groq	_{Hugging Face}	_MiniMax	_{Mistral AI}	_ModelRush	_Moonshot
_{Nebius Token Factory}	_{Novita AI}	_{NVIDIA NIM}	_OpenAI	_OpenRouter	_Portkey
_{Qwen (Alibaba)}	_{Reka AI}	_Requesty	_SambaNova	_{Scaleway Generative APIs}	_SiliconFlow
_{Together AI}	_{Upstage Solar}	_{Vercel AI Gateway}	_Writingmate	_{Zhipu AI}

Why teams use Melaya

Minimum-tool agent permissions instead of an unlimited toolbox
Encrypted Connectors instead of credentials in prompts or pipeline JSON
Tenant-scoped projects and API keys
Human approval for consequential actions, enforced server-side
Run status, traces, costs, evaluations, outputs and cancellation
Cloud execution or a user-controlled local runner
Mobile and browser workflows for products that expose no suitable API
Nine official SDKs over the same public lifecycle

Quick start: pair a phone

import { Melaya } from "@melaya/sdk";

const melaya = new Melaya({
  apiKey: process.env.MELAYA_API_KEY!
});

const { code, expiresInSeconds } =
  await melaya.agents.phone.pair();

console.log({ code, expiresInSeconds });

const devices = await melaya.agents.phone.listDevices();
const apps = await melaya.agents.phone.listApps();

await melaya.agents.phone.setAllowedApps([
  "com.android.chrome"
]);

A Melaya platform key is required. "No app API required" means Device Control operates the target app through its user interface; it does not mean the Melaya SDK is unauthenticated.

Quick start: connect over MCP

No SDK, no key to paste. Add the endpoint to any compatible client and approve the scopes you want:

claude mcp add --transport http melaya https://api.melaya.org/mcp
# or
codex mcp add melaya --url https://api.melaya.org/mcp

Setup for Claude, ChatGPT, Cursor, VS Code, Le Chat, Gemini CLI, Zed, Cline, Goose and more: melaya-labs/melaya-mcp.

Agent Skill: teach any AI to run Melaya

The MCP server gives your assistant the tools. The Melaya skill gives it the method: connecting services, building and validating pipelines on real runs, triggers and approvals, reading results and handing work over. A free, open playbook your assistant reads before it acts, so it gets things right the first time.

Any assistant (ChatGPT, Gemini, Cursor, …): paste this line.

Install the Melaya skill from https://github.com/melaya-labs/melaya-mcp/tree/main/skills/melaya and use it whenever I ask you to work with Melaya.

Claude Code: copy it into your skills folder, then restart. It loads on its own when you mention Melaya.

git clone --depth 1 https://github.com/melaya-labs/melaya-mcp /tmp/melaya-mcp && cp -r /tmp/melaya-mcp/skills/melaya ~/.claude/skills/

Claude.ai and Claude Desktop: download skills/melaya as a .zip and upload it under Settings → Capabilities → Skills. Anywhere else, add SKILL.md as a project instruction or rules file.

The skill is one short router with the rules that always apply, plus eleven modules the assistant opens only when the task needs them:

quickstart _{Plain-language journeys for non-technical users}	discovery _{Finding the right tools, templates and connected services}
runners-models _{The runner and models: Claude Code, Codex, Copilot, Ollama, LM Studio, cloud}	projects-templates _{Projects, teams and starting from a validated template}
pipeline-authoring _{Pipeline configs that generate and run correctly}	agentic-systems _{Complete multi-pipeline systems, designed end to end}
data-spine _{Google Sheets data stores, bulk scoring, clean records}	automation-governance _{Schedules, event triggers, approvals and cost limits}
validate-debug _{Proving a pipeline on real runs and fixing what fails}	client-handover _{Documentation and handover for the people who will use it}
devices-browser _{Agents that use a phone or a browser like a person}

Official SDKs

	Language	Package
	Python	melaya
	TypeScript / JavaScript	@melaya/sdk
	Go	melaya-go
	Rust	melaya
	Java	org.melaya:melaya-sdk
	Kotlin	org.melaya:melaya-sdk-kotlin
	C# / .NET	Melaya.SDK
	Ruby	melaya
	PHP	melaya/sdk

The supported public surface includes authentication, projects, Connectors (personal and project-shared), credentials, connector tool calls (discover and call the tools your connected services unlock, with an in-app approval for writes), pipelines with run inputs and file uploads, pipeline documents (static context and RAG), templates, Agent Builder tools, the tool-call audit log, Device Control management, HITL, evaluations, events, billing, account operations, runner management, team management, MFA, the assistant, bug reports and agent memory.

What the SDKs drive: Melaya Agents pipelines and runs, the Melaya Assistant, Device Control on real Android apps, Browser Control, and the same execution layer behind the MCP Server and Melaya Marketing.

Internal operator APIs are intentionally absent.

Security rules for SDK users

Keep MELAYA_API_KEY in a secret manager or server environment.
Store model and external-service credentials in Connectors.
Do not put secrets in source, prompts, RAG documents, artifacts, or env_overrides.
Give agents the smallest practical tool and app allowlists.
Require human approval for consequential writes.
Validate errors and final state before reporting success.
Revoke unused platform keys and paired devices.
Redact credentials from proxy, APM, and WebSocket query logs.

See Security and trust.

Documentation

Full product documentation and interactive API reference: melaya.org/documentation.

Where to find us

Melaya is listed across the MCP registries and the product directories below. Every link was fetched and confirmed live on 2026-09-21.

Product directories

AI agent directories

MCP ecosystem

_{Also on LaunchKiwi · MakerHunt · LaunchNest · FoundrList · Launchpadly · LaunchIgniter · Launch Llama · The SaaS Dir · ProjectRadar · TopBusinessSoftware · HackerNoon}

License

The SDK code and public documentation are licensed under Apache-2.0. The hosted platform and engines are proprietary and are not included in this repository.

Third-party names and logos are used only for identification and do not imply endorsement.

_{Melaya Labs · melaya.org · Discord}

melaya / sdk

Package info

Security

Statistics