mu Coding Agent

SECURITY.md says mu runs with the current user's permissions and is not a sandbox, recommending a container or VM when isolation is needed. Risk rules, constraint checks, approval for project MCP servers, and permission modes provide meaningful safeguards, but the evidence does not establish that they prevent every mistaken action, so this is not full marks. The documentation specifies where conversations and judge data go, describes credential masking, and says keys are not sent to another judge service. External commands and other effects are governed by permission modes, with checkpoints and rewind commands documented. Dependency pinning and CI checks are visible, but the supplied material shows no dependency audit or vulnerability mitigation record. pi and AionUi are named as upstream projects, and the repository scope and maintenance channel are clear; publisher identity is unverified and the team is small, so provenance is not independently established.

The README explains decision points, modes, and commands, but the root package.json identifies a pi-monorepo at version 0.0.3 while the README describes mu as a 0.1.x prerelease; the desktop app also depends on AionUi and its relationship to the repository-level manifest is not fully clear in the supplied evidence. CI lists build, type-check, and test workflows, but runtime decisions can depend on free OpenCode Zen or other external model services, and the local judge has stated limits. SECURITY.md provides a private vulnerability-report route and response expectations, while CI defines timeouts and failure artifacts; concrete user-facing error behavior is only partially evidenced.

The documentation gives clear uses for interactive coding, context filtering, test logs, tool safety, and multi-agent work. Permission modes, judge choices, active/shadow/off decision points, sandbox boundaries, and judge fallibility are described, so capability limits and trigger scope are well covered. The CLI specifies Node.js 22.19 or newer and the desktop targets several operating systems and architectures; resource needs, environment differences, and offline behavior are not fully documented in the supplied material.

The README has a contents list, organized tables, commands, configuration guidance, and links to reference documents. It clearly states installation steps, prerelease status, measurement scope, and limitations. Decision-point and product naming is structured, but the version evidence conflicts (README 0.1.x versus root manifest 0.0.3), and the README warns that names, settings, and formats may change, reducing naming stability. The LICENSE contains MIT text, but its copyright names Mario Zechner and the supplied materials do not explain how that relates to the repository or the given MIT metadata. SECURITY.md defines supported versions, maintenance responsibility, and a reporting path; the supplied materials do not show an actual change-history entry.

The product offers a readable status board, judge ledger, commands, and per-decision-point explanations that make outputs inspectable and actionable. The README reports quantified log-folding and goal-aware selection results, with methodology and limitations, supporting potential value; the evidence remains primarily project-authored and lacks an end-to-end comparison with comparable agents. Latency, cost, and context savings have concrete figures, but judge services add external dependency and possible cost, and independent comparative evidence is absent.

The README connects major performance claims to an in-repository replay script and methodology document, and states the dataset, measurement date, label source, and uncovered cases. SECURITY.md and CI configuration provide additional evidence about boundaries and automated workflows. The supplied material includes a no-op placeholder test and workflow definitions, not proof that every claimed test or behavior is effective, so cross-source corroboration is moderate. The documentation distinguishes author measurements, scope, limitations, and unverified claims clearly.