Apache Maka Review: An Agent Workspace With Receipts

Originally published on andrew.ooo — visit the original for any updates, code snippets that aged out, or follow-up posts.

TL;DR

Apache Maka (Incubating) is a local-first AI agent workspace whose central claim is unusual: the interesting artifact is not the agent's cleverness, it's the record. Model messages, tool calls, tool results, permission decisions, and how a turn terminated are all written to an append-only Runtime Event Log. The chat UI and the next model call are projections of that log, not the only copy of it.

Key facts (verified 2026-08-26):

• 3,527 GitHub stars, 346 forks, ~1,769 stars gained this week
• Apache 2.0, TypeScript, created 2026-05-27 — three months old
• Incubating at the Apache Software Foundation, sponsored by the Incubator PMC
• Latest tag: v0.1.11 (2026-08-18) plus cli-v0.1.0-beta.1 the same day
• 337 open issues and extremely active — commits landed the morning this review was written
• Three surfaces: Electron/React Desktop, a TUI + non-interactive CLI (maka, maka run), and a benchmark harness (maka eval)
• One execution authority: everything routes through Runtime Host; no surface owns a second runtime
• Built-in tools: Read, Write, Edit, Bash, Glob, Grep. Computer Use and catalog skills are opt-in
• No Apache release exists yet — the README explicitly recommends building from source

The one-line version, from a Japanese reader on X who caught the design intent better than the README does: "Agentの賢さより、証拠が残る方が強い" — evidence that survives beats agent cleverness.

Why This Matters Now

Nearly every agent tool we've reviewed this year competes on capability. DeepSeek Harness competes on extensibility. Orca competes on parallelism. Tilde Run competes on sandbox isolation. The pitch is always the agent can do more.

Maka is competing on something else entirely: can you prove what the agent did?

That sounds like compliance theater until you've actually lost a session. Anyone running agents seriously has hit some version of this: the agent ran for forty minutes, compacted its context twice, edited eleven files, and then crashed — or worse, finished successfully but you can no longer reconstruct why it made the call it made at minute twelve, because the tool output that justified it got pruned out of the transcript to save tokens.

Most agent tools treat context compaction as destruction. Old tool results get dropped so the next prompt fits, and they're gone. Maka's design draws a hard line here: shorter context is not deleted history. Compaction and pruning change the provider input projection — what gets sent to the model — while the event log keeps the evidence. The model can even reach back into pruned material on demand through bounded ArchiveRead calls instead of everything being eagerly re-hydrated into the prompt.

That's event sourcing applied to agent runs, and it's the right idea. event-sourcing is literally one of the repo's GitHub topics, which tells you the authors know exactly what they're building.

What It Actually Is

Maka is not a CLI wrapper around a model API. It's a layered runtime with three client surfaces sitting on top of one execution spine:

Desktop / TUI / CLI → Runtime Host → SessionManager → AgentRun
                                             ↓
                         Model + Tool Runtime → Runtime Event Log
                                             ↓
                              Context / Session / UI projections

The important architectural commitment is that Runtime Host is the sole execution authority. Desktop, terminal, bots, and the eval harness all ask Runtime Host to execute work. None of them ships a second, slightly-different agent loop. If you've ever debugged a tool that behaves differently in its GUI than in its CLI because they're separate implementations, you'll appreciate why this matters.

The repo layout mirrors the boundaries cleanly:

packages/core/         Session, Event, Permission, Connection contracts
packages/storage/      SQLite operational state + payload stores
packages/runtime/      AgentRun, model adapters, tools, context, recovery
packages/runtime-host/ Sole hosted execution authority + public protocol
packages/eval/         Experiment cells, attempts, results, adapters
packages/cli/          TUI and non-interactive CLI
apps/desktop/          Electron main / preload / React renderer

Getting It Running

Here's the first genuinely important caveat, and it's one most coverage of this project glosses over: there is no Apache release yet.

From the README, verbatim in spirit: everything currently published from the repository or a package registry was produced before or during incubation, is not an ASF release, and has not been reviewed or voted on by the Incubator PMC. Until an approved source release exists, the project recommends no prebuilt download.

So the blessed path is source:

git clone https://github.com/apache/maka.git
cd maka
npm ci
npm run dev

Requirements: Node.js 22.19+ (CI uses Node 24), npm 11, Git, and ripgrep — the Grep tool shells out to it. If you installed with ELECTRON_SKIP_BINARY_DOWNLOAD=1, you'll need node node_modules/electron/install.js before Electron will start.

There's also a published beta CLI on npm, explicitly pinned to the next dist-tag:

npm install --global maka-agent@next
maka --version

Note the package name mismatch: the npm package is maka-agent, the binary is maka, and there's an unrelated maka package on npm that is not this project. The docs call this out directly, which is more care than most projects take.

First run does not bundle a model account. You open provider setup, add an API key, pick your models, and go. The app distinguishes configured, send-ready, and experimental connection states — an account flow that isn't actually wired into Runtime won't be presented as usable. Small detail, but it's the kind of honesty that suggests the team has been burned by fake-working integrations before.

One non-interactive turn:

maka run "Summarize this project and identify its highest-risk area"

Permission prompts are on by default. maka run --yolo grants full file and network access, and the docs are blunt about only using it somewhere you're prepared to let the task modify.

The Graph Mode

The feature most likely to interest people already running multi-agent setups is --graph:

maka run --graph "Implement two independent slices, integrate them, then review the result"

In the TUI it's /graph on, /graph off, or /graph <task>. Agent Graph schedules dependent work using child Sessions, and every activation goes back through the same Runtime — so parallel work still produces one coherent event log rather than N disconnected transcripts.

Graph implementation operators use isolated Git worktrees, which means the source project must be a clean Git worktree before you start. That's a real constraint in daily use (uncommitted work blocks you), but it's the honest version of parallel agents: separate worktrees rather than several agents fighting over one checkout.

Non-interactive --graph runs block until the durable graph finishes before printing the supervisor output.

Where Your Data Actually Lives

Workspace state is local, in a plain directory:

<userData>/workspaces/default/
  runtime.sqlite
  connection-catalog.json
  credential-vault.json
  settings.json
  artifacts/

Released builds use per-platform profiles: ~/Library/Application Support/Maka on macOS, $XDG_CONFIG_HOME/Maka (or ~/.config/Maka) on Linux, %APPDATA%\Maka on Windows. A dev checkout uses a separate Maka Dev profile, and the two are never synchronized automatically — worth knowing before you wonder where your sessions went after switching from source to the released CLI.

Two things here deserve flagging rather than burying:

Credentials are plaintext. credential-vault.json is a local plaintext file protected only by the OS account boundary, with owner-only file modes enforced on POSIX. It is explicitly not an OS keychain. The renderer process never sees it, which is good Electron hygiene, but anything running as your user can read your API keys.

Upgrades can look like data loss. runtime.sqlite is the live record; older JSONL transcripts and Electron safeStorage credential files are not imported. An upgraded workspace can show empty threads and will require re-entering credentials. That's a rough edge of a fast-moving 0.1.x, and it's documented rather than hidden.

Resume is also off by default. MAKA_RUNTIME_SAFE_BOUNDARY_RESUME=1 enables Desktop Safe resume, CLI /resume, and startup auto-resume — with the honest warning that those calls hit the model and burn tokens.

The Security Model Is Refreshingly Blunt

Maka's SECURITY.md says something most agent projects won't:

The only enforcement boundary against an adversarial LLM is the operating system.

Not the permission engine. Not output redaction. Not URL allowlists. Not the web-search fail-closed chain. Those ship, and they're useful, but the policy classifies them as in-process heuristics operating on an attacker-influenced string — explicitly not boundaries. Vulnerability reports that merely demonstrate the limits of a heuristic get closed as out-of-scope (though still welcome as ordinary issues).

The policy credits NousResearch's hermes-agent SECURITY.md as its model and inherits its honesty principle. The trust model is single-tenant: Maka runs as your OS account, inside your OS account's trust envelope.

Permission mode defaults to ask, evaluated per tool category by @maka/core/permission. Tools that leave the sandbox must be approved. 0.1.11 also added brokered Windows AppContainer sandbox support and tightened local IPC ownership and ACL enforcement.

If you want containment beyond the OS account, put Maka on a machine you're willing to lose — a VM or a dedicated box. That's not a Maka criticism; it's the same conclusion every honest agent-sandbox analysis reaches.

The Eval Harness Nobody's Talking About

packages/eval is the sleeper feature. It's a declarative benchmark system with a deliberately anti-cheating design:

maka eval run experiment.json --out .maka-eval/run-001

The model is Experiment = benchmark + executor + subjects + tasks + repetitions, expanded into Cell = task × repetition × subject. Each cell produces immutable attempts. The result kernel holds only score, normalized usage, attributable cost, duration, status/failure reason, and artifacts.

The rule that matters: when a cell has multiple attempts, the earliest valid attempt is authoritative — operators cannot choose a preferred outcome. That single constraint kills the most common form of benchmark massaging, where you rerun until the number looks good. A/B testing is just a two-arm experiment sharing one executor, benchmark, task set, budget, and verifier.

Harbor and Pier are executor adapters requiring separate pinned Python environments:

python3.12 -m venv ~/.venvs/maka-harbor-0.20.0
~/.venvs/maka-harbor-0.20.0/bin/python -m pip install 'harbor==0.20.0'

python3.12 -m venv ~/.venvs/maka-pier-0.3.0
~/.venvs/maka-pier-0.3.0/bin/python -m pip install 'datacurve-pier==0.3.0'

Eval fails before running a cell if a declared prerequisite is missing — it does not install or silently substitute anything. Notably, 0.1.11 added a DeepSeek Harness benchmark arm, so Maka is measuring itself against competitors in its own harness.

Honest Limitations

Platform coverage is thin. The Desktop build targets Apple Silicon macOS. Intel Macs and Linux desktop are not supported. Windows is an unsigned preview, explicitly "not a supported release tier." The CLI is broader — the release gate validates Linux x64 (Node 22.19 and 24), macOS arm64 (Node 24), and Windows x64 (Node 24) — but real Eval executor validation only runs on Linux x64 / Node 24.

Legal paperwork is incomplete. DISCLAIMER-WIP states the software grant and committer ICLAs are not yet complete. If you're incorporating this into a product, the disclaimer tells you to conduct your own licensing review. That's a genuine blocker for commercial adoption today.

There are god objects. The maintainers' own open issues from this week are candid: session-manager.ts is 6,445 lines with 40+ exports, ai-sdk-backend.ts is 4,874 lines covering six concerns, execution-composition.ts is 1,840 lines, and packages/runtime/src/ is a flat 198-file directory awaiting subdirectories. Filing these publicly is healthy. It also tells you the architecture diagram is cleaner than the code underneath it.

Config knobs are being removed, not added. Unreleased 0.2.0 unifies context management under one Runtime-owned policy: MAKA_CONTEXT_* environment overrides no longer tune or disable compaction and tool-result pruning. If you had pruning set to off, it gets re-enabled on upgrade, and there is currently no supported replacement opt-out. Defensible for coherence; annoying if you depended on it.

Community discussion is nearly nonexistent. There is no meaningful Hacker News thread for Apache Maka. Coverage so far is a TechTarget trending roundup, a SourceForge mirror listing, scattered X posts, and a handful of blog writeups. 1,769 stars in a week is real momentum, but momentum from the GitHub trending page is not the same as a user base that has shipped with it.

Who Should Actually Try This

Try it if: you run agents on work where the audit trail matters — regulated environments, shared codebases, anything where "what did the agent touch" is a question you'll be asked later. Also try it if you're building agent benchmarks and want a harness that structurally prevents result-shopping.

Wait if: you need Linux desktop, you need a signed installer, you need an ASF-blessed release for procurement, or you want a stable data format. 0.1.x with an explicit "formats may change" warning means what it says.

Skip it if: you just want a faster coding agent. Maka's differentiator is the record, not raw capability. If you're not going to read the log, you're paying architecture cost for a benefit you'll never collect.

FAQ

Is Apache Maka production-ready?
No. There is no Apache release yet, the software grant and committer ICLAs are incomplete, the README recommends building from source rather than downloading a prebuilt binary, and data formats may still change. It's a serious project at an early stage — treat 0.1.11 as an evaluation build.

How is Maka different from Claude Code, Codex, or OpenCode?
Those are coding agents optimizing for what the agent can accomplish. Maka is an agent workspace optimizing for what survives the run. Its append-only Runtime Event Log keeps model messages, tool calls, tool results, permission decisions, and termination facts as durable evidence, with context compaction changing only what's sent to the model — not what's stored. Maka also ships a Desktop app, a TUI/CLI, and a benchmark harness on one shared runtime.

Does Apache Maka run local models?
Yes — you bring your own model. It supports cloud API providers, local models, and compatible gateways through its connection catalog. Nothing is bundled, and there's no shared Maka model account. Pair it with a local server like oMLX on Apple Silicon for a fully local stack.

Are my API keys stored securely?
Partially. Keys live in credential-vault.json, a local plaintext file protected only by your OS account permissions (owner-only modes on POSIX). It is explicitly not an OS keychain. The Electron renderer never receives them, but any process running as your user can read that file.

Can Maka run multiple agents in parallel?
Yes, via Agent Graph (--graph or /graph). It schedules dependent work through child Sessions routed back through the same Runtime, with implementation operators running in isolated Git worktrees. Your source project must be a clean Git worktree to start a graph run.

What does "local-first" mean here in practice?
Sessions, settings, run records, and artifacts stay on your machine by default in a per-profile directory containing runtime.sqlite, a connection catalog, a credential vault, settings, and an artifacts folder. Model inference still goes wherever your configured provider lives — local-first describes the workspace data, not necessarily the inference.

Sources

• apache/maka on GitHub — README, ARCHITECTURE.md, SECURITY.md, DISCLAIMER-WIP, CHANGELOG.md (accessed 2026-08-26)
• Maka CLI package docs — install matrix, Runtime Host service, Eval prerequisites
• Apache Maka podling status — ASF incubation status
• GitHub API repository metadata and open issue tracker, 2026-08-26
• GitHub Trending (weekly), 2026-08-26 — ~1,769 stars gained this week