Board, agent and model. None of it leaves the building.
Self-hosting the board was never the whole problem.
Meshly Build's execution edge needs an agent, and an agent needs a model. If the only model available is a hosted frontier API, the air-gap story stops at the server boundary and the agents sit outside it. That is why this used to be handled as a concession: the platform works offline, but your agents still need an exception. It is no longer the honest answer, because we can supply the models too.
- The server itself runs indefinitely offline. Licence heartbeat, telemetry and portal calls all fail silently and degrade cleanly.
- Air-gap operation is verified in the code rather than asserted in a datasheet.
- Every other external dependency is optional, off by default, or degrades without denying you functionality.
Take the exception, or take neither.
Plenty of environments described as air-gapped will permit a proxied gateway for the agents, and where yours does, that is the simplest path and we will tell you so. Where it does not, the appliance serves local coder and reasoning models behind one OpenAI-compatible gateway on your own hardware, and Meshly CLI is the agent that talks to it while holding the same MCP connection to the board that Claude Code holds.
- The gateway is an ordinary OpenAI-compatible endpoint, so the agent is not doing anything exotic to reach it.
- The board sees the same MCP client either way. Gates, audit and cost accounting do not change.
- Reference hardware exists for the appliance, and configurations outside it need tuning. Ask before assuming yours fits.
The buyers a vendor cloud structurally cannot serve.
If data sovereignty is a hard constraint rather than a preference, this stops being a features conversation. Regulated and sovereignty-bound organisations were the hardest fit for this category and are now the best one, because the constraint that ruled everything else out is the constraint this was built around. Meshly Oy is a Finnish company, so for European buyers the vendor sits inside the same jurisdiction as the requirement.
- Code, prompts and model traffic all stay inside your network. No contract language is doing that work.
- Governance obligations that ask for auditable records of automated decisions are answered by the record the board already keeps.
- Deploy on a single VPS with PM2 and Nginx, or with Podman or Docker, on your hardware and your PostgreSQL.
This half of the stack is younger. Much younger.
Meshly Build is at v3.8.5 after 142 releases. Meshly CLI is at v0.7.0 and the appliance at 0.4.1. The capability is shipped and real, verified in both source trees, but it carries far less production mileage than the control plane it serves. A customer choosing the no-egress route is choosing the less-proven half, and should know that before signing anything, not during the pilot.
- Tool-call reliability with local models varies by model. Some work natively, others need a parser fallback.
- Everyone else in this category is describing a roadmap here. That distinction is only worth something if we are equally plain about how new ours is.
- Commercial terms for the appliance, including hardware, warranty and support, are a separate conversation and we will not improvise them.
Tell us what your network will not allow.
The useful version of this conversation starts with your actual constraint: what may leave, what may not, and who has to sign off. We will tell you which of the two routes fits, and say so plainly if the simpler one is enough for you.