4 MB. That's it.
A demand-driven closure plus LTO trims the host by nearly 40% — models, search, MCP, C modules and auto-update all stay.
See the size engineering →Built as one
Systematic capability, packed into one ink marker
Ultra-light, portable, connected, in control — four straight lines from every model call to every byte on disk.
Your C drive says thanks
No registry, no AppData: data lives only in the mdo-home/ beside the exe. Point --home anywhere; uninstall is deleting one folder.
Phone drives the PC
Same-account devices control each other through the official relay: chat, files, settings and updates act on the target device — no open ports, read-only or full control.
Explore Device Link →Every step has a guideline
Tool permissions, write admission, per-call approvals and write receipts; 94 contract documents and 562 tests ship with the MIT source.
Data security →Capabilities
The full capability of a workbench
From a single conversation to a scheduled task — everything runs inside the same permission and audit boundary.
Device Link · now shipping
Phone and PC control each other under one account: once a device is selected, chat, files, settings and updates all act on the target device — offline freezes operations, never falling back to the controller. Devices connect outbound to the official relay; no open ports. Read-only / control modes with receipted, deduplicated writes.
Three steps to control →Sessions & timeline
Streaming replies pushed over a same-port WebSocket — no polling; confirmations, questions and unfinished replies each get a clear card; history loads by rounds while context compaction never deletes what you see.
Start your first task →Tools & approvals
Write-admission tokens, per-call approvals and interruption recovery — every side effect crosses the guideline first; RETRY and RECORD_UNCERTAIN are your explicit calls.
Configure boundaries →File-based memory
The agent edits the same MEMORY.md you do: plain file tools read and write it, snapshot fingerprints give optimistic concurrency.
Organize memory →Skills · MCP · C modules
Progressive-disclosure Skills, MCP over stdio and Streamable HTTP, plus C modules hot-reloaded through restricted TCC — one versioned ABI.
Extend mdo →Web trio
Bounded web_search, web_open and web_find: only the first two touch the network, with public-address enforcement inside the resolver.
Know the boundary →Scheduled tasks
Background tasks reuse the same agents, permissions and audit chain; they resume after restart with cursors that never move backwards.
Schedule a task →Device Link
Device Link, now shipping
Sign in to the same account and let phone and PC drive each other. The sessions, files and settings you see all come from the controlled device — there is no silent path back to the controller's local data.
Three steps to control
Remote control is off by default · each device has its own encrypted identity
- 1Sign in to the same account
PC and Android on one member account see each other in the device list; cross-account devices cannot be queried or connected.
- 2Pick the target device
Open the sidebar device entry, pick a device, watch in read-only mode — or switch to control mode and operate.
- 3Work as if local
Chat, projects, files, approvals, settings and updates all act on the target; streaming events and image attachments return in real time.
Security boundaries, up front
Devices connect outbound · TLS transport
- No open ports: devices connect outbound to the official relay — nothing to forward on home or office networks.
- Same-account isolation: the server validates member sessions and device ownership; tickets are short-lived and single-use.
- Receipted writes: write requests carry a unique ID and content fingerprint; the target deduplicates — no blind replays after reconnects.
- Offline means frozen: when the target goes offline it stays listed and new operations are blocked — never a fallback to the controller.
- Nothing stored at the relay: forwarded content passes through memory only — no database, no access logs.
- Restrained on mobile: Android requests background resources only while remote control is on, releasing them on close.
First release: mdo PC / Android control each other; a member account is required. A web control entry is on the roadmap.
Data Stays Yours
Your data stays home, visibly
Every promise below is pinned by contract documents and tests — not a fine-print footer.
Local first
Sessions, memory, files and config write only to the local mdo-home/ — nothing uploaded to any cloud; every local feature works without signing in.
Zero telemetry
No analytics SDK, crash reports or behavior collection; network requests happen only inside features you actively use — model chats go only to providers you configure.
Keys never leave
Secrets are never stored or transmitted in clear text: config holds only secret_ref references, credentials are encrypted on-device, APIs report only "configured".
Minimal relay exposure
The device relay forwards in memory only — nothing stored, nothing logged; same-account isolation with a read-only mode. → Device Link
MIT open source
Public repository + 94 contract documents + 562 tests + deterministic builds — audit every line.
Read the source →Architecture
A home-grown C stack, no more layers than needed
From cross-platform infrastructure to the browser UI, every layer comes from the same engineering system, tied together by dependency locks and deterministic builds.
Four layers C11
Single responsibility each · commits & source hashes pinned by deps.lock
mdo productsessions · memory · approvals · device link
/api/v1Web UIdevice relayaccount & searchauto-updateAgent orchestrationtools · permissions · audit · ledger
xwork 3xllm 3.1xllm-session 3Application hostHTTP · WebSocket · compilation
xserver xsTCCVFS / packInfrastructurenetwork · concurrency · security · data
xrtTLSJSONmemory · error chainsSingle-executable delivery
deps.lock pins every dependency commit and production source hash; the builder verifies first, then generates the unity entry. The release artifact can be just mdo.exe.
Server-authoritative state
The browser never duplicates run state: stores hold snapshots and cursors; switching sessions or reloading restores from the server, with explicit cursor gaps.
Versioned module ABI
The public ABI lives only in include/mdo/module.h and depends on C standard types alone; C modules compile through restricted TCC and evolve independently with transactional hot reload.
Platforms
Three postures, one ink marker
Where the Home is, the workbench is — park it on D:, drop it on a USB stick, move it to an external drive. Zero C-drive footprint.
Windows6.0
Native WebView2 window with the product icon on taskbar and window.No registry, no AppData; only creates data/cache/webview2/ in the Home when a window first opens — headless start and exit write nothing.
Android5.6
Lite / full arm64-v8a APK editions with a private in-app Home, under the same contracts as desktop.Scheduled tasks, approvals, recovery and device link boundaries are identical on mobile; the UI covers a 390×844 viewport.
Portable mode
USB sticks, shared folders, several Homes side by side — one argument decides which disk holds your data.
PowerShell
# keep the whole workbench on D:, zero C-drive footprint mdo.exe -- --home D:\mdo-home
Engineering excellence
Excellence, on every release path
Contract checks, real runtime probes, deterministic packing and size engineering form the release gate — open the source and re-verify.
182 contract checks
Strict C11 · real probes · deterministic pack
Python contract checks, syntax and interaction tests for every frontend ES module, 116 real low-load TCC runtime probes, two deterministic packs, plus zero-write startup and portable-Home regressions — no stress tests, only re-verifiable checks.
Read the gate source →−37.7% · mdo.exe size reduction
Demand-driven closure + LTO — smaller, not lesser
Same application code, host swapped: Windows mdo.exe −37.7%, Android APK −41.2%, Android libxs.so −50.8%, Linux xs −49.7%. The TCC SDK shrinks from 305 to 179 entries; models, search, MCP, C modules and updates all remain.
mdo.exe −37.7%APK −41.2%libxs.so −50.8%Linux xs −49.7%94 contract documents reviewed with the code · every rule in docs/ has a matching test
