Keep the worker separate from private accounts and files
AgentMug lets you build portable AI workers, connect them to real systems and trusted knowledge, and run them wherever the work happens, with a clear record of each run.
A reusable worker needs a description of its job, the tools it may use and the evidence it requires. It should not distribute its creator's private documents or account credentials. AgentMug records the portable definition in a versionable .agent file. Each receiving owner supplies their own accounts and source bindings.
The public runtime separates model access, persistence, source reading and tracing through adapters. This makes the boundary between the worker's definition and its execution environment explicit. Portability still requires checking which tools and source adapters the receiving host provides.
A concrete workflow: answer from an operating policy
The runtime documentation demonstrates a worker that requires an operating-policy document and answers a question about a refund approval rule. The portable contract requests read and citation capabilities; the host privately binds the actual policy file. The shared worker does not contain that file or its location.
Before the first model request, the runtime checks required bindings, permissions, adapters and freshness requirements. Missing required evidence stops the run. Retrieved passages carry source and revision references, and the run produces a receipt. This is a documented implementation example; it is not a reported deployment for a Saudi customer.
Connect a worker to an existing workflow
The MCP bridge exposes a hosted AgentMug worker as a callable tool. A compatible client can inspect its source-readiness contract and receive a structured run receipt. Execution remains on the configured AgentMug endpoint; the bridge does not move that hosted worker onto the client's computer.
The n8n community-node source includes an importable example: a manual trigger sends a message to a selected worker and receives its result. It can return the output alone or a fuller response. The default endpoint is hosted, and model inference is billed to the endpoint operator.
Make execution inspectable
Run receipts record source reads, revisions, evidence references, final status and supported evaluation results. Portable checks cover source readiness, freshness, citations, write boundaries and bounded structured output. Assertions that the runtime cannot evaluate are recorded as skipped rather than silently treated as passed.
A separate OpenTelemetry adapter emits model-call and transcription spans into an operator-configured tracing pipeline. Its documented attributes include token use, latency and input/output previews. Those previews require an appropriate data-handling policy; tracing is not automatically private merely because the adapter is open source.
Applying this pattern to your project
This pattern is useful when the same AI worker needs to operate with different owners' knowledge and tools. The worker carries its requirements; each environment supplies the actual bindings. Tool coverage differs by host, source adapters are read-only, and the documented KnowledgeAdapter is an interface rather than a shipped universal retrieval backend.
The public core is pre-1.0, and the hosted service includes proprietary components. For a custom project, define the supported sources, allowed actions, deployment location and acceptance checks, then verify the complete workflow against the intended environment.