Mancube

Platform & workflow engineering

Read the source before you hire us.

Mancube builds and operates the unglamorous middle of a software estate — pipelines, workflows, data movement, the front door. Twelve of the tools we would reach for on your project are already shipped, and eleven of them are public under Apache‑2.0. Install one this afternoon. Decide about us afterwards.

Start a conversation See the portfolio

Four of twelve — the rest are in §02

dagron v0.3.0

Durable DAG workflow engine. One static binary, YAML, a database as the only state — no control plane, no cluster to operate.

docker: mancube/dagron-engine
helm: oci://…/mancube/dagron

eggrd v0.3.1

A secure front door for an app you do not change: authentication, rate limiting, TLS and hardened headers, secure by default.

crates.io: eggrd
docker: mancube/eggrd

mcpdef v0.2.0

MCP gateway and governance plane. Deny-by-default allowlist, RBAC, WASM-sandboxed servers, and a tamper-evident audit ledger.

github: lucheeseng827/mcpdef

lakeleto v0.1.4

Local-first lakehouse table explorer. Open Parquet, CSV and Iceberg tables without standing up a warehouse first.

lakeleto.mancube.net

§01

What we’re engaged to do

Ten kinds of work. Each row names what we have already built in that area and made public — not a case study you have to take on trust, but a repository you can clone on the walk back to your seat.

01 Workflow creation Turning the nightly cron pile and the runbook in someone’s head into a graph that retries, resumes and can be replayed. dagron
02 Air-gapped delivery Systems that install and run with no egress at all — no package fetch, no licence call-home, no model download. §03
03 DevOps Release pipelines that produce the same artefact twice: multi-arch images, versioned tags, a chart, and a rollback that has been rehearsed. images
04 Migration Moving a workload between clouds, regions or off a product being sunset — with the cutover written down and reversible. shapeshift
05 Centralisation Four teams, four schedulers, four definitions of “customer”. Consolidating them without a two-year freeze on everyone else’s work. covenant
06 Cloud Accounts, networks, identity and the bill. Everything as code, so the estate can be rebuilt from an empty account. doneyet
07 Proof of concept A working, measured answer to one question, in weeks — built to be thrown away without regret if the answer is no. covenant
08 Optimisation Latency, throughput and spend — profiled first, changed second, reported with the before and the after side by side. recall
09 Development Systems software where correctness and footprint matter. Mostly Rust; the portfolio below is what that looks like finished. crates.io
10 Developer productivity Shrinking the distance between writing a line and knowing it works: local-first tooling, honest CI, docs generated from the code. evald

§02

The portfolio

Consultancies are hard to evaluate from the outside; software is not. These are released products, not demos — versioned, documented, and written for people who never speak to us.

12 shipped products 11 public repositories 100% of those under Apache-2.0 2 CPU architectures per release

Orchestration & data movement

dagron Durable DAG workflow engine in one Rust binary — an open-source, lightweight alternative to a full orchestration stack. Multi-arch images and an OCI Helm chart per release. v0.3.0 shapeshift Streams JSON and JSONL into Parquet or an Apache Iceberg v2 table under one declarative transform spec. No JVM, no catalog server, no row cap. v0.1.2 lakeleto Instant, offline, single-binary explorer for Parquet, CSV and Iceberg: schema, row preview, per-column profiles and opt-in SQL. Nothing leaves the machine. v0.1.4 covenant Data-contract enforcement that actually runs the contract, at the boundary, fast enough to sit in the data path — so a silent schema change becomes a rejected batch, not a corrupted quarter. v0.1.0

AI infrastructure

mcpdef Single-binary MCP gateway and governance plane: multiplexes transports, enforces a deny-by-default allowlist and RBAC, sandboxes untrusted servers in WASM, and writes a tamper-evident audit ledger of every tool call. v0.2.0 recall Self-hosted semantic cache in front of any OpenAI- or Anthropic-compatible proxy. On a hit it replays a stored completion instead of calling the model. No external vector database. v0.1.1 forge Batch-inference coordinator: fan a giant JSONL across N workers on your own spot GPUs or hosted APIs, survive interruptions, and resume with zero loss. v0.1.2 evald OTel-native trace and eval store in one static binary. Point an exporter at localhost, run evals from a JSONL dataset, get scores keyed to the exact span. No database, no Python runtime. v0.2.0 loregraph Builds a memory knowledge-graph of decisions and implementations from the transcripts your coding agents already write to disk, every node linked by hard provenance back to a session and a commit. v0.1.0 mergestro A behavioural merge gate for AI-generated code: instead of statically reviewing a pull request a human opens, it gates what an agent wrote by running it, before it becomes a review anyone has to sit through. v0.5.0

Edge & operations

eggrd Drop-in Rust edge proxy giving any HTTP application a secure front door — authentication, rate limiting, TLS and hardened response headers — with zero changes to the application. v0.3.1 doneyet Workflow and job tracker in production: register long-running work, push status, and answer “is it done yet?” at a glance. Backend, dashboard, CLI, SSO and billing. Not open source. live

§03

If it can’t phone home, most of the market stops working

Regulated, classified and operational-technology estates are not “cloud with a firewall”. Nothing resolves. Nothing pulls. A licence server is a single point of failure you are not allowed to have. Most orchestration and gateway products quietly assume otherwise.

We design for that case first, because a system that runs with no egress also runs everywhere else. That constraint is why the engine above is a single statically linked binary with a database as its only dependency, why the trace store needs no Python runtime, and why the semantic cache carries no external vector database to install beside it.

1

Binary to install for the workflow engine. No control plane, no broker, no scheduler tier.

0

Outbound calls required to start, validate a workflow, or serve traffic.

2

CPU architectures published per release — linux/amd64 and linux/arm64.

11

Repositories you can vendor, audit and keep — every one Apache-2.0.

# the whole install, on a host that can reach nothing $ dagron validate pipeline.yaml # offline lint: no database, no server $ dagron pipeline.yaml # state lands in ./workflow.db

§04

Three ways this starts

All three end with something running in your environment and written down well enough for your team to keep it. None of them end with a slide deck.

A · days

Review

We read the estate — pipelines, deploys, data paths, the bill — and come back with what is actually costing you, ranked, with the measurements attached.

  • Written findings, not a workshop
  • Fixed scope, fixed price
  • Yours to act on with or without us

B · weeks

Proof of concept

One question, one working answer. Built in your environment against your data, instrumented so the result is a number rather than an impression.

  • Success criteria agreed before we start
  • Disposable by design
  • “No” is a valid, useful outcome

C · months

Build & hand over

Delivery of the platform, migration or workflow estate itself — then a handover that assumes we are leaving, because eventually we are.

  • Everything as code, in your repositories
  • Runbooks written from real incidents
  • Your engineers on the keyboard by the end

§05

Tell us what is broken

A paragraph is enough to start. What the system does, what it does badly, and what would have to be true for the problem to be over.

info@dagron.dev

Useful to include

  • Where it runs — cloud, on-premise, or with no egress
  • What is orchestrating things today
  • Whether this is a review, a proof of concept, or a build
  • The constraint that makes it hard

Working languages

English and Bahasa Malaysia. Based in Malaysia; engagements run remote, on site, or inside your network.

Before you write

If you would rather evaluate the work than the pitch, everything in §02 installs without talking to us first. That is deliberate.