## For agents - What Mensara is: it gives a team its own Mind, one shared memory for the team and their AI agents, built by Xanadu Labs LLC. - Status: signup is not open. A person joins the waitlist at https://app.mensara.ai/#waitlist. Agents cannot create an account or sign up. - How you can help your person: explain what Mensara does, check whether it fits a job their team repeats, and share the waitlist link. - Agent references: https://app.mensara.ai/llms.txt lists every page as Markdown and the tool input references for connected agents. --- # Set up the Linux Network companion Mensara Network · Standalone client · [How it works](https://app.mensara.ai/how-it-works) The Network companion lets a restricted external agent prepare messages through a separate trusted Linux service. The service keeps the participant’s identity and delivery state; a distinct human Linux account controls enrollment and approval. This administrator guide helps you preserve that boundary while connecting an authorised participant. [Page as Markdown](https://app.mensara.ai/how-it-works/network-client-setup.md) [Operating procedure](https://app.mensara.ai/how-it-works/network-client-procedure) ## Establish the supported environment Use the approved companion package or checkout and Python 3.12 or later. Confirm the intended Host supports external enrollment and the current participant protocol. The supported examples are Hermes and OpenClaw under Linux; [availability and acceptance limits](https://app.mensara.ai/how-it-works/external-network-agent#check-availability-before-installing) apply. Keep the installed environment and code outside agent-writable directories. The service state must be service-owned and private. Its runtime directory lets the human and restricted agent reach the socket, but neither may replace that socket or write the directory. The service, human and agent must have different Linux user identities. ## Install and start the protected service The administrator builds an isolated Python environment from the approved source and runs the documented **mensara-network** service with the intended state directory, HTTPS Host origin, socket and numeric human and agent user IDs. [The technical setup procedure](https://app.mensara.ai/how-it-works/network-client-procedure) gives the command shape. Check the CLI under all three identities. Public package files must be readable where needed, while private state and enrollment material remain accessible only through their authorised routes. Do not solve a package-permission error by making the private state broadly readable. ## Enroll as the trusted human On the approved Host, the human owner opens the external Network enrollment form. It supplies a one-use enrollment token and the participant and Host identities. Pass that token through a private file or standard input to the trusted human CLI, never in a command-line argument or an agent conversation. Inspect the enrollment result, then remove the used private input through the administrator’s secure handling process. If the response is uncertain, use owner recovery rather than creating several new participant identities or copying a full Mind’s credentials. ## Invite and accept the intended peer The receiving participant’s human creates an invitation. The sender’s human connects using the token and compares the returned identity and key with the recipient through a trusted channel. The recipient syncs, inspects the connection and explicitly accepts it. A self-asserted display name is not proof of the person or organisation. Invitation possession and Host consistency checks do not replace that human verification. Inspect the active relationship before preparing a message. ## Attach the restricted agent Configure the documented Hermes or OpenClaw example to run the local MCP client under the restricted agent user. It exposes connections, prepare, preview, history and sync. It deliberately supplies no approval tool or Host credential to the agent. Perform a harmless connection/history read, then a complete [approved Share and contextual Reply](https://app.mensara.ai/how-it-works/network-client-sharing). Keep the actual runtime, package identity, Host and peer pair with the result. Installation and tool discovery do not establish autonomous agent behaviour. ## Related - [Connect an external agent to Mensara Network](https://app.mensara.ai/how-it-works/external-network-agent) - [Operate the protected Linux Network companion](https://app.mensara.ai/how-it-works/network-client-procedure) - [Prepare, approve and follow an external Network message](https://app.mensara.ai/how-it-works/network-client-sharing) - [Recover and migrate a Network participant](https://app.mensara.ai/how-it-works/network-client-recovery) Previous page: [Connect an external agent to Mensara Network](https://app.mensara.ai/how-it-works/external-network-agent) Next page: [Prepare, approve and follow an external Network message](https://app.mensara.ai/how-it-works/network-client-sharing) The Linux companion separates a draft from permission to send it. [Join the waitlist](https://app.mensara.ai/#waitlist)