Local control plane

What this accomplishes

Run agents from local scripts, editor extensions, or another process without embedding the Node SDK or keeping the desktop app open.

Current availability

The local control plane is available through miton daemon on macOS, Linux, and Windows. Its versioned HTTP and WebSocket protocol is local-first and does not depend on Miton Studio.

Before you start

Install the Miton CLI, configure the provider credentials needed by the agent runtime, and confirm that the operating-system credential store is available. Port 7746 must be free unless a different --port is supplied.

Start and stop

miton daemon start
miton daemon status
miton daemon stop

The default endpoint is http://127.0.0.1:7746. State and the advisory process lock live under ~/.miton/daemon/. Named profiles use ~/.miton-<profile>/.

miton daemon list lists agent runs owned by the local control plane. miton daemon attach <run-id> attaches stdout to the run’s NDJSON event stream without starting another agent runtime.

Authentication

The first start creates a random 256-bit bearer and stores it in the encrypted credential store under miton:vault:auth-token:daemon:<profile>. On macOS, Linux, and Windows, the CLI credential-store adapter uses the operating-system credential store. It has no plaintext-file or environment-variable fallback.

Every /v1/agent/*, /v1/sessions/*, and WebSocket request requires:

Authorization: Bearer <vault-token>

GET /v1/healthz is the sole unauthenticated route. It reports liveness, protocol version, process ID, and port; it does not expose project or session data. That route alone permits cross-origin GET and Private Network Access preflight so the Studio SPA can report daemon reachability.

Version 1 routes

Start a run:

curl \
  -H "Authorization: Bearer $MITON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"prompt":"Summarise the active project"}' \
  http://127.0.0.1:7746/v1/agent/runs

The bearer shown as $MITON_TOKEN is illustrative shell state. Miton itself reads the value from the encrypted credential store and never writes it to a configuration file.

Network posture

Loopback is the default. Binding to another interface requires both an explicit host and --consent-lan:

miton daemon start --host 0.0.0.0 --consent-lan

Use LAN mode only on a trusted network. The bearer remains mandatory. The local control plane does not provide an internet relay.

Every HTTP response and WebSocket event passes through the privacy redaction gate before leaving the process.

Relationship to Miton Studio

The local control plane and Studio are deliberately separate:

Studio can remain closed while the local control plane runs. Studio’s limited workflow and note actions remain an operations-console subset; they do not define the public agent protocol.

What success looks like

miton daemon status reports the selected profile as running, GET /v1/healthz returns protocol version v1, authenticated run and session requests succeed, and miton daemon stop removes the process record after the server exits.

Common failures and recovery

• If startup reports that the port is in use, stop the process occupying it or start Miton with a different --port.
• If an authenticated request returns 401, read the bearer for the selected profile from the encrypted credential store again; profiles do not share tokens.
• If status finds a stale process record, rerun the command. The lifecycle removes records whose process no longer exists.
• If a non-loopback bind is refused, add --consent-lan only after confirming the network is trusted.

Related next action

Use miton auth login <provider> to establish an OAuth-backed provider session, then start a run through POST /v1/agent/runs or @miton/sdk.