Do You Need a Machine?
Not every task does. An ExecWarden-hosted agent can plan, run bounded JavaScript, make bounded public HTTP requests where enabled, and invoke granted capabilities without execution capacity. Add a customer-configured VM, Docker environment, or local machine when it needs shell, files, processes, git, browser, tests, containers, persistent state, or private-network access.
| Continue without capacity | Planning, bounded JavaScript, bounded public HTTP where enabled, workflows, transcripts, and governed capability calls. |
|---|
| Connect execution capacity | Shell, files, processes, git, browser, tests, containers, persistent environments, or access to customer networks. |
|---|
| Keep authority separate | The environment controls what is locally available. ExecWarden controls only the capabilities and credentials invoked through ExecWarden. |
|---|
Available Operations
When a supported capacity provider exposes a running machine, the agent can call capacity:allocations.invoke with an allocation id, method name, and method arguments. Available operations depend on the configured provider and machine type.
| runCommand | Run a shell command when the configured capacity provider exposes command execution. |
|---|
| writeFile | Write a file when the configured capacity provider exposes filesystem access. |
|---|
| readFile | Read a file when the configured capacity provider exposes filesystem access. |
|---|
Two Ways to Set Up Machines
| Bring your own machine | Pair a laptop, workstation, VPS, or private host that you control. The built-in provider creates per-job Docker environments on that registered host. |
|---|
| Configure a provider adapter | Register a capacity provider that implements ExecWarden's prepare, ensure, observe, and destroy lifecycle. GCP Spot VM support exists behind explicit gateway configuration; other providers require an adapter rather than an MCP connection alone. |
|---|
Built-in Providers
| Bring your own machine | Default provider. Creates a Docker-backed environment on a paired laptop, workstation, VPS, or private host; exposes runCommand, writeFile, and readFile. |
|---|
| GCP Spot VM | Optional provider enabled through gateway configuration for short-lived Google Compute Engine Spot capacity. |
|---|
| Development memory provider | Development-only lifecycle provider. It creates no external machine and should not be presented as execution capacity for production work. |
|---|
Removing a Provider
When you remove a provider, the gateway stops all its running machines. It checks every 30 seconds until everything is gone, then marks the provider as removed. If cleanup stalls, you can force-remove — this skips cleanup but the machines may keep running on the provider side.