Preview · Refract Mesh is in private development · Coming soon
REFRACT MESH · v0.1 · MCP-NATIVE · MULTI-TENANT

The orchestration mesh
with one source of intelligence
at the center.

Mesh is the enterprise stream of Refract — built on the same source that powers Lens, refracted through your organization via MCP-native connectors, deterministic workflows, multi-tenant isolation, and an auditable compliance kernel. The Workato alternative for teams who already speak AI.

MCP-native SOC 2 path Audit-grade
refract.mesh.architecture RUNTIME · MULTI-TENANT
EXT systems
crm
erp
db
saas
apis
▼ ▼ ▼ ▼ ▼
L1 mcp
mcp:crm
mcp:erp
mcp:db
mcp:saas
mcp:custom
L2 orch
workflows
triggers
composer
L3 source
agent:tenant₁
agent:tenant₂
agent:tenantn
L4 kernel
risk_classify · policy_gate · audit_ledger
▼ ▼ ▼ ▼ ▼
OUT actions
write
notify
update
decide
audit
The Stack

L0..L4The full architecture,
layer by layer.

Mesh is composed, not bundled. Every layer is independently addressable, independently versioned, and independently auditable. Run the whole stack, run a slice, run it on prem.

L0 Sources
CRM ERP DBs SaaS APIs file_systems message_queues webhooks
Whatever you already run — read-write boundaries kept on the source side. Mesh never owns your systems of record.
L1 MCP Connectors
mcp.bind() mcp.invoke() mcp.subscribe() connector_registry credential_vault
Each source surfaced as an MCP server. Standard protocol, standard auth, standard observability. Bring your own or pull from the registry.
L2 Orchestration
workflow_dag step_composer trigger_router replay_engine version_log
Deterministic workflows composed from MCP calls and agent inferences. Replayable, versioned, auditable. Triggered by event, schedule, or invocation.
L3 Agent Source
agent_spawn() tool_curator role_template multi_tenant_iso multi_provider_router
The same source that powers Lens — extended for org-level tenancy, B2B WorkerAgents, and multi-provider LLM routing. The intelligence layer.
L4 Compliance Kernel
risk_classify policy_engine audit_ledger approval_router data_residency
5-tier action classification (green / blue / yellow / red / black), runtime policy enforcement, and an append-only audit ledger. The spine that makes Mesh enterprise-grade.
agent USER INTENT L1 · MCP REFRACT CRM ERP DB SaaS Webhook Custom API Queue FS / S3
L1 · MCP-Native

Every system, surfaced
as an mcp_server.

No proprietary connector format. No "we built our own thing." Mesh's connector layer is MCP-native end to end — every source becomes a model-context-protocol server, addressable by every agent and every workflow under the same primitive.

  • // SPEC
    MCP-protocol everywhere Open standard. Bring your own MCP servers, or use ones from the registry. We don't lock-in your integrations.
  • // AUTH
    Credential vault, not credential read OAuth tokens stored encrypted-at-rest in tenant-isolated vaults. The connector layer hands tokens to MCP servers; humans never see them.
  • // AUDIT
    Every invocation logged Every mcp.invoke() and mcp.subscribe() writes to the audit ledger. Replay any call, see the response, see who triggered it.
trigger webhook mcp.invoke crm.fetch_lead mcp.invoke db.query_history agent.reason classify · decide policy gate workflow_dag · v0.7.2 · replay-ready

// dag.compose() · trigger → parallel(mcp_calls) → agent_reason → policy_gate → emit

L2 · Orchestration

DAGWorkflows that
compose, replay, version.

Mesh workflows are deterministic DAGs of MCP calls and agent inferences. Author them in code, in the visual composer, or let the source propose them — then version, replay, and govern them like any other production artifact.

// PRIMITIVE workflow_dag Directed graph of typed steps — MCP calls, agent inferences, policy gates, emit nodes.
// FEATURE replay_engine Re-run any past workflow with the same inputs. See exact decisions. Override and re-emit.
// FEATURE version_log Every workflow change versioned. Roll forward, roll back, branch by tenant.
// FEATURE trigger_router Webhooks, schedules, source events, agent-initiated. One router, all triggers.
Connector Library

L1If it has an API,
it has an MCP server.

The connector grid below is what's coming live first. The actual surface is bigger — anything addressable through MCP, plus the long tail accessible via the universal HTTP / GraphQL connectors.

Ggoogle.workspace
Mmicrosoft.365
Ddynamics.365
#slack
Nnotion
hubspot
salesforce
Nnetsuite
$stripe
shopify
Sservicenow
Wworkday
Llinear
Jjira
airtable
Zzendesk
postgres
snowflake
kafka
azure
aws
openai
anthropic
+http.universal
L4 · Compliance Kernel

5-tierRisk-classified.
Policy-gated. Auditable.

Every action an agent considers takes a trip through the kernel before it runs. Risk gets classified, policy gets enforced, audit gets written. The kernel is what takes Mesh from "raw source" to "audit-grade orchestration."

action classify gate emit ledger
GREEN auto-execute
BLUE log + execute
YELLOW notify + run
RED human approve
BLACK block · escalate
// FEATURE policy_engine Per-tenant policies enforced at runtime. SoD, data residency, action gates.
// FEATURE audit_ledger Append-only. Cryptographically chained. Exportable. SOC 2 / ISO-friendly.
// FEATURE approval_router Slack / Teams / email approval flows for RED-tier actions. Time-bound, attributable.
// FEATURE data_residency Per-tenant region pinning. Canada-resident data path on by default for our home market.
vs Traditional iPaaS

What changes when
the platform is AI-native.

The iPaaS category was built for deterministic data movement. Mesh is built for deterministic data movement and agentic decision-making — without bolting one onto the other.

Capability Refract Mesh Workato MuleSoft Zapier
MCP-native connectors first-class
AI agents (built-in) the core add-on add-on add-on
Deterministic workflows
Replayable / versioned by default enterprise tier
Multi-tenant compliance kernel 5-tier classify policy controls governance pkg
Append-only audit ledger crypto-chained log only
Multi-provider LLM routing
Self-host / on-prem on roadmap
Boutique implementation included via RautingTech via partners via SI

// honest competitive read · not a hit-piece · this matrix updates as Mesh ships

Sibling stream: Refract Lens

Mesh is the enterprise stream. Lens is the personal stream — same source, same connector layer, scoped to one human, loosely compliant by design.

See Refract Lens →
Refract is built by RautingTech, the Canadian boutique orchestration practice.
Architecture Review · Design Partner Cohort

Bring your stack.
We'll refract it through Mesh.

Mesh is shipping in design-partner cohorts. Tell us what you run and what you're trying to orchestrate — we'll send back a reference architecture and a 30-min slot to walk through it.

// design partners get reference-architecture sessions, early SDK access, and shaping power on the roadmap