Your plans sync between machines. Never through ours.
Flanner Mesh syncs plans and memory directly between your team's machines over an encrypted connection. Every change is signed by the machine that made it. Our servers store who is on your team and who can access which workspace. They never receive your plans or memories.
The flanner client — CLI, MCP server, local web UI — is free, open source and needs no account. Start there if you are one person on one machine. You need Flanner Mesh when two or more machines need the same plans.
Where your plans actually go
Plan contents travel on one path only: directly between devices.
What our servers store
The right-hand column is not a policy. Our servers never receive that data, so they cannot store it.
On our servers
- Who is on your team, and their handles
- Which devices each person enrolled: each one's public key, its operating system, and a label that is the machine's name unless you pass --label
- Which workspaces exist, and who may enter them
- Billing: how many seats, and whether they are paid
- Whether messaging is on, and how long messages are kept
- The agent policy your team published, every version of it
- Device reports: agent names and versions, the policy version applied, and counts of findings. Kept 30 days, with no paths, file names, repository names or usernames
- Where to send your team's alerts, sealed so that we can deliver to it and cannot read it back. An alert waits here until it is delivered, 7 days at most
- The public half of each key an agent signs commits with, and which device registered it
Never on our servers
- The text of any plan, in any version
- The text of any memory, shared or not, and whether one exists at all
- Plan names, titles, memory titles, or the repositories they came from
- Comments, review decisions, or who proposed what
- The content of messages, who they are sent to, or when
- A credential's value, its name, or where it is kept. A device counts what its agents can reach, and sends the counts
- Your plans or memories after you cancel. There was never a copy on our servers. Account, device and billing records are kept as listed above.
How one sync happens
Every sync follows the same four steps.
- 01
You ask
Your device asks a teammate's for what it lacks. Teammates can push to you too, unless you turn pushes off, and the same checks apply.
- 02
They answer with a list
Their device replies with a list of what it holds, not the contents.
- 03
You fetch the gaps
Your device pulls only the versions it is missing, so a second sync moves almost nothing.
- 04
You verify every signature
Each version is signed by the machine that wrote it. Your device checks the signature against that machine's public key.
Two machines usually connect directly, even behind home routers and office firewalls. When they cannot, an encrypted relay forwards the bytes. The relay cannot read them.
Review, and an accepted baseline
A plan a teammate is still drafting and a plan the team has agreed on are different things. Review is what keeps them apart.
Anyone with access proposes a version for review. Teammates comment against a quotation from the plan, so a note is attached to the line it is about rather than to the document. A maintainer approves, and that version becomes the accepted baseline.
The baseline is the point. Without it, “the plan” means whichever copy you happen to have pulled. With it, your agent can ask which version the team actually agreed to, and get an answer that is the same on every machine.
Every proposal, comment and decision is signed by the machine that made it and travels the same way plans do — device to device. None of it reaches our servers.
Decisions are recorded locally even without a subscription; what Mesh adds is that they reach anybody else. The commands
Messages, on the same connections
Team Mesh also lets teammates ask each other short questions from inside Claude Code or Codex. Messages go device to device, like plans, and reach your agent as quotes, not instructions. Flanner Messages explains how.
One agent policy for the whole team
Flanner Curb shows what each coding agent can reach on a machine. On Mesh, a team sets one policy for all of them and sees where it holds. These parts are free: they keep working when a trial or a subscription ends.
One signed policy
Paths no agent may read, the sandbox, allowed domains, web access and allowed MCP servers. Your organization signs it. Each device checks the signature, the version and the expiry before anything changes, and an older or altered policy is refused.
The delegation
flanner curb policy --enrol asks you once to let signed policy make changes that only tighten. Your device works that out against its own settings. Anything else waits for --approve on that device, and --withdraw ends the delegation.
The fleet view
flanner curb fleet shows admins each device's policy state, drift and counts by severity. Devices sign and number their reports, and the command checks them itself. A device whose newest report is over a day old shows as stale.
Alerts
One alert for each change that grows what an agent can reach, and one for each refused policy. Developers see them on their own machine. Admins can have them relayed to a webhook or Slack, each with a stable id, so a retry is never a second alert.
A device re-reads its settings against the policy at session start, when they change, and every 6 hours while flanner peer serve runs, so drift shows by the next check. A device writes the policy to user settings, which its user can undo. flanner curb policy --export writes the same policy as admin-owned files, for device management to deliver. If the policy names an audit collector, records go from your devices straight to it, never through us. How the policy is signed
What it is not
Flanner Mesh is not a live collaborative editor. There is no shared cursor and no shared document. It works like git: you edit your copy, and versions move between machines when someone pulls them.
Live co-editing would require a document server. Flanner does not run one, by design.
Nor is it a sync button for Claude Code's memory. Claude Code keeps its auto memory on the machine that wrote it, and documents no way to share it. Mesh shares the memories you choose, one at a time, beside your team's plans and skills. How the two compare.
Seats, devices, and leaving
Your second machine
A seat is a person, not a device. Your laptop and your desktop cost one seat between them. Each still enrols separately, because each generates its own key.
Revoking a device
An admin can revoke a device or remove a member. Syncing stops for that device when its entitlement next renews, within a day.
What revocation cannot do
Revoking access does not remove plans a machine has already pulled. Those files stay on that machine.
If you stop paying
Syncing stops. Everything local keeps working: plans, versions, history, CLI, MCP server and web UI. Nothing is deleted, because nothing was stored on our servers. Your agent policy, device reports and alerts keep working too: they are free.
What it costs
$9 a month for one person, or $19 a member for a team. Both start with a 30-day trial. Seats are per person, not per device.