inseam

How it works

Between a question
and an answer.

inseam connects your devices and your data hosts into one network, indexes what is on them where it is, and reads an object from its source when you ask. This page is for people who want to know what happens underneath, and for teams that would build on inseam.

Four steps, every time.

  1. 1 Connect

    Install inseam on your laptop, or sign in to a cloud service. Each place becomes a host on your network.

    A device-bound host gets a device node. A network-reachable host is stewarded by your network’s cloud node.

  2. 2 Index

    inseam reads each object where it is, extracts its text and keeps a search index. It never keeps the object.

    A producer emits records: address, content hash, metadata, extracted text. One writer per host index commits revisions to object storage.

  3. 3 Search

    You or your agent search once, across every host. The results are addresses.

    Hybrid search over every host index you may read, fused and returned as inseam:// addresses.

  4. 4 Fetch

    Ask for an object by its address. inseam reads it from its host, the whole object or just a range.

    GET /o/{address}: the gateway checks the grant and the steward streams the bytes. Ranges stay ranges.

inseam 0.1.0greg-mbp
$ inseam search "q3 plan"
inseam://home/laptop/notes/q3-plan.md          laptop    2d
inseam://home/gmail/threads/19a2f0c1/plan-v2   Gmail     6d
inseam://home/icloud/Documents/Q3 plan.pages   iCloud    3w
3 hits across 3 hosts. Bodies stay on their hosts.
 
$ inseam fetch inseam://home/laptop/notes/q3-plan.md --range 0-180
# Q3 plan

Ship the macOS app to the early ring. Keep the
compatibility window at 90 days. Decide the licence
before launch.
180 bytes from laptop. Not copied.
The CLI, as planned. Output may change before release.

Every object has an address.

Search returns addresses. Fetch returns bytes from the host. That is the whole API.

  • Bodies never move. The network distributes a catalog, extracted text and vectors. Bytes stream from the host under the steward's authority.
  • Sandboxed, AI-written connectors. Connectors run in their own facet with no ambient network and no secrets. A gate adds credentials and enforces an allowlist.
  • Offline first, without conflicts. One writer per host index, always online. Devices queue records offline and drain on reconnect.
  • Cheap at rest. Everything persistent is immutable objects in a bucket. Compute is edge isolates that cost nearly nothing when idle.
locationinseam://{network}/{host}/{path}
contentb3:{hash}
exampleinseam://home/laptop/notes/q3-plan.md
b3:7f3a9c1e…
A location address is stable while the object stays put. A content address names its bytes. Two locations with one content address hold the same data.

What inseam keeps, and what it doesn't.

inseam keeps

  • A search index of your data's text and metadata.
  • An address for each object: where it is, and a hash of its bytes.
  • The credentials you connect, encrypted. Every decryption is logged where you can see it.

inseam does not keep

  • Your files, emails and records. They stay where they are.
  • Copies of your data. When you ask for a temporary link, inseam keeps a copy of that one object for at most a day.
  • Your passwords or tokens inside a connection. Each connection runs in its own sandbox and never sees them.

The inseam service can read your index, like most cloud services can read the data they host. We protect it with per-network isolation, no standing operator access and an audit log you can see.

Run it under your own product.

inseam is built to sit underneath other products. Each customer gets a network of their own, with its own hosts, its own index and its own permissions, isolated from every other network.

  • One address for agents

    Point any MCP host at /mcp. The agent asks for scopes, the person consents in their browser, and the session can be revoked at any time. Headless agents use a device code; anything else uses a pasted token.

  • A plain HTTP API

    Sign-in is a magic link, with no password. Sessions are bearer tokens. Search, fetch and write go through the gateway, which checks the grant on every request.

  • Clients only where the internet cannot reach

    The macOS app and the CLI turn a Mac or a server into a device node for folders, databases and NAS boxes. Everything reachable with credentials is handled by your network's cloud node, with nothing to install.

  • Metered, with a free plan

    Networks are billed by indexed items and pad storage. Over the limit, new items wait while search and existing items keep working.

Read the API referenceGet started