The Problem

Enterprises deploying LLM-powered tools face a fragmented stack: separate systems for model access, tool execution, identity, and guardrails. Archestra consolidates these into a single platform with an LLM gateway, MCP registry, and agent runtime—so teams don't stitch together half a dozen tools to get from "user prompt" to "approved, sandboxed action."

What This Does

Archestra is an enterprise AI platform with three sub-projects: platform/ (the main web app, 5074 files), ai-labs/ (a Rust-based benchmarking harness, 254 files), and migration-kit/ (35 files). The platform provides chat, an LLM proxy for developer tools, an MCP gateway with OAuth, a private MCP registry, an orchestrator with a Kubernetes operator, and deterministic guardrails including Dual-LLM verification.

The ai-labs/ component is a Rust workspace (ai-labs/Cargo.toml) that runs benchmark experiments across LLM providers, tracking costs, token usage, and trajectory quality. It includes a CLI (ai-labs/cli/src/main.rs), a runner (ai-labs/runner/src/run.rs), and a dashboard (ai-labs/dashboard/) for rendering results.

How It Is Wired

The main entry point is main in ai-labs/cli/src/main.rs:151, which reaches 65 functions. The heavier path is run in ai-labs/runner/src/run.rs:140, reaching 212 functions—this is the core experiment orchestrator. It spawns subprocesses (cmd.spawn) for Dagger log capture, and the sandbox backend in platform/archestra-rs/sandbox-core/src/backends/dagger.rs runs external commands for session management.

The highest-blast-radius function is Err, called from 86 places—it's the error constructor, so any change to error handling ripples widely. request (35 callers) is the HTTP client used across the codebase. run.rs is the most interconnected file: 132 functions, called from 2 files, calling into 14, and it both reads/writes files and calls models for inference. The ai-labs/core/src/lanes.rs module (34 functions, 29 callers) defines the lane system that prices and routes experiments.

The wiring for external effects is thin: 7 functions call models, 7 spawn subprocesses, 6 touch the filesystem. A run goes from main → run_dashboard → serve → spawn → connect_target → spawn_and_read_connect_params in just 6 hops to leave the process.

How To Use It

Setup: This is a pnpm monorepo with Docker and GitHub Actions CI. The ai-labs/ component is Rust with Cargo. No root package.json or Makefile is present, so platform install steps are not documented in the repo.

Configuration: The ai-labs/envs/ directory holds TOML files like basic.toml and apps.toml that configure LLM providers and MCP servers. ai-labs/lanes.toml defines the experiment lanes. The platform's configuration files are not visible in this structure.

Running it: The CLI entry is ai-labs/cli/src/main.rs. Build with cargo build --release inside ai-labs/. The README points to https://archestra.ai/docs/platform-quickstart for the full platform setup, but the commands are not in this repo.

Real-World Use

A team runs a benchmark comparing two LLM providers for a customer-support agent. They configure lanes in ai-labs/lanes.toml, point the runner at their MCP servers via ai-labs/envs/, and execute cargo run --release --bin archestra-cli from ai-labs/. The runner executes tasks from ai-labs/tasks/, records trajectories and costs, and the dashboard (ai-labs/dashboard/templates/index.html) renders pass rates and token spend for review before promoting a model to production.

Code Health & Issues

Static analysis (not opinion) found 6 issues:

  • High - Pinned dependency with published advisory: tokio@1 has CVE-2021-45710 (high severity) plus 7 more. The pinned version installs, so the advisory describes this deployment. Fix: upgrade to the fixed version and commit the lockfile.
  • Medium - Container base image not pinned by digest: .github/bench/Dockerfile uses ghcr.io/astral-sh/uv:${UV_VERSION}. Fix: use image:tag@sha256:<digest>.
  • Medium - No dependency vulnerability scan in .github/workflows. Fix: add dependency-review-action or osv-scanner.
  • Medium - Large binaries in repo: 9 blobs over 5MB, including create-azure-bot.mp4 at 15.6MB. Fix: use Git LFS or object storage.
  • Low - 4 workflows lack timeout-minutes. A wedged job runs to the 6-hour default.
  • Low - Missing .editorconfig, .gitattributes, and formatter config.

The repo also has committed secrets flagged by the audit, which should be rotated and removed.

The Bottom Line

Archestra is a serious, well-structured enterprise AI platform with a real benchmarking harness and substantial test coverage (1669 test files). The Rust ai-labs component is clean and modular. The main risks are the pinned vulnerable dependency, large media files bloating clones, and committed secrets. Teams wanting a self-hosted LLM gateway with guardrails and MCP orchestration should evaluate it; teams needing quick setup documentation will find the README links point elsewhere.