Mycel drafts every client deliverable from one past one, and holds the logins that send them.

That is Mycel's own description of the problem it sells against, and it is the truest sentence on the site 1. A service firm's capacity ends at the one person who reads every draft before it reaches a client. Mycel launched on Product Hunt on September 20, 2026 and finished first on that day's leaderboard 2. Its offer is to write the drafts and leave that person one job, which is approving them.

The repository behind the product describes the same thing in seven words: "OpenCode in a sandbox. A human on every send." 3

Both sentences are accurate. The model and the agent belong to other people. What Mycel built is the loop around them and the gate at the end of that loop, and it names the parts in between on its own privacy page. Read that page next to the landing page and the product comes into focus: a carefully built gate, priced off the operations standing behind it.

The pitch is specific. "Upload any piece of work you have already sent a client. It drafts the next one for every client. Correct it once." 1 Setup takes four steps: describe the service, upload one past deliverable, hand it this week's work, approve what comes back 1.

The trades it names are the ones a small firm bills for: bookkeeping, recruiting, AI-search visibility, legal, web and operations desks, all running the same loop 1. The first jobs on offer are a weekly check of what AI assistants tell your client's buyers, an accounts receivable desk that drafts the next dunning step and "never double-invoices," a monthly close that reconciles "to the cent," a recruiting desk, a vendor security questionnaire pack, and a contract desk that drafts redlines and risk notes 14.

Underneath, most of the machinery belongs to other companies. Mycel drives OpenCode, an open-source coding agent it does not own, and its Product Hunt listing credits opencode and Daytona among the tools it is built with 5. Each job executes inside a rented isolated environment. App connections are brokered through Composio's OAuth layer, which the repository counts at 250-plus toolkits 3. Model calls reach OpenAI through Mycel's own proxy rather than from the agent 6.

Renting the sandbox and the model is the sensible way to start, and the repository says so in its own principles: "Rented commodities. Swap sandbox or model with one env var." 3 It matters for one reason. Every one of those rented parts sits between your client's data and your client.

The launch price is $149.50 a month for three months, halved from $299 and running until September 27, 2026 1. Starter allows two businesses, three people and 2,000 jobs a month. Growth is $899 for ten businesses, ten people and 10,000 jobs. Scale is a sales conversation, with no limits, a private cloud of your own and a security review 1.

The unit is defined on the page rather than in a footnote. "A job is one piece of work done: a message answered, a sync run, a document produced." 1 At Starter that works out at about fifteen cents a job, and about nine cents at Growth. The meter runs the other way when it empties: "The AI bills are ours, and there is no overage charge. Growth carries five times the volume of Starter; if a month's runs out, work waits for the next one." 1 So a busy month costs the same as a quiet one, and the back office stops until the first of the following month. That is comfortable for the buyer's budget and awkward for a client waiting on a month-end close.

The page sets its own comparison. Mycel costs $3,588 for a Starter year, against roughly $14,400 for an offshore contractor and an $80,000 hire with six weeks of ramp 1. The contractor comparison is where the arithmetic gets interesting, because a contractor and a hire both take work off your desk. Mycel drafts the work and returns it to the same desk for approval, which is the desk the launch page opened by describing as the cap on the business.

The rest of the fee is buying the company's operations rather than its intelligence, and Mycel says as much. The kernel that runs the whole thing is Apache-2.0, self-hostable, with "no metering, no seat limit and no expiry," and the install is one line that clones the repository and runs its setup script 13. What stays closed is the client-facing portal, sign-up and billing, and the company's own go-to-market 3. The engine is open and the operation is paid, which is a coherent split and an unusual one to state this plainly.

The open half is also young. At the time of writing the repository shows twelve stars, no forks and nine commits, and its README carries its own warning: "Pre-alpha. The core is real and tested. APIs still move. Watch the repo; don't pin to it yet." 3 A free self-hosted install runs on Postgres only if you set a database URL, and holds everything in memory until you do, which the README describes as "fine for the first hour, gone on restart" 3. Two of the product's own pages also disagree about how you get onto the hosted plan: the repository calls it invite-only, while the homepage says "Start today. No invite, no call." 13

The best thing on the site is a security design, and it is stated as a mechanism rather than a promise. "The agent never holds a credential. It gets an opaque nonce. The harness holds the secret, shows a preview, executes on approve, and writes an audit row. There is no code path from the sandbox to the network that skips that gate." 3

The privacy policy repeats the point and calls it architecture rather than policy, pointing readers at the source code for proof 6. The processing agreement fills in the rest: credentials encrypted at rest under a key held outside the database, per-customer isolation so that "a credential belonging to one of your clients cannot be used on another's work," tenant isolation enforced at a single fail-closed code path, and an append-only, hash-chained audit log 7. A prompt injection that lands inside a job therefore reaches a handle instead of a token. That is a real design decision, and it is the reason this product is worth an afternoon rather than a paragraph.

It is also a decision that concentrates risk in one place. The design that keeps credentials out of the agent is the design that puts every client's credential in one harness. Mycel publishes that harness, so a buyer can read it 3. A buyer on the hosted plan leaves the running of it to Mycel, and their clients' logins sit in Mycel's harness. The trust a firm extends here is the same trust it would extend to an agency holding the keys to its clients' mail, calendars and books, which is worth saying out loud because the landing page never has to.

At rest, that data stays in London, on AWS and Supabase 67. Model inference, the sandbox each run executes in, the brokered app connections and the image generation do not, and the processing agreement is direct about the remedy: "If you need inference or the sandbox to stay in the UK or the EEA, that is a configuration change. Ask us." 7 The privacy page lists what actually crosses a border, among it the prompt and response of a model call, the files a run works on inside its sandbox, and the specific app call you approved 6.

The evidence offered for all of this is the source code. Neither the privacy policy nor the processing agreement names an independent certification 67. For a product whose customer is about to route client invoices and candidate conversations through it, a repository is a more inspectable artifact than a badge, and it also asks the buyer to do the inspecting.

Two desks depend on the customer supplying something the marketing never mentions. "Connecting a LinkedIn account requires a residential proxy, and you supply it. Every LinkedIn request, including message content, goes through the proxy provider you picked. It isn't our sub-processor and we don't pick it for you, but you should know it is in the path, because we won't connect the account without one." 6 The recruiting and pipeline desks therefore run on a layer the buyer buys, operates and answers for, whose purpose is to make the requests look like they came from a person's home connection.

The meeting recorder carries its own edge. Mycel notes joins a Google Meet, Zoom or Teams call as a visible participant named "Mycel notes (transcript)," records audio only, and keeps a transcript on that person "so the next conversation is better prepared," with Amazon Transcribe turning the audio into text 6. On a client call that is a recording of a client. In recruiting it is a recording of a candidate who agreed to be interviewed by a firm.

Two smaller lookups travel further than their names suggest. When a prospect's stored photo has expired, Mycel asks unavatar.io for a replacement from the public LinkedIn handle, and it asks icons.duckduckgo.com for a company's favicon by domain 6. All of it is written down in the policy. The landing page describes the product as the thing that drafts work and waits for your approval.

Then there is the limit, in the processing agreement, sitting a long way from the list of trades. "Mycel has no data classification layer. Nothing distinguishes a health record from a shipping address, so there is no field-level redaction and no per-field residency. Do not use it for special-category data. We would rather lose the deal than have you assume otherwise." 7 The desks Mycel advertises include recruiting, contracts and bookkeeping. A firm running a recruiting desk handles candidates; a firm running a bookkeeping desk handles transactions. The vendor has drawn a clear line and the marketing has drawn a wide one, and the buyer is standing between them.

One commitment is stronger than most of its peers and belongs in the same breath. "We do not train models on your data, or your customers' data. Not ours, not anyone's." 6 Self-hosting the kernel, the policy notes, leaves only the sub-processors you configure yourself 6.

The headline claim is one upload. "A close, a proposal, a report, a shortlist. Mycel learns how your firm does it," and the page promises that "the third draft needs less than the first" 1. The repository is where the claim turns into something you can check, and it describes the learned part as three things rather than one document: a service definition carrying skills for how the work is done and knowledge for what is true 3.

Two mechanisms in that repository are worth more than the copy on the homepage. A generated service definition cannot author away its own approval gate, so no config file can switch the gate to off or raise its own budget 3. And autonomy inside the product narrows itself as rejections accumulate, and never widens on its own, with a founder's stated claim that contradicts something the system observed being declined rather than averaged in 3. Those are the kind of choices that come from running a service business on the thing before selling it, which is what the README says the team did 3.

The proof offered on the page is three quotes: Mailwarm, which the page labels as YC S20, figr.so, and a customer identified only as "SEO Agency" 1. The product is one day old, so that is the entire published customer evidence. The repository is equally frank about how much of the catalogue is finished. Of the desks listed, the dunning desk is described as "the most complete loop," two entries in the same table are marked internal rather than products, and the README ends on what the kernel cannot yet express 3.

Take it seriously if your firm's bottleneck is one person's approval and your deliverables are written or numeric: reports, closings, redlines, shortlists, chases. The gate is the part of this product that has been thought through hardest, and a gate is the right thing to build when the work belongs to a client who never agreed to hear from a machine. The harness is published, so reading it before trusting it is an option the buyer actually has.

Get four things in writing before a client's work goes through it. What counts as a job, so that the 2,000-job ceiling is a number you can plan a month around 1. What happens at the ceiling in your busiest month, given that the answer on the page is that work waits 1. Which of the providers on the privacy page will touch a specific client's credentials, and whether inference and the sandbox can be moved out of the United States 67. And a written position on special-category data for whichever desk you switch on, because the processing agreement declines it and the desks most likely to collect it are the ones being advertised 7.

Leave it alone if your client work carries health, financial or candidate data as a matter of course, or if you want the promise without the operations. What Mycel sells is the gate and the operation behind it, and on the hosted plan the keys to your clients' accounts are kept on the other side of that gate.