Ephemora-cell runs untrusted, AI-generated code inside a WebAssembly (WASM) and WASI sandbox built on Wasmtime, with the host deciding per execution what the guest may reach. Each run starts from a clean state, executes under budgets for fuel (CPU), memory, wall-clock time, I/O, and output size, can emit a signed record of what happened, and carries no execution state into the next run. It targets AI agents, MCP tools, plugins, and code interpreters, and ships as a Python library, a CLI, and an MCP server.
By default the guest gets no network, no filesystem beyond explicitly preopened directories, no process spawning, and no unrestricted environment. Defaults are 128 MB of WASM memory, a fuel budget of 1,000,000, a 30 second timeout, and 10 KB of captured output, and every WebAssembly proposal the shipped WASI surface does not need (threads, GC, exceptions, tail calls) is switched off in the engine config. Failures come back as graded statuses (fuel exhausted, memory exceeded, timeout, non-zero exit) rather than crashes, and an isolated mode adds a disposable worker process with OS-level limits and a hard kill.
Every result attaches an execution record covering status, cost (fuel consumed, elapsed time), and the policy it ran under (memory limit, preopens, network policy, Wasmtime version), canonicalized with RFC 8785 JCS and signable with DSSE so that editing any field fails verification. Third-party tools can be required to ship an Ed25519-signed manifest whose signature and module hash are checked before the module is registered, and an agent can only propose a tool for the host to approve. Egress, where an operator opens it, is granted per URL and redirect hop by signed grants that narrow an operator allowlist, with loopback, private, link-local, and metadata addresses refused at resolve time.
The MCP server is a stdio process in which each tools/call starts a fresh sandbox while the server itself stays long-lived. Clients such as Claude Desktop, VS Code with Copilot, Codex, or LM Studio connect to it, tool results include the execution record and an optional attestation signature, and a get-policy tool reports the per-tool policy from the same code path that enforces it. Integration suites run against Hermes and NemoClaw in CI, with example integrations for LangGraph, CrewAI, AutoGen, OpenAI Agents SDK, and Semantic Kernel.
Measured overhead on the reference host is 0.376 ms warm wall-clock per sandboxed run, about 0.5 ms per call on a pooled engine and about 12 ms per MCP call with a fresh sandbox. Any language that compiles to WASM runs, with Rust, Go, C, AssemblyScript, and Zig gated in CI and Python supported as a bring-your-own interpreter guest. It is not a persistent workspace, VM, container replacement, malware detector, or agent framework: hostile code that stays within its budgets still runs, and exfiltration through a granted capability remains the integrator's concern.
Features
- Capability-bound execution: no network, filesystem, process, or environment access unless the host grants it, with every grant recorded in the run
- Budgets with exact accounting: fuel stops a loop at its budget, plus memory, wall-clock, output, and host I/O walls (defaults 128 MB, 1,000,000 fuel, 30 s, 10 KB)
- Stateless runs: no sandbox directory, engine state, or authority survives a run, and named state crosses runs only through a bounded host-held StateStore
- Signed execution records: status, cost, and policy canonicalized with RFC 8785 JCS and signable with DSSE, so one edited field fails verification
- Graded failures: fuel exhausted, memory exceeded, timeout, and non-zero exit come back as statuses with their receipt, consumable by an auto-grader
- Isolated mode: a disposable worker process with OS rlimits and a hard termination for modules from outside your own build
- MCP server: a long-lived stdio server where each tools/call runs in a fresh sandbox, with per-call records, optional attestation, and a get-policy tool
- Signed tool manifests: Ed25519-signed manifests verified on signature and module hash before a tool registers, with agent-proposed tools held for host approval
- Mediated egress: signed grants per URL and redirect hop that narrow an operator allowlist, with private and metadata addresses refused at resolve time
- Budget profiles: plugin, llm, edge, default, analytical, and interpreter presets, the last for bring-your-own interpreter guests
- CLI verbs: run, inspect, benchmark, build (Rust, Go, C, AssemblyScript, Zig to WASM), and ledger for verifying a run chain
- GitHub Action: a composite action for gating untrusted pull-request code in CI
