StackMap
Subscribe
Explore / ephemora-cell
MichaelS1011

ephemora-cell

Capability-based WASM sandbox for MCP tools and agent-generated code: wasmtime + WASI with fuel, memory, time and I/O caps per run, sub-ms warm execution and signed (JCS/ES256) execution records.

40 5 Python Apache-2.0updated yesterday
securityagents
View on GitHubDispute this mapping →
Curator's take

Use Ephemora Cell when the thing you need to run is small, untrusted and frequent - an MCP tool, a plugin, a snippet the agent just wrote - and you want a receipt: every run returns status, fuel consumed, elapsed ms and the enforced policy in a canonicalized, signable record. 0.17 ms warm start beats any container or microVM by orders of magnitude. The catch is the WASM boundary: your workload has to compile to a .wasm/WASI module, so this is not 'run arbitrary Python or a Docker image'. For full-OS sandboxes (shell, packages, browsers) reach for cubesandbox, forkd, superserve or opensandbox instead; Cell sits *under* an MCP server as an execution primitive, not beside it as a platform. 40 stars, one author - solid tests (424) but treat the signing story as early.

Mapped by ShipWithAI editors · links verified

Continue your stack

What teams reach for next — and why each earns a place beside ephemora-cell. Ranked by curator confidence.

pairs wellpairs wellalternativealternativealternativealternativemcp-context-forgeAdrianCubeSandboxOpenSandboxforkdsuperserveephemora-cell
pairs wellalternativebuilt withpick a node for the why · open it from the panel
Weekly digest
README.md2 min read

Ephemora Cell

Secure execution for untrusted AI-generated code.

Run AI-generated code, MCP tools and plugins inside an enforced capability boundary — explicit resource limits, auditable execution records.

8/8 attack vectors blocked · 424 tests · sub-millisecond warm execution

Built for AI agents, MCP tools, plugins, code interpreters, and other untrusted workloads.

Fast, capability-based WASM execution: CPU, memory, time, I/O and filesystem budgets enforced per execution, with sign-ready execution records (RFC 8785 JCS canonicalization + ES256 sign()/verify() primitives).

PyPI Python 3.10+ License Status GitHub stars

AI Agent → Ephemora Cell enforcement stack → bounded result

The problem

AI agents increasingly need to write and execute code, call tools, and run plugins. The question that decides whether that is safe:

How do you let an agent execute untrusted code without giving that code access to your host, your credentials, your network, or unlimited compute?

AI Agent ──▶ Tool / MCP ──▶ Ephemora Cell ──▶ WASM ──▶ bounded result

Ephemora Cell is a small, capability-based WASM execution runtime for exactly that job: an execution primitive — not an agent framework — that sits underneath your existing agent stack, MCP server, plugin system, or application.

Every execution leaves evidence

Every tool call answers three questions at once — attached to the result as _meta.execution, canonicalized (RFC 8785 JCS) and signable:

Answer Example fields
RESULT what came back status, stdout, exit_code
COST what it cost fuel_consumed, elapsed_ms
POLICY under which rules it ran memory limit, preopens, network policy, wasmtime_version

"Verified. Not claimed." is a data field, not a slogan. Runnable demo: python examples/signed_record_demo.py.

Quick Start

Three commands: install Cell, run something untrusted, read its audited receipt.

1 — Install (use a virtualenv; on Ubuntu ≥ 23.04 / Fedora a bare pip install is refused by PEP 668. Windows: use Git Bash or WSL, and python instead of python3):

python3 -m venv .venv && source .venv/bin/activate
python -m pip install ephemora-cell

2 — Run something untrusted (the repo ships examples, or bring any .wasm):

git clone https://github.com/MichaelS1011/ephemora-cell.git && cd ephemora-cell
ephemora-cell run examples/hello.wasm --isolated

(adds OS-level process isolation around the run, a few ms — recommended for code you didn't build)

Hello from Ephemora Cell!

3 — Read the audited receipt — same run, machine-readable. Here a hostile module (examples/fuel_bomb.wasm) is given a 100-unit fuel budget and stopped, exactly as budgeted:

ephemora-cell run examples/fuel_bomb.wasm --fuel 100 --isolated --json

{
  "status": "fuel_exhausted",
  "exit_code": 0,
  "fuel_consumed": 100,
  "fuel_budget": 100,
  "stdout_bytes": 0
}

Same from Python — every result carries status, cost and captured output: