Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
ephemora-cell — Capability-based WASM runtime for executing untrusted AI-generated code with enforced CPU, memory, time, I/O, and filesystem limits. Provides sub-millisecond warm execution, signed execution records, and an MCP server for integration. | Kitploit
Tools/GitHubGitHub/michaels1011/ephemora-cell
Container SecurityDynamic Analysis (Sandboxing)Security VirtualizationCloud SecurityDevSecOpsAPI SecurityAI Security
GitHubmichaels1011/ephemora-cell

ephemora-cell

Capability-based WASM runtime for executing untrusted AI-generated code with enforced CPU, memory, time, I/O, and filesystem limits. Provides sub-millisecond warm execution, signed execution records, and an MCP server for integration.

View Repository
4881241 day agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
Website

Ephemora-cell

Ephemora-cell is an ephemeral, stateless, capability-bound execution boundary for untrusted AI and agent-generated code.

create → constrain → execute → prove → destroy

Every execution starts from a clean state, runs under limits the host granted — fuel, memory, time, I/O, output size, filesystem and network capability — can produce signed evidence of what happened, and ends without carrying execution state into the next run.

The evidence persists. The execution state does not.

Ephemeral. Stateless. Capability-bound. Verifiable.

No execution state or authority is inherited implicitly. Named state is a separate, bounded capability the host wires in on purpose — not execution persistence, and not storage (Stateless by construction).

Built for AI agents, MCP tools, plugins, code interpreters, and other untrusted workloads — the integration path is AI Agent / Application → Tool / Plugin / MCP → Ephemora-cell → WASM module. The picture below draws one execution of it: what the boundary grants, what it denies by default, and what survives.

PyPI Python 3.10+ License: BUSL-1.1 (source-available; each version converts to Apache-2.0 four years after its first publicly available distribution) Public API surface: stable, shipped and machine-gated since 1.0.0 Not a production-security approval for untrusted workloads: independent evaluation pending, and the newest isolation controls are on main — not in the published release GitHub stars

CI Tests — see CI Coverage — see CI Type-checked with mypy — see CI Formatted with black, linted with ruff scheduled WASM fuzz smoke + pip-audit CVE + bandit SAST + OSSF Scorecard in CI WASI conformance

Listed in the official MCP Registry (newest published entry: 1.0.4.3) Glama classification — read it from the live badge

Quick Start · Enforcement · Statelessness · Security evidence · Evaluate · MCP · Benchmarks · Docs

Latest release: v1.1.0 · PyPI · signed GitHub release · BUSL-1.1. Release notes: CHANGELOG.md · supported versions and the 2026-09-24 + 2026-10-02 wasmtime advisory waves against the pinned wasmtime==49.0.0 runtime, triaged with measured evidence: SECURITY.md · latest reproducible measurement: 2026-10-02 interpreter-guest run, benchmarks/results/ · measured counts per installation state: docs/release_assurance.md.

What “stable” is claimed for, and what it is not. Stable here means the public API surface and its release gate: they are shipped, documented and machine-checked. It is not a production-security approval for untrusted workloads — no reviewer has signed off independently yet, the pinned Wasmtime line still carries advisories whose fix wheels are not on PyPI (SECURITY.md), and the newest isolation controls exist on main, not in the published release. Which build carries which control, per commit: docs/release_assurance.md.

One execution: an agent hands untrusted code to the Ephemora-cell capability boundary, which grants explicit capabilities and budgets, denies network and process access by default, and returns a bounded result with a signed record while the execution state is destroyed — create, constrain, execute, prove, destroy

Why this boundary exists

Wasmtime gives you a WASM runtime. Cell builds the application-level boundary around it — WASM is the mechanism, the controlled execution of untrusted code is the product:

Wasmtime:            Ephemora-cell:
    Execute WASM         Execute WASM
                         + define capabilities
                         + enforce budgets (fuel, memory, time, I/O)
                         + bound output
                         + collect execution metadata
                         + produce execution records (sign-ready)
                         + integrate with agents and MCP
Download Tool