michaels1011/ephemora-cellCapability-based WASM runtime for executing untrusted AI-generated code with enforced CPU, memory, time, I/O, and filesystem limits. Provides sub-millisecond warm execution, signed execution records, and an MCP server for integration.
Ephemora-cell is an ephemeral, stateless, capability-bound execution boundary for untrusted AI and agent-generated code.
create → constrain → execute → prove → destroy
Every execution starts from a clean state, runs under limits the host granted — fuel, memory, time, I/O, output size, filesystem and network capability — can produce signed evidence of what happened, and ends without carrying execution state into the next run.
The evidence persists. The execution state does not.
Ephemeral. Stateless. Capability-bound. Verifiable.
No execution state or authority is inherited implicitly. Named state is a separate, bounded capability the host wires in on purpose — not execution persistence, and not storage (Stateless by construction).
Built for AI agents, MCP tools, plugins, code interpreters, and other untrusted workloads — the integration path is AI Agent / Application → Tool / Plugin / MCP → Ephemora-cell → WASM module. The picture below draws one execution of it: what the boundary grants, what it denies by default, and what survives.
Quick Start · Enforcement · Statelessness · Security evidence · Evaluate · MCP · Benchmarks · Docs
Latest release: v1.1.0 · PyPI · signed GitHub release · BUSL-1.1. Release notes: CHANGELOG.md · supported versions and the 2026-09-24 + 2026-10-02 wasmtime advisory waves against the pinned wasmtime==49.0.0 runtime, triaged with measured evidence: SECURITY.md · latest reproducible measurement: 2026-10-02 interpreter-guest run, benchmarks/results/ · measured counts per installation state: docs/release_assurance.md.
What “stable” is claimed for, and what it is not. Stable here means the public API surface and its release gate: they are shipped, documented and machine-checked. It is not a production-security approval for untrusted workloads — no reviewer has signed off independently yet, the pinned Wasmtime line still carries advisories whose fix wheels are not on PyPI (SECURITY.md), and the newest isolation controls exist on main, not in the published release. Which build carries which control, per commit: docs/release_assurance.md.
Wasmtime gives you a WASM runtime. Cell builds the application-level boundary around it — WASM is the mechanism, the controlled execution of untrusted code is the product:
Wasmtime: Ephemora-cell:
Execute WASM Execute WASM
+ define capabilities
+ enforce budgets (fuel, memory, time, I/O)
+ bound output
+ collect execution metadata
+ produce execution records (sign-ready)
+ integrate with agents and MCP