Wetware

Wetware lets you safely run code you didn't write, don't trust, and cannot see: third-party MCP servers, code your LLM produced at runtime, tools other agents handed you across the swarm. It's a decentralized operating system for multi-tool agent swarms.

Cells are WASM processes that run with zero ambient authority. Their only access to the world is through explicitly granted, typed Cap'n Proto capabilities. Those references can be attenuated to a method allowlist; the restriction travels with the reference across local and libp2p RPC boundaries and recursively confines capabilities returned through it. Argument- and resource-level filtering remain separate, application-level designs. Least privilege is enforced by the runtime, not delegated to a prompt or to the model running inside the cell.

Try it in 60 seconds

curl -sSL https://wetware.run/install | sh
curl http://localhost:2080/status

{
  "status":       "ok",
  "version":      "0.1.0",
  "peer_id":      "12D3KooWRLf8DAFsNfbv3s2DjRMbUuPc8AYdcBfokZbz6kJ2aUss",
  "listen_addrs": ["/ip4/127.0.0.1/tcp/2025", "/ip6/::1/tcp/2025", ...],
  "peer_count":   216
}

The second command hit a WebAssembly cell running inside the daemon. The cell cannot acquire node authority on its own: its parent explicitly granted only host, so it can report peer identity and connected peers. The wiring lives at ~/.ww/etc/init.d/05-status.glia:

(perform host :listen
  (cell (perform :load "bin/status.wasm")
    :grants {:host host})
  "/status")

That's the whole registration.

Here is the capability surface in action, directly in the Wetware shell (Glia):

• defcap defines a capability server in Glia.
• attenuate derives a restricted capability.

;; Define a local capability server with two methods.
(defcap directory
  :lookup   (fn [name]
              (perform routing :find name :count 5))
  :announce (fn [name]
              (perform routing :provide name)
              :ok))

;; Attenuate to a read-only view (lookup only).
(def directory-ro
  (attenuate directory [:lookup]))

Features

• Explicit child grants. Each ordinary cell starts with a typed bundle of capabilities and nothing else. Parent cells choose which capabilities to hand down; method-level restrictions are enforced on the capability reference and on capabilities reached through it.
• Composable membranes. Tool A calls tool B which calls tool C, each link carrying an explicit capability set. The membrane is the boundary at every hop. See examples/oracle/ for the runnable version.
• Content-addressed code. Cells are identified by CID. The binary that ran is the binary you pinned; no swap-under-the-rug between generation and execution.
• WASM cell scale. ~10ms spawn, KB-scale binaries, language-agnostic via wasm32-wasip2. Per-call sandboxing is only feasible because cells are cheap; microVM cold-start is too slow for that.
• P2P capability sharing. A cell can export a typed capability to a peer over libp2p. Service names locate a stream; they do not authorize its caller. A deployer can publish a Terminal that authenticates a login identity and issues only the method authority selected for that identity.
• MCP integration. ww perform install wires the node into Claude Code as an MCP server. The same capability surface you can hit with curl is reachable from an LLM through the grafted membrane. See .agents/prompt.md.
• Glia shell. A Clojure-inspired language where capabilities are first-class values and every side effect (capability calls, exceptions, I/O) is gated by an effect system. The same shell serves humans (REPL) and LLMs (over MCP).

Quickstart

Install

curl -sSL https://wetware.run/install | sh

Or build from source:

ww doctor                         # check your dev environment
rustup target add wasm32-wasip2   # one-time
make                              # build everything (host + std + examples)

Requires a Rust toolchain with the wasm32-wasip2 target. Optional: Kubo for IPFS resolution and DHT-based peer discovery.

Run a node

ww run .                                # boot a node from current dir
ww shell                                # discover a local node, then open REPL

ww shell uses libp2p transport and Terminal(Membrane) auth. By default it discovers local hosts from runtime state and prefers an unambiguous identity match. If multiple hosts remain, TTY sessions prompt for selection, and non-interactive sessions can pass --select <index|peer-id>.

Boot a cell

examples/oracle/ is a working cell with both native vat RPC and an HTTP/WAGI adapter. The vat path is the stateful service surface; HTTP/WAGI is a stateless request adapter for curl/browser infrastructure:

ww run --http-listen 127.0.0.1:2080 --port=2025 std/kernel examples/oracle
curl http://localhost:2080/oracle

Read examples/oracle/README.md for the full walkthrough, including the DHT-based consumer flow.

Use it from an LLM

ww perform install

Wires the node into Claude Code as an MCP server. The LLM gets a Glia shell over the same grafted membrane as the curl flow above. See .agents/prompt.md.

How it works

ww run starts a libp2p node on port 2025, merges any image layers into a virtual FHS filesystem, and spawns trusted boot/main.wasm (pid0) with the full graft-capable Membrane.

Pid0 calls membrane.graft() to obtain host capabilities. Ordinary children instead call initial_grants.get() and receive exactly the immutable List(Export) selected by their parent—no host graft or fallback. After an epoch transition, delegated host capabilities stay stale until an authorized ancestor explicitly re-delegates fresh references or respawns the child.

doc/architecture.md is the canonical reference; doc/capabilities.md is the capability surface.

Cell modes

WASM processes ("cells") run with zero ambient authority. Their stdio is wired to a transport based on WW_CELL_MODE:

Mode	stdio carries	Use case
vat	Cap'n Proto RPC	Long-lived capability services
raw	libp2p stream bytes	Long-lived byte/session protocols
http	CGI (WAGI)	Stateless HTTP request adapters
(absent)	Host RPC channel	pid0 kernel, full membrane graft

The shell

Glia is a Clojure-inspired language where capabilities are first-class values. The design blends three traditions:

• E-lang: capabilities as values you can pass, compose, and attenuate
• Clojure: s-expression syntax, immutable data, functional composition
• Unix: processes, PATH lookup, stdin/stdout, init.d scripts

/ > (perform host :id)
"12D3KooWExample..."
/ > (perform host :addrs)
("/ip4/127.0.0.1/tcp/2025" "/ip4/192.168.1.5/tcp/2025")

See doc/shell.md for the full syntax and capability reference.

Standard ports

Port	Service
2025	libp2p swarm
2026	Local HTTP admin (/healthz, metrics, peer ID, listen addrs); disable with --with-http-admin off
2080	HTTP/WAGI

Publishing a cell

ww init myapp                                # scaffold a new cell project
cd myapp && ww build                         # compile to WASM
ww run .                                     # test locally
ww push . --ipfs-url http://localhost:5001   # publish to IPFS
ww run /ipfs/<CID>                           # run from content-addressed image

Roadmap

• dosync: transactional state management for Glia. Atomic multi-field updates over content-addressed stems. "Every agent gets its own Datomic, as a language primitive."
• ww shell capability discovery: attach a shell to a running node, enumerate cells, call them via Cap'n Proto from Glia.

Learn more

• Positioning: the JTBD-anchored category claim and audience
• Architecture: design principles and capability flow
• Capabilities: the capability model and Cap'n Proto schemas
• CLI reference: full command-line usage
• Shell: Glia shell syntax and capabilities
• Image layout: FHS convention, mounts, on-chain coordination
• Routing: Kademlia DHT and peer discovery
• Keys & identity: Ed25519 identity management
• RPC transport: transport plumbing and scheduling model
• Guest runtime: async runtime for WASM guests
• Replay protection: epoch-bound authentication
• Examples: echo, counter, oracle, chess, discovery, and snap-hello-rs