Sandboxed skills

Language-agnostic skills and MCP tools, isolated by default.

The WASI 0.2 component runtime for executing community-supplied agent skills, MCP tools, and A2A skill components in a deterministic, capability-based sandbox. Language-agnostic, content-addressable, audit-ready.

Overview

Where untrusted code runs under explicit capabilities.

A skill or tool is shipped as a `.wasm` component alongside a manifest that declares its identity, the host interfaces it depends on, and the capabilities it requests. The runtime verifies the manifest's content hash, runs the component under Wasmtime fuel metering and epoch interruption, and returns an execution receipt that chains into Tenzro's settlement receipts.

Capabilities

What the runtime guarantees.

Language-agnostic

Compile from Rust, TypeScript / JavaScript, Go, AssemblyScript, Python, or any other language with a WASI 0.2 target.

Capability-based sandbox

Components start with no filesystem, no network, no environment. Capabilities granted explicitly via the manifest.

Deterministic fuel metering

Wasmtime fuel + epoch interruption produces reproducible cost reports independent of wall-clock time.

Content-addressed identity

Every component is identified by its SHA-256 hash. On-chain skill / tool registries pin exact bytes.

Execution receipts

Each invocation returns an ExecutionReceipt with content hash, function, input + output hashes, outcome, and fuel report.

Host-mediated tenzro:* interfaces

Components see WASI 0.2 plus a small set of tenzro:* interfaces (config, events, metrics) mediated by host policy.

Agent-kit integration

Skills with runtime: agent-skill dispatch through the sandbox instead of native Rust / Python paths.

MCP tool host

Community MCP tools ship as components; the node executes them in-process under capability checks.

Lifecycle

How a component runs.

01
Manifest
Component author publishes a ComponentManifest declaring id, version, content_hash_hex, runtime, capabilities, deadline, fuel_limit.
02
Registration
Host calls register_component(manifest, bytes). The runtime verifies the SHA-256 hash and admits the component to its registry.
03
Capability gate
Every host_method the manifest requests is checked against the host's policy. Unauthorized methods fail closed at load.
04
Invocation
Host calls invoke(component_id, function, input, caller_did). The runtime instantiates, runs under fuel + deadline, returns output + receipt.
05
Receipt
The ExecutionReceipt carries the content hash, input/output hashes, outcome, and fuel report. Chains into Tenzro ReceiptEnvelope records.

Specifications

Standard: WASI 0.2 component model
Runtime: Wasmtime with fuel metering + epoch interruption
Identity: SHA-256 content hash
Defaults: Deny-all storage, network, environment
Embed points: tenzro-agent-kit (skill runtime), tenzro-node (MCP tool host)
Crate: tenzro-wasm

Agents→

Settlement→

Identity→

Get started

Ship on the open network.

Start building

Sandboxed skills docs