ACT — Agent Component Tools

The problem

Third-party tools come with full access

✕npx / uvx / curl | bash run as you
✕SSH keys, .env, browser cookies all reachable
✕No declared bounds, no enforced ceiling
✕Provenance opaque — what's actually running?

The ACT way

Bounded blast radius, by construction

✓Sandboxed by wasmtime — zero ambient access
✓Capability ceiling declared at build time, enforced by host
✓Signed OCI artifacts with attested provenance
✓Content-addressed — pinned by digest, signed to its build

How it works

Write

Build your tool in Rust or Python with a first-class SDK — or in any of ten more languages that reach the Component Model.

#[act_tool](description = "Search the index", read_only)
fn search(query: String) -> ActResult<String> {

Build

Compile to a single .wasm component. Self-documenting — schemas, descriptions, examples baked in.

$ cargo build --target wasm32-wasip2
  Compiling my-tool v0.1.0
  Finished: my-tool.wasm (312 KB)

Ship

Push to an OCI registry, signed with keyless cosign in CI. Pull-and-run on any host with one command.

$ act-build push my-tool.wasm actpkg.dev/me/my-tool:1.0
$ act run actpkg.dev/me/my-tool:1.0 --mcp \
    --allow wasi:http

Why ACT

Sandboxed

WASM isolation with zero ambient access. No filesystem, no outbound network, no syscall surface — only what the operator explicitly grants.

Capability ceiling

Components declare what they need at build time. Operators grant what they're willing to give. The host enforces the intersection — neither side can escalate past the other.

Signed lineage

Every published component is signed with keyless cosign over GitHub’s OIDC token, binding the artifact to the workflow that built it. Verifiable provenance, no signing key to leak.

Pinned & verifiable

Every artifact is content-addressed and resolvable by digest, with a signature binding it to the workflow that built it. Audit once, then deploy that exact digest.

Self-documenting

Schemas, descriptions, usage hints, examples, embedded agent skills — all baked into the binary. Agents (and humans) read it without running the component.

Twelve languages

Rust and Python with an SDK; C, C++, Zig, Go, C#, Java, Kotlin, Scala, D, Lua and PHP verified end-to-end. The ceiling is enforced by the host, so the security model is identical across all of them.

Hardened AItoolchain