astrid
starsforks
How to install astrid?
astrid-runtime/astrid
$git clone https://github.com/astrid-runtime/astridA portable, capability-secure operating system for composable software.
README.md
| 1 | # Astrid |
| 2 | |
| 3 | **A portable, capability-secure operating system for composable software.** |
| 4 | |
| 5 | [](https://github.com/astrid-runtime/astrid/actions/workflows/ci.yml) |
| 6 | [](https://github.com/astrid-runtime/astrid/actions/workflows/codeql.yml) |
| 7 | [](#license) |
| 8 | [](https://www.rust-lang.org) |
| 9 | [](https://www.rust-lang.org) |
| 10 | [](https://github.com/astrid-runtime/book) |
| 11 | |
| 12 | --- |
| 13 | |
| 14 | Astrid treats a component the way an operating system treats a process. Every |
| 15 | ability is a sealed WebAssembly **capsule**: it can be composed with other |
| 16 | capsules, granted only explicit authority, and replaced without expanding its |
| 17 | reach. Astrid is independent of any particular product, model provider, agent |
| 18 | loop, user interface, or distribution. |
| 19 | |
| 20 | The kernel underneath is small and deliberately dumb. It routes events, |
| 21 | enforces capabilities, runs the sandbox, and records the audit trail; it holds |
| 22 | no model, tool schema, or business logic. A jailbreak, poisoned tool, or plain |
| 23 | bug still cannot read a file, reach a network, or spawn a process outside its |
| 24 | grant. Authority is a capability the kernel enforces, not an instruction the |
| 25 | model is trusted to follow. |
| 26 | |
| 27 | ## Quick start |
| 28 | |
| 29 | ```bash |
| 30 | brew tap astrid-runtime/tap && brew install astrid |
| 31 | astrid init --distro @yourorg/your-distro |
| 32 | astrid start |
| 33 | astrid status |
| 34 | astrid capsule list |
| 35 | ``` |
| 36 | |
| 37 | Astrid Runtime does not select or bundle a product distro. Choose a distro you |
| 38 | trust and pass its name, repository, local `Distro.toml`, or signed `.shuttle` |
| 39 | archive explicitly with `--distro`. Operators running an uncomposed runtime can |
| 40 | skip `init` and start the daemon directly. |
| 41 | |
| 42 | Start with [the Book](https://github.com/astrid-runtime/book) for the |
| 43 | architecture or the [Contributor Handbook](https://github.com/astrid-runtime/handbook) |
| 44 | to contribute. |
| 45 | |
| 46 | ## Why Astrid exists |
| 47 | |
| 48 | Agent frameworks put trust in the prompt. Astrid puts it in the runtime. An agent is untrusted code |
| 49 | executing on your machine with access to your files, your network, and your credentials. Telling it |
| 50 | to behave is not a security boundary. An OS-grade boundary is. |
| 51 | |
| 52 | - **Cryptographic capability model.** Every file path, network host, and tool is a signed ed25519 |
| 53 | grant scoped to a resource pattern, principal-bound, expiry-checked, and globally revocable. No |
| 54 | grant, no access. |
| 55 | - **WASM sandbox with no ambient authority.** Capsules run in Wasmtime with no syscalls, no file |
| 56 | descriptors, and no host memory. Every external effect is a capability-checked host call over a |
| 57 | WIT-typed ABI. |
| 58 | - **The kernel is dumb.** It instantiates an event bus, loads capsules, and routes IPC bytes under a |
| 59 | capability ACL. It has no LLM handles, no conversation state, and no tool registry. All |
| 60 | intelligence lives in capsules, so a capsule bug cannot corrupt shared kernel state. |
| 61 | - **Per-principal everything.** Each identity gets isolated capsule access, KV data, secrets, home |
| 62 | directory, quotas, and audit chain. One principal can never read another's namespace, and it fails |
| 63 | closed if the caller cannot be resolved. |
| 64 | - **Signed, hash-linked audit chain.** Each entry seals the hash of the one before it and is signed. |
| 65 | Break the chain and the tampering shows. |
| 66 | - **Live capsule lifecycle.** Install, upgrade, and remove capsules on a running daemon. No restart. |
| 67 | |
| 68 | ## How it works |
| 69 | |
| 70 | Frontends (the CLI, the HTTP gateway, Discord, and so on) are **uplinks**: protocol clients that |
| 71 | connect to the daemon over a Unix domain socket and speak in IPC events. There is no `Frontend` |
| 72 | trait. An uplink publishes events and receives responses like any other bus participant. |
| 73 | |
| 74 | ```mermaid |
| 75 | fl |
People who liked this also viewed
6 picksType
- mcp-proxy-for-awsAWS MCP Proxy ServerMCP ServersJul 2026
- pydantic-ai-backendFile Storage & Sandbox Backends for Pydantic AI: console tools for file operations, Docker-isolated sandboxes for safe execution, and permission system with presets for access control. Enables secure multi-user handling and testing in agents via in-memory, local, or containerized storage.MCP ServersJul 2026
- mcp-for-argocdAn implementation of Model Context Protocol (MCP) server for Argo CD.MCP ServersJul 2026
- heroku-mcp-serverHeroku Platform MCP Server using the Heroku CLIMCP ServersJul 2026
- ghost-mcpA Model Context Protocol (MCP) server for interacting with Ghost CMS through LLM interfaces like Claude. Allow you to control your Ghost blog by simply asking Claude etc.MCP ServersApr 2026
- Google DriveUpload, organize, and share files in the cloud. Manage folders, set permissions, and search across stored documents.MCP Serversrecently
