Wire

██╗    ██╗██╗██████╗ ███████╗
██║    ██║██║██╔══██╗██╔════╝
██║ █╗ ██║██║██████╔╝█████╗
██║███╗██║██║██╔══██╗██╔══╝
╚███╔███╔╝██║██║  ██║███████╗
 ╚══╝╚══╝ ╚═╝╚═╝  ╚═╝╚══════╝
        BOUNDED EXECUTION

Rust execution core · typed TypeScript tools · signed admission

v1.0.0 source release · AGPL core / MIT integrations · sealed 2026-10-30; performance cleared

Wire puts bounded parsing, Ed25519 budgets, rate limits, schemas and a pure-output cache behind one native boundary. @wire-runtime/sdk and @wire-runtime/cli connect these tools to local MCP clients. The archive name does not establish production clearance or npm publication.

The problem

Tool servers repeatedly decode JSON, allocate transient objects and serialize responses. Large frames and unrestricted handlers amplify memory use. Permissive adapters can lose session identity or skip admission. Language runtimes, pipes and editor rendering add costs beyond parsing. Wire isolates native work and makes its resource and trust boundaries explicit.

Related MCP server: fde-assessment

Architecture

JavaScript serialization and handlers allocate. Node/V8, JIT compilation, stacks and host state are outside the guest memory ceiling. JavaScript handlers and native administration are trusted.

Performance with scope

Latest controlled Windows x64 measurements (2026-10-30): Rust 1.94.0 GNU, native AVX2/FMA, least-busy-core pin, HIGH_PRIORITY_CLASS for the runner and EcoQoS disabled for the child. Latest gate outcome: PASS on every gate, in two consecutive controlled runs (fresh-signature upper95 43.1371 us and 48.7001 us against the strict <50 us bound). No threshold was relaxed and no sample was discarded; the audit lists all seven attempts, including the two that an externally loaded host invalidated. Upper bounds apply to the mean's 95% confidence interval, not individual request deadlines.

Standalone signed core peak RSS is 4,968,448 bytes (4.74 MiB), the highest of five 100-process runs on 2026-10-30 (three reported an identical 4,964,352-byte peak; two added a single 4 KiB page). The strict <7.20 MiB gate passes with 2,581,299 bytes (2.46 MiB) of headroom against its integer-byte cutoff. This is an observed Windows working-set peak, not an OS memory cap. Guest linear memory is bounded to 239 pages, strictly below 15 MiB. Node's process RSS is separate: SDK 46.15 MiB and direct native 44.51 MiB after 510,001 calls; both sustained-growth checks pass. The optional Wasmtime compiler's host RSS is outside the guest ceiling.

The requested 12.16 us parse and 54.66 us cache figures are historical targets, not substituted for these measurements. No controlled Python/Node parser/full-call comparison is available. CPU flags and cached keys do not guarantee a wall-clock deadline under arbitrary host load. Workspace defaults and the native build helper enforce host CPU tuning. Native artifacts require the build host CPU features; platform and architecture matching alone does not establish CPU compatibility. Use python scripts/performance.py benchmark for the host-native gate. The configuration behind the published numbers is --cpu auto --high-priority --performance-mode --cooldown 120: it probes every logical CPU, pins the least busy one, raises the runner's priority class without any privilege, disables EcoQoS for the child, and idles after compilation so the package returns to its cool turbo bins before the first timed sample. POSIX runners can add --nice -10; --cpu 7 --above-normal reproduces the earlier configuration. Windows-only scheduling switches are optional and never change system power policy. Seven attempts and their conditions are recorded in the audit: two failed only because an unrelated process stalled ~580 ms of a four-second window or held the package at a lower clock, and no gate was adjusted afterwards.

Native executors raise the calling thread only for the duration of a transaction with THREAD_PRIORITY_TIME_CRITICAL on Windows, SCHED_FIFO (falling back to nice -10 when unprivileged) on Linux, and QOS_CLASS_USER_INTERACTIVE on macOS. Escalation is lazy and scope-scoped: rt::elevate() is entered immediately before signature verification or IPC frame processing and its guard restores the previous thread class on drop, including unwind paths. initialize also runs a bounded strict Ed25519 warm-up (WIRE_PREWARM_MS, default 25 ms, 0 disables) before publishing the engine. Affinity is opt-in with WIRE_PIN_CPU=<index> and every hook is disabled with WIRE_RT=off. schedulingStatus() reports the active class without mutating it. These hooks reduce scheduler and P-state jitter; they cannot create a wall-clock deadline on a saturated host. The 2026-10-29 post-hook runs and the 2026-10-30 re-measurement are recorded in the audit report.

Idle behavior. No polling loop, timer, sleep or background thread exists in the runtime path: an idle dispatcher sits in its caller's blocking read and contributes 0.0% CPU between transactions. Wasm guest execution is joined per invocation and never outlives the call; the express-mcp SSE keepalive is unref'd so it cannot hold a process open. Elevation, cache and nonce state are released when the guard drops, so no priority, affinity or timer state survives the completed transaction.

Build and quickstart

Use Rust 1.94.0, Node >=20 and pnpm 9.15.0. CI selects Node 24.22.1. The core without sandbox retains MSRV 1.85; Wasmtime 36 needs >=1.86. Windows release addons need MSVC build tools and Windows SDK. Verification tooling uses Python >=3.11 and PyYAML==6.0.3. This source archive contains no native modules, npm tarballs, dependency stores or build caches.

pnpm install --frozen-lockfile
node scripts/native.mjs build
pnpm build
pnpm typecheck
node scripts/native.mjs native-tests
pnpm test

The SDK loads a matching platform package or the locally built packages/sdk/native/ fallback. Supported release targets: Linux x64/ARM64 glibc >=2.28, macOS ARM64, Windows x64 MSVC. Installation never compiles native code. All four native CI runners must pass before publication.

For a local consumer, pack your verified build instead of assuming the npm namespace is published:

mkdir release-packages
pnpm --dir packages/sdk pack --pack-destination ../../release-packages
pnpm --dir packages/cli pack --pack-destination ../../release-packages
# Select the directory matching your local verified native build:
pnpm --dir packages/native/linux-x64-gnu pack --pack-destination ../../../release-packages
node packages/cli/dist/index.js init demo --yes
cd demo
# Replace these with absolute paths to the three tarballs just built:
npm install --ignore-scripts /ABS/sdk.tgz /ABS/cli.tgz /ABS/native.tgz @sinclair/typebox@0.34.52
npm run dev

wire dev --calls 2 --metrics demonstrates native exhaustion through a loopback development console. Its signing keys are ephemeral. wire build emits dist/tools.mjs and dist/server.mjs. Production startup requires externally issued credentials and independently configured trust.

Quick-start and integration templates

Build the native addon and TypeScript packages once, then run any template check from the repository root. The checks use the local SDK/addon and contact no network.

node scripts/native.mjs build
pnpm build

node templates/claude-desktop/verify.mjs     # MCP handshake + tampered-token rejection
npm --prefix templates/agent-harness test     # two tool calls + native budget debit
node templates/express-mcp/smoke-test.js      # HTTP/SSE wrapper + JSON-RPC framing

Outside this repository the primary @wire-runtime/sdk import resolves the published SDK and its matching platform package; the relative fallback is only for this checkout. One loaded addon instance is one trust domain: run N agents as N processes, each with its own token, session and trust map. See Security and threat model.

Production credentials

On the issuer's separate trusted machine, run wire budget keygen --out issuer-keys, then wire budget mint --key issuer-keys/private.pem --session <32-lowercase-hex> --calls 1000 --ttl 3600 --key-id 7 --out budget.bin. Deliver only the raw 112-byte token, independently established session identity and public-key trust map to the runtime. Keep private keys with the issuer.

Set these values through the process supervisor or editor configuration:

WIRE_BUDGET_FILE=/ABSOLUTE/PATH/secrets/budget.bin
WIRE_SESSION_ID=<independently-authenticated-32-lowercase-hex>
WIRE_TRUSTED_KEYS_FILE=/ABSOLUTE/PATH/secrets/trusted-keys.json
WIRE_SESSION_GUARD_DIR=/ABSOLUTE/PATH/durable-session-guard
WIRE_PROTOCOL=mcp
WIRE_TELEMETRY=0
WIRE_RT=on
WIRE_PREWARM_MS=25

WIRE_RT=off disables the per-thread scheduling hooks, WIRE_PREWARM_MS bounds the Ed25519 warm-up (default 25, 0 disables) and WIRE_PIN_CPU=<index> opts into affinity.

The trust-map format is {"7":"<64-lowercase-hex-public-key>"}. Invalid signatures, expiry and missing credentials fail startup. Precreate the restricted durable guard directory. Exclusive, verified session markers prevent restarting a process from restoring a spent allowance. Preserve markers and issue a fresh session after restart. Replicas need deliberately partitioned allowances. Without a durable guard or external accounting, replay protection remains process-local.

Codex CLI, Claude Desktop, Cursor and VS Code

1. Build the app and provision credentials above. Use absolute paths for Node, dist/server.mjs, credentials and guard directory. Escape backslashes in Windows JSON paths.

2. Copy or merge the matching configuration below, replacing every placeholder.

3. Reload the client and confirm Wire's tool list. Approve a harmless call, then test exhaustion and restart rejection with a test session before assigning a production allowance.

The bounded legacy MCP adapter negotiates 2025-11-25, 2025-06-18, 2025-03-26 or 2024-11-05 and supports initialize/initialized, ping, tools/list and tools/call. Modern 2026-07-28 MCP is not implemented. Clients must negotiate a supported version. Templates cannot guarantee editor roundtrip latency; stdio pipes and MCP serialization have separate costs.

Configuration references: Claude Desktop, Cursor, VS Code, Codex MCP. Live client UI acceptance remains an operator check.

Enterprise Docker and Kubernetes

Use templates/ecosystems/enterprise/ with a complete app context: package lockfile, production dependencies, built app and verified matching native package. Build the Dockerfile with a verified immutable NODE_IMAGE digest for your architecture. Replace image digests, per-session Secret and PVC names in sidecar.yaml, render the manifest and run cluster validation before applying it.

The sidecar serves bounded local Unix RPC and loopback Prometheus at 127.0.0.1:9464/metrics. prometheus.yaml supports a same-pod scraper; the OpenTelemetry collector forwards local scrapes. Container limits include Node/JIT overhead. Templates use non-root users, read-only roots, dropped capabilities, runtime-default seccomp and default-deny networking. Supply narrowly scoped required egress. Actual image builds and cluster acceptance need real deployment runners. The gateway is local Wire JSON RPC, not a public MCP/HTTP endpoint. Route application calls through the pod-local socket, provide app tools at dist/tools.mjs, and keep telemetry loopback-only. Rotate sessions after restarts; never delete guard markers to recover an allowance.

deploy/ contains the single-host production manifests: wire-runtime.service sets Nice=-20, CPUSchedulingPolicy=fifo, priority 99 and CPUAffinity=2; docker-compose.yml sets cpuset, read-only roots, dropped capabilities and a 7.20 MiB native-probe gate. Run deploy/verify-deployment.sh --static anywhere to check the invariants; --container also builds the probe, checks Docker's memory limit and cgroup memory.max, and executes the binary inside the 7.20 MiB cgroup. A Node gateway cannot run in 7.20 MiB, so its ceiling is 96M; the 7.20 MiB limit applies only to the measured 4.74 MiB standalone core.

Security and threat model

Confused deputy: admission checks issuer trust and independent session identity; cache keys include authorization scope and policy generation. Budgets limit calls, not arbitrary business permissions. Handlers must authorize each actual resource.

Process per trust domain: one loaded addon instance owns one initialized trust domain and one authenticated session; initialize is single-use. Run N agents as N processes or containers, each with its own signed token, session id, trust map and durable guard directory. Replicas require deliberately partitioned allowances; do not clone a shared allowance across processes.

Prompt injection: signed allowances, rate limits, schemas and explicit sandbox capabilities bound tool activity. They cannot identify all malicious natural-language instructions. Treat tool results/descriptions as untrusted, retain client approvals and enforce handler authorization.

Resource exhaustion: bounded frames, fixed ledgers/cache/pending slots, atomic allowance debits and guest fuel/memory limits constrain their respective layers. Trusted handlers, compilation and OS exhaustion still need process/container supervision.

Panic containment: exported work uses unwind guards; poison fails closed. Allocation failure, abort, external termination and native undefined behavior cannot be recovered by catch_unwind. Fault injection is test-only and excluded from production prebuilds. Never commit live credentials.

Security reporting

Report suspected vulnerabilities privately through GitHub Security Advisories (Security → Advisories → Report a vulnerability). If private reporting is unavailable, contact the maintainers at security@wire.example; repository owners must replace this placeholder with a monitored security mailbox before publication. Do not open a public issue, pull request or discussion for an undisclosed vulnerability.

Include the affected Wire version or commit, operating system and architecture, configuration, reproduction steps, observed impact and any suggested mitigation. Do not attach live signing keys, budget tokens, session identifiers or customer data. Maintainers will acknowledge the report, triage it privately, coordinate a fix and disclosure timeline, and credit reporters who request attribution once a coordinated disclosure is agreed.

Verification and packaging

python scripts/release.py audit
python tests/performance.py
cargo test --workspace --features wire-core/sandbox,wire-core/telemetry --locked
cargo run -p wire-core --release --example parser_stress --locked
python scripts/performance.py benchmark
node --max-old-space-size=32 --max-semi-space-size=2 --expose-gc scripts/native.mjs rss-native
python scripts/release.py package

Template and deployment checks:

node templates/claude-desktop/verify.mjs
npm --prefix templates/agent-harness test
node templates/express-mcp/smoke-test.js
deploy/verify-deployment.sh --static      # use Git Bash on Windows

deploy/verify-deployment.sh --container requires Docker and additionally validates Docker's memory limit, the cgroup memory.max and probe execution; the static mode validates the manifests without a container runtime.

The public harness contains exactly four runners:

tests/performance.py checks strict gate rejection behavior. Workflows call these runners directly. Build the standalone probe with cargo build -p wire-core --release --features std --bin core_memory_probe --locked, then run python scripts/performance.py rss target/release/core_memory_probe (append .exe on Windows). The RSS runner fails at or above 7.20 MiB; the separate guest-memory bound remains 239 pages.

Trusted verification keys are decoded once and stored immutably. Fresh signature computation reads them without a key-cache lock and runs outside the session ledger mutex. Registration rechecks the clock and token ledger before insertion; simultaneous registration cannot reset spent counters. Admission accounting and the FFI engine retain synchronization for joint state changes.

The campaign defaults to 5,000,000 deterministic inputs with available SIMD/scalar parity checks. Guard pages, forgery/replay tests, hostile guests, concurrent FFI fault injection and supported Unix transport checks complement it. Finite tests do not prove freedom from all defects. Publication requires exact-commit native-release and production-validation success. Standalone core RSS, guest limits, Node stability and latency are distinct gates; the latency gate is now green in two consecutive controlled runs on this host and toolchain. A failed required gate remains blocking; acceptance on other operating systems, container runtimes and live editors is still pending.

Component licensing and contributions

This distribution uses two component licenses, rather than offering an unrestricted choice of licenses for the entire runtime:

MIT wrappers do not relicense the AGPL native addon they load. Distributing a combined application must preserve applicable component obligations and upstream notices. Third-party licenses remain intact in third-party-licenses/, platform package license folders and LICENSES/THIRD_PARTY_NOTICES.txt. Strict JSON stays valid; REUSE.toml supplies component-specific SPDX annotations instead of injecting comments or unknown schema properties.

Contributions require permission to contribute under the destination component's license and DCO sign-off (git commit -s, real contributor identity, Signed-off-by: Name <email>). The maintainer also requires an executed CLA before merging external contributions. It must identify the contributor, actual recipient legal entity, covered work, granted rights and signatures. DCO does not replace the CLA; no unsigned submission implies copyright assignment. The maintainer supplies the operative agreement. Do not relicense third-party contributions without authority. Keep changes reviewable and run the checks below.

Codex modes and transport contract

The template was checked against Codex CLI 0.163.0-alpha.11.1 and current official MCP docs. After replacing absolute paths and provisioning credentials, verify discovery with codex mcp list. Use codex --sandbox read-only --ask-for-approval on-request for review and codex --sandbox workspace-write --ask-for-approval on-request for editing. Unattended jobs can use codex exec --sandbox workspace-write --ask-for-approval never inside an appropriately restricted runner; failures return to the caller. Check codex exec --help for your installed version. The historical --suggest, --auto-edit and --full-auto switches are absent in the verified CLI. codex_env.json is not a native Codex configuration format; the supplied TOML is the supported launch/environment mapping. .codexrules is a compatibility note; Codex reads AGENTS.md. Instructions guide tool selection. They cannot disable arbitrary other tools: server-side signed admission and OS policy enforce the actual trust boundary.

MCP clients exchange newline-delimited JSON over standard pipes. Wire's synchronous N-API buffer ABI is binary internally; it does not turn MCP stdio into end-to-end zero-copy transport. The stdio adapters share the same native admission checks. No signing key is passed to an editor. See official Codex MCP configuration and CLI command reference.

All editor and Docker launch examples set --max-old-space-size=32 --max-semi-space-size=2. These tune V8's heap/young-generation collection thresholds; they do not cap process RSS or force GC in an embedding process. Native output, control and diagnostic buffers are allocated once per dispatcher. Tickets and returned replies keep independent ownership across asynchronous calls. Runtime configuration bounds request/output buffers, cache entries and native pending slots. Node stability tests execute 510,001 calls and reject more than 8 MiB sustained growth between the first and last measured batches. Operators must still bound handler concurrency/work and use supervisor/container memory limits appropriate to V8 overhead.

Rust sandbox lifecycle

Enable wire-core/sandbox for the pinned Wasmtime/wasmtime-wasi 36.0.19 packages. Default normal dependencies exclude them. Retain a lazy Sandbox; compile trusted registered tool binaries (<=1 MiB, fuel 1..=10,000,000) once. Bind ModuleGrant entries to the exact immutable compiled handles and trusted key policy. Retain one BudgetAuthority<N> per trust domain. authorize(token, independently_authenticated_session, tool, capabilities) debits a call and returns a single-use InvocationPermit; consume it using Sandbox::execute.

Every invocation creates a fresh store, globals, memory and WASI state. The export ABI is (i64) -> i64; wire.call(i32, i64) -> i64 invokes explicit capability bits 0..63 through a trusted host bridge. No unchecked guest pointer crosses that interface. Requested rights must fit both the issuer's module grant and compiled tool policy. Failed calls still consume budget.

Guest linear memory is limited to 239 pages (15,663,104 bytes), one memory/instance/table, 1024 table elements, and a 256 KiB guest stack. Initial allocation and growth are checked; denied growth fails the call even if ignored by guest code. WASI arguments/environment are empty; filesystem, sockets, DNS, inherited stdio, clocks and entropy imports are denied. Only a narrow Preview 1 import allowlist and explicit bridge are available. Threads, GC, memory64, shared/multiple memories and unknown imports are denied by policy/feature selection.

Fuel charges guest instructions including start functions, not compiler or trusted callback work. The host must bound compilation counts, callbacks and wall time. release-sandbox enables unwind containment; abort/OOM cannot be caught. A 239-page guest bound is not a <15 MiB Wasmtime host RSS guarantee: JIT code, WASI metadata, stacks and compiler state consume separate host memory. core_memory_probe measures a standalone signed native engine with 64 cache entries, 32 pending slots, 16 KiB frame/output bounds and 100,000 calls, excluding the optional Wasmtime compiler.

Required developer checks

cargo fmt --all -- --check
cargo check --workspace --all-targets --locked
cargo clippy --workspace --all-targets --features wire-core/sandbox,wire-ffi/telemetry,wire-ffi/test-fault-injection --locked -- -D warnings
cargo test --workspace --features wire-core/sandbox,wire-core/telemetry --locked
cargo check -p wire-core --no-default-features --locked
pnpm build
pnpm typecheck
WIRE_NATIVE_TESTS=1 pnpm test
python -m pip install PyYAML==6.0.3
python scripts/release.py ecosystems
python tests/performance.py
python scripts/performance.py benchmark
python scripts/release.py audit
python scripts/release.py package

Use the platform's environment-variable syntax on Windows. Build FFI with --profile release-ffi; plain --release intentionally fails its abort guard. Build sandbox hosts with --profile release-sandbox. Every release profile uses opt-level 3, fat LTO and one codegen unit; release additionally sets panic=abort and strips symbols for standalone binaries and the probe, while release-ffi and release-sandbox pin panic=unwind and keep symbols so panic containment and native export checks still work. Workspace and native helper CPU flags require host AVX2/FMA on x64 or NEON on ARM64. The helper rejects mismatched build-host architectures and overrides caller flags with native tuning. Native artifacts can require additional features selected by target-cpu=native; deploy only to compatible CPUs. A portable baseline needs a separate build and validation process.

The ZIP is deterministic source: sorted paths, fixed timestamps/permissions, embedded SOURCE_SHA256SUMS, CRC and byte-for-byte verification. Dependencies, native binaries, temporary reports, build tools and raw measurement dumps are excluded. Rebuild on each release target and run the exact source revision through native/platform and production-validation CI before publishing packages. The single official audit records what was actually executed locally.

Before source packaging, remove generated dependency/build/tool directories and native prebuild outputs; python scripts/release.py audit --release-clean must pass. Keep verified platform binaries in the separate native release pipeline; the pristine source ZIP intentionally contains none.

The v1.0.0 source tree is initialized as a Git repository with a multi-tier .gitignore; build outputs, dependency stores, native addons and local logs stay untracked. The live audit verdict, including any unmet gate, is authoritative over the archive or repository name.