Velaris MCP server

<!-- mcp-name: io.github.gowrishankar-infra/velaris --> <!-- The line above proves to the MCP registry that this package and the server io.github.gowrishankar-infra/velaris have the same owner. It is read from this file as published to PyPI; removing it breaks publishing to the registry. See integrations/mcp_registry/server.json. -->

Velaris

An AI wrote you a script. Run it anyway.

A language where a function's signature declares what it may touch — and the runtime refuses anything you did not allow, whatever the code says about itself.

Not a security boundary by itself: an interpreter in the program's own process enforces the budget. From 8.4 the operating system is asked to hold the same budget under it - fully on Linux, partly on macOS and on Windows - and each run says which it got (THREAT_MODEL.md, docs/confinement.md).

Playground · Documentation · Reference · Library · Errors

<!-- illustrative lines 1: installs from PyPI -->

pip install velaris-lang
velaris agent_output.vel

That program cannot open a socket, read a file, call Python, or ask the clock. Not "shouldn't" — the runtime refuses, and a refusal cannot be caught and carried past. You do not have to read the code, understand it, or trust the compiler's analysis of it.

Since 5.0 that is what a run with no --allow gets: io, the console. It used to be all seven effects, which meant the answer to "what may this program do?" was "everything" until an operator said otherwise. Widen it by naming what the program needs (--allow io,fs:read:./data); --allow all grants every effect and writes one line to stderr saying so.

--allow io,ffi:math,json grants Python for those modules only; a call that reaches any other module — named, or reached through an attribute of a granted one — is refused (E311). A granted module can still do whatever that module itself can do: ffi:os is the operating system. Since 3.0 the same grammar narrows every coarse effect: fs:read:./data, fs:write:./out, net:api.example.com:443, net:.example.com, and @100 for at most that many operations in a run; env is its own effect, so an io-only program cannot read the environment. timeout and maxmemory_mb are available through the library and every door, and on a door the operator's limits are ceilings a caller cannot raise. It is still not a security boundary - but the caveats every review raised, the ffi cliff, unbounded execution, and fs and net with no path or host list, are now precise permissions rather than holes. It is a real guard for the situation everyone is now in — running a program someone, or something, else wrote.

To see it happen, with nothing to read first (8.5):

<!-- illustrative: writes and runs its own files in a temporary directory -->

velaris demo

Shortened. The full README is on GitHub.