ward

A microVM control plane for sandboxed execution; fleet-grade, observable, MCP-ready.

ward boots each workload into its own Linux microVM via libkrun (Apple Hypervisor.framework on macOS arm64, KVM on Linux). The isolation boundary is hardware virtualisation, not Linux namespaces. Three integration paths:

• Daemon (wardd); long-running gRPC service with Prometheus metrics, cross-sandbox pub/sub broker, egress policy, multi-tenant resource caps. Designed for fleet operation and observability.
• MCP server (ward-mcp); exposes sandboxed execution as MCP tools for LLM agents (Claude, Cursor, Codex). Embedded; no daemon required.
• SDKs; Apache-2.0 clients in Rust (Python / TS / Go scaffolded); generated from proto/ward.proto (CC0).

See docs/why.md for the Docker / SaaS comparison, and docs/positioning.md for how ward differs from other libkrun-based projects.

Pre-release. v0.1.0 is the first signed semver release; see the project board for live status.

Install

curl -fsSL https://raw.githubusercontent.com/igorjs/ward/main/install.sh | bash

Installs ward, wardd, and ward-mcp to ~/.ward/bin. Tarballs are SHA-256 pinned and SLSA Build L3 attested; if slsa-verifier is on PATH the installer checks the provenance chain before extracting. On macOS the daemon ships codesigned with the Hypervisor entitlement; on Linux you'll need to be in the kvm group (sudo usermod -aG kvm $USER). See docs/platforms.md for the full per-platform setup.

Workspace binaries:

Binary	Purpose
wardd	Long-running daemon (gRPC over Unix socket)
ward	CLI for the daemon
ward-mcp	MCP stdio server for LLM agents (embedded; no daemon required)

Build from source

git clone https://github.com/igorjs/ward.git
cd ward

# macOS (Apple Silicon)
brew install slp/krun/libkrun slp/krun/libkrunfw
# Linux (Debian/Ubuntu)
sudo apt-get install -y libkrun-dev libkrunfw-dev

cargo build --release --features krunvm
cargo test --features krunvm

Release binaries always ship with --features krunvm and a bundled libkrun bottle from igorjs/libkrun-builds; the installer above does this for you. The default cargo build (no features) compiles against a stub backend on any platform; useful for contributors hacking on broker/CLI/MCP code without libkrun installed, not for actually running sandboxes. See docs/platforms.md for the full setup matrix.

Hello world (daemon + CLI)

wardd &                                  # start the daemon
ward create alpine                       # → sandbox id
ward exec <id> -- echo "hello from inside"
ward logs <id> <pid>
ward remove <id>

Hello world (MCP, for agents)

Drop into a Claude / Cursor MCP config:

{
  "mcpServers": {
    "ward": {
      "command": "/path/to/ward-mcp",
      "env": { "WARD_DATA_DIR": "/home/you/.ward/data" }
    }
  }
}

The agent can then call ward_create_sandbox, ward_list_sandboxes, ward_exec, and ward_remove_sandbox directly.

Full CLI: ward --help.

Documentation

• docs/SPEC.md; architecture index (ADRs)
• docs/architecture.md; system diagram
• docs/platforms.md; supported platforms + libkrun setup
• docs/workspace.md; crate layout
• docs/status.md; what's shipped, what's pending
• docs/why.md; why ward vs Docker / SaaS sandboxes
• docs/adr/; architecture decision records (most recent: ADR-016)
• CONTRIBUTING.md; dev setup, libkrun bump, PR + release
• SECURITY.md; responsible disclosure
• proto/ward.proto; wire protocol (CC0)

Related

• igorjs/libkrun-builds; libkrun bottles bundled by release artefacts.
• sdks/; Apache-2.0 client libraries (Rust shipping, Python / TS / Go scaffolded) generated from proto/ward.proto.
• superradcompany/microsandbox ; adjacent libkrun-based runtime focused on embedded-SDK use; ward bets on the fleet/daemon angle. See docs/positioning.md for the comparison.

License

AGPL-3.0-only for the daemon, CLI, runtime, and MCP server. The wire protocol (proto/ward.proto) is CC0; SDKs are Apache-2.0 (compiled from the proto, no AGPL linkage; see ADR-016). Contributing requires DCO sign-off and CLA; see CONTRIBUTING.md for the process.