ACT (Agent Component Tools) is a toolchain designed to enable the creation, signing, and deployment of sandboxed components for AI agents. It addresses the challenges of running third-party tools with unrestricted access by introducing strict boundaries, enforced capability ceilings, and verifiable provenance for each component. The platform is intended for environments where security, reproducibility, and transparency are critical, particularly for AI agents that require deterministic and auditable execution.
With ACT, developers can build tools in languages such as Rust, Python, Go, C++, JavaScript, or any language that compiles to WebAssembly. wasm) component, which is self-documenting and embeds schemas, descriptions, examples, and agent skills directly into the binary. These components are sandboxed using wasmtime, ensuring zero ambient access—meaning no default access to the filesystem, outbound network, or system calls, unless explicitly granted by the operator. This approach limits the "blast radius" of any component, as both the developer and operator declare and enforce the minimum required capabilities at build and runtime.
ACT components are distributed as signed OCI artifacts, with each one carrying a GitHub Actions attestation that links the artifact to its source commit. This signing process provides end-to-end, verifiable provenance, allowing users to audit and prove that the code running in production matches the code that was reviewed. The deterministic build process ensures that the same SHA256 hash is produced on every machine, supporting reproducibility across environments. Components can be run over multiple interfaces, including MCP, CLI, HTTP API, or directly in the browser.
The toolchain is delivered through a combination of command-line tools and npm packages, such as @actcore/act and @actcore/act-build. ACT is positioned as a hardened solution for building secure, signed, and sandboxed components for AI agents, with a focus on environments that demand strict security and auditability guarantees.
ACT is a Frameworks & SDKs product. It focuses on securing and standardizing third-party AI agent tools with sandboxing and provenance. ACT is an open-source project aimed at AI developers. The project is open source (Apache-2.0). It runs on the web, the command line, and API, and it can be self-hosted.
ACT first shipped in 2026. The project is developed in the open on GitHub with 23 commits in the last 90 days. Across PulseGate's embedding index, ACT has few near neighbours, marking it as relatively distinct. Among its 5 catalogued features are sandboxed components, signed artifacts, and capability ceilings. It exposes integrations via a public API and an MCP server.
Latest indexed changes and source events
actcore.dev discovered by the PulseGate indexer
Other apps tracked under the same category.
