Sandbox profile · Open-source project

Extism

Answer in brief

A BSD-licensed WebAssembly plug-in system from Dylibso with host SDKs for 15+ languages and manifest-level memory, host and path limits, built on Wasmtime. The cleanest way to run agent tools as sandboxed Wasm plug-ins inside your own app; use a VM sandbox for anything that needs an OS.

By the Agent Sandboxes editors · Updated November 9, 2026

Overview

Extism is "a lightweight framework for building with WebAssembly" and a "plug-in system for everyone", an open-source product of Dylibso under the BSD-3-Clause licence. The host embeds an Extism SDK, which exists for Rust, JavaScript (web, Node, Deno, Bun), Go, Python, Ruby, .NET, Java, PHP, Elixir, Haskell, OCaml, Perl, Zig, C and C++, and loads plug-ins compiled with a PDK (Rust, JS, Python, Go, Haskell, AssemblyScript, .NET, C, C++, Zig). A plug-in is described by a manifest that doubles as its policy: max_pages caps memory in 64 KiB pages, allowed_hosts limits outbound HTTP (an empty list blocks everything), allowed_paths maps host directories in only when WASI is enabled, and config passes free-form settings. The runtime's Cargo.toml depends on wasmtime 49 with WASI preview 1 support.

The pitch is that you "determine where in your application some arbitrary code should run, what data that code should be provided, and the data the plug-in should return", and the sandbox keeps that code from harming the host "accidentally or maliciously". That maps directly onto agent tool execution: each tool can be a Wasm plug-in with its own memory and network allow-list, called from whichever language your agent runs in. The trade-off is scope. Plug-ins are functions, not environments: there is no shell, package manager or long-running process, and anything the plug-in needs must be compiled to Wasm. Extism v1.41.0 was released on 9 October 2026.

Notable

BSD-3-Clause; maintained by Dylibso, which also offers commercial support; v1.41.0 released 9 October 2026
Host SDKs for 15+ languages and PDKs for 10 plug-in languages
Runtime built on Wasmtime (pinned to major version 49 in Cargo.toml)

Extism specifications

Attribute	Details
Isolation	WebAssembly sandbox per plug-in on Wasmtime (runtime pins wasmtime 49); manifest sets max memory pages, allowed HTTP hosts and allowed filesystem paths; "secure & host-controlled HTTP without WASI"
Deployment	Open-source project · Self-hostable
Open source	Yes (BSD-3-Clause)
SDKs and interfaces	Rust, JavaScript/TypeScript, Go, Python, Ruby, .NET, Java, PHP, Elixir, Haskell, OCaml, Perl, Zig, C, C++
Cold start (vendor claim)	Not documented
Max session length	Runtime limiters and timers are listed as features; plug-in calls are bounded by the host
Persistence	None; plug-ins are called with input bytes and return output bytes, with plug-in memory owned by the host
GPU	No - CPU-only WebAssembly
Networking	Host-controlled HTTP without WASI; allowed_hosts in the manifest (an empty list blocks all hosts, null allows all)
Pricing	Free and open source
Free tier	Free to self-host
Compliance	Not documented
Regions	Not documented

Facts from Extism’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.

Strengths and trade-offs

Strengths

You want sandboxed, user-supplied or agent-written code called in-process from almost any host language
You need per-plug-in memory caps and HTTP host allow-lists declared in a manifest
You want plug-ins written in several languages to share one interface

Trade-offs

A plug-in model, not an execution environment: no shell, filesystem by default, or native packages
Timeouts and resource limiters are host-level features you must configure; the manifest page checked documents memory, hosts and paths only
No GPU

Good fit for: Letting users or agents supply code that runs as a sandboxed plug-in inside your application, in almost any host language.

How Extism compares

Sandbox	Isolation	Open source	Self-host / BYOC	Cold start (vendor)	Max session	Snapshots / pause	GPU	SDKs
Extism	Wasm plug-in sandbox	Yes	Yes / No	Not documented	Host-set	No / No	No	Rust, JavaScript/TypeScript, Go, Python, Ruby, .NET, Java, PHP, Elixir, Haskell, OCaml, Perl, Zig, C, C++
Wasmtime	Wasm sandbox	Yes	Yes / No	Not documented	Embedder-set	No / Not documented	No	CLI, Rust, C, C++, Python, .NET, Go, Ruby
Wasmer	Wasm sandbox	Yes	Yes / No	Not documented	Not documented	Not documented / Not documented	No	CLI, JavaScript/TypeScript, Python, Rust, Swift
Spin (Fermyon)	Wasm component	Yes	Yes / No	ms (claim)	30 s (Fermyon Cloud)	No / No	No	CLI, Rust, JavaScript/TypeScript, Go, Python
Pyodide	CPython in Wasm	Yes	Yes / No	Not documented	Not documented	No / No	No	JavaScript/TypeScript, Python

See all Extism alternatives →

Frequently asked questions

What is Extism?

How does Extism isolate code?

Extism documents its isolation as: WebAssembly sandbox per plug-in on Wasmtime (runtime pins wasmtime 49); manifest sets max memory pages, allowed HTTP hosts and allowed filesystem paths; "secure & host-controlled HTTP without WASI".

Is Extism open source?

Yes (BSD-3-Clause). It can be self-hosted.

How much does Extism cost?

Free and open source Check the official pricing page for current rates.

What are the alternatives to Extism?

Common alternatives include Wasmtime, Wasmer, Spin (Fermyon), Pyodide. See Extism alternatives for a full comparison.

Sources

Cite this page

Agent Sandboxes. (2026). Extism. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/extism/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.