Pinned by hash
A harness is one statically linked RV64 ELF. berm compiles it once and instantiates it per invocation — arguments go in through host calls, the result comes back out of guest memory, and the instance is gone.
A sandbox for harnesses. One statically linked RV64 ELF, pinned by hash, compiled once, and instantiated per invocation.
cargo add berm Apache-2.0 licensed Compiled by Cranelift Served over MCP
The outer result is the host's — a missing tool, a trap. The inner one is the harness reporting failure, which is a result the model should see.
let berm = Berm::load(&engine, &elf, &[])?;
match berm.call("echo", br#"{"query":"hello"}"#.to_vec())? {
Ok(result) => println!("{result}"),
Err(failure) => eprintln!("{failure}"),
}$ berm push 127.0.0.1:5000/berm/fixture:v1 ./fixture
127.0.0.1:5000/berm/fixture:v1
digest sha256:222890c498ed28f4bf60670a223141489d9879020bd1890111b8c11ac79fa31d
$ shasum -a256 ./fixture
222890c498ed28f4bf60670a223141489d9879020bd1890111b8c11ac79fa31d ./fixtureA harness travels as one OCI layer with no tarball around it, so the digest a registry
addresses it by is shasum of the file on your disk.
A harness is one statically linked RV64 ELF. berm compiles it once and instantiates it per invocation — arguments go in through host calls, the result comes back out of guest memory, and the instance is gone.
A harness reaches the world only through the system harnesses it was given, and that list is the Linker it was instantiated with. A call to anything else traps because nothing is registered for it, not because a check said no.
berm ships no system harnesses at all. What a filesystem is bounded by, and where bytes persist, are decisions about a host — so they belong to whoever is building one.
Manifest::from_elf reads what an image claims to be — its tools, their schemas, when to reach for them — without compiling it and without running it.
bermd serves every deployed harness on one MCP endpoint, with tools named {harness}.{tool}.
$ bermd &
$ berm deploy example ./harness.elf
$ berm lsPushing makes a harness fetchable, not findable. The list is a git repository, so search reads a clone of it with no service and no credential.
$ berm push ghcr.io/org/example:v1 ./harness.elf
$ berm publish ghcr.io/org/example:v1
$ berm search "read a file"