WebAssembly for AI skills: Luminarys AI

Luminarys AI: A Modular Platform for Isolated AI Skills in WebAssembly

Luminarys AI is a platform for deploying AI agents with skills isolated in WebAssembly sandboxes. It supports writing skills in Go, Rust, AssemblyScript, clustering on heterogeneous architectures, and the MCP protocol. It addresses security, multi-language support, and scaling challenges in production.

Skill Isolation in Sandboxes

Skills are compiled into WebAssembly and executed with strict isolation based on configuration. Access to FS, shell, and HTTP is restricted via allowlists—the skill physically cannot exceed its boundaries. Verification occurs at load time: configuration mismatches block execution.

Example configuration for hardware monitoring:

# Example: skill for hardware interaction
id: hardware-monitor
permissions:
  fs:
    enabled: true
    dirs:
      - "/sys/class:ro"               # read sysfs (sensors, devices)
      - "/dev/serial:rw"              # access to serial ports
  shell:
    enabled: true
    allowlist:
      - "lsusb **"                    # only listed commands
      - "i2cget **"
      - "cat /proc/cpuinfo"
    allowed_dirs:
      - "/tmp/hw-monitor"

A skill for CPU temperature only sees /sys/class/thermal, for GPIO—/sys/class/gpio. No command chains, no sandbox escape.

Multi-Language Skills with SDK

Skills are written in Go, Rust, or AssemblyScript. The lmsk code generator creates WASM modules from annotated code: routing, serialization, validation.

• AssemblyScript: compact modules (~100 KB), TS syntax. For HTTP, FS, text.
• Rust: performance, native libraries. Parsing protobuf/PCAP, ONNX inference, tree-sitter.
• Go: stdlib, embedding JS/Python VM.

Example skill in Go:

// @skill:id      ai.example.hello
// @skill:name    "Hello Skill"
// @skill:version 1.0.0
// @skill:desc    "Simple greeting skill."
package main

import sdk "github.com/LuminarysAI/sdk-go"

// @skill:method greet "Return a greeting."
// @skill:param  name required "Person name"
// @skill:result "Greeting string"
func Greet(_ *sdk.Context, name string) (string, error) {
    return "Hello, " + name + "!", nil
}

Rust version:

/// @skill:id      ai.example.hello
/// @skill:name    "Hello Skill"
/// @skill:version 1.0.0
/// @skill:desc    "Simple greeting skill."

use luminarys_sdk::prelude::*;

/// @skill:method greet "Return a greeting."
/// @skill:param  name required "Person name"
/// @skill:result "Greeting string"
pub fn greet(_ctx: &mut Context, name: String) -> Result<String, SkillError> {
    Ok(format!("Hello, {}!", name))
}

AssemblyScript:

/**
 * @skill:id      ai.example.hello
 * @skill:name    "Hello Skill"
 * @skill:version 1.0.0
 * @skill:desc    "Simple greeting skill."
 */
import { Context } from "@luminarys/sdk-as";

// @skill:method greet "Return a greeting."
// @skill:param  name required "Person name"
// @skill:result "Greeting string"
export function greet(_ctx: Context, name: string): string {
  return "Hello, " + name + "!";
}

Skills in different languages load into a single host, call each other, share state.

Clustering on Heterogeneous Nodes

Master node routes calls to slaves on x86, ARM, RISC-V, IoT. Skills don't notice the cluster—API is local.

Scenarios:

• CI/CD: tests on Linux slave, build Windows binary on Windows slave.
• Hardware: Raspberry Pi for I2C, Jetson for video, x86 for serial.
• IoT fleet: master in cloud, slaves on edge with GPIO/SPI/UART.
• Monitoring: sysfs, SMART, CPU/GPU in sandboxes.

Relay server ensures encrypted file transfer. If a slave fails—automatic tool updates.

Multi-LLM and Agent Mode

Model routing by task/language: deepseek-coder for code, rust-specialist for Rust. Config without restart.

Agent mode (development):

• Batches: synchronous/asynchronous calls to multiple skills.
• Autonomy: callbacks on events (timers, sensors, MQTT).
• Interaction: skill→skill calls with depth/timeout control.

MCP Compatibility

Support for Model Context Protocol: Claude, Cursor, Open WebUI. Transports—Streamable HTTP, SSE, stdio, OpenAPI.

Key Points

• Skills in WebAssembly sandboxes prevent permission escapes.
• Multi-language support (Go/Rust/AS) with unified annotations and code generator.
• Clustering distributes load across architectures without API changes.
• MCP compatibility for integration with Claude/Cursor/Open WebUI.
• Callback model for real-time and autonomous agents.

— Editorial Team