ACT CLI & Build Tools
Host and build ACT (Agent Component Tools) WebAssembly components.
This repo contains two tools:
act— run, call, inspect, and serve ACT components from local files, HTTP URLs, or OCI registriesact-build— post-process compiled WASM components: embed metadata, skills, and custom sections
Install
# act (CLI host)
npm i -g @actcore/act
pip install act-cli
cargo install act-cli
# act-build (build tool)
npm i -g @actcore/act-build
pip install act-build
cargo install act-build
Pre-built binaries available on GitHub Releases and Docker (ghcr.io/actcore/act).
act — Component Host
# Discover tools in a component
act info --tools ghcr.io/actpkg/sqlite:0.1.0
# Call a tool
act call ghcr.io/actpkg/sqlite:0.1.0 query \
--args '{"sql":"SELECT sqlite_version()"}' \
-m database_path=/data/app.db \
--grant '{"wasi:filesystem":{"mode":"allowlist","allow":[{"path":"/data/**","mode":"rw"}]}}'
# Serve over HTTP
act run -l ghcr.io/actpkg/sqlite:0.1.0
# Serve over MCP stdio
act run --mcp ghcr.io/actpkg/sqlite:0.1.0
Components can be referenced as:
- OCI refs:
ghcr.io/actpkg/sqlite:0.1.0 - HTTP URLs:
https://example.com/component.wasm - Local paths:
./component.wasm
Remote components are cached in ~/.cache/act/components/.
Commands
| Command | Description |
|---|---|
run |
Serve a component over MCP — stdio (--mcp) or Streamable HTTP (--mcp --http -l) |
call |
Call a tool directly, print result to stdout |
info |
Show component metadata, tools, and schemas (--tools, --format text|json|toon) |
pull |
Download a component from OCI or HTTP to local file |
Audit trail
run and call write a structured audit trail to stderr: what component is running and under what capability modes, every capability decision as it resolves, and a per-call summary. It is on by default and independent of RUST_LOG — only --no-audit (or [audit] enabled = false in the config file) turns it off.
audit: act-cli/tests/fixtures/fs-canary.wasm sha256:92342c │ wasi:filesystem=ask wasi:http=deny wasi:sockets=deny
audit: ⚠ declared ask, no prompt channel — every access will be denied: wasi:filesystem
audit: ? ask-deny wasi:filesystem /tmp/probe.txt denied by user
audit: ● read tool-error 1ms args:43ebc7 req:00392e
That's a real, captured transcript of one headless call with no --grant: the first line is the instantiation header (component, digest, resolved mode per capability class); the second warns that a declared ask capability has no prompt channel to answer it, so every access degrades to deny; the third is the immediate denial (denials and asks print the moment they resolve, never batched); the fourth is the per-call rollup — outcome, duration, an args: digest of the tool arguments (or the full values with --audit-args), and a req: id for joining this line back to a client log. Allowed operations coalesce into that rollup line instead of one line each, e.g. filesystem: 12 read under /data/**.
HTTP Endpoints (run -l)
| Method | Path | Description |
|---|---|---|
GET |
/info |
Component metadata |
POST |
/metadata-schema |
JSON Schema for metadata |
POST/QUERY |
/tools |
List tools |
POST/QUERY |
/tools/{name} |
Call a tool (SSE with Accept: text/event-stream) |
act-build — Component Build Tool
# Embed act:component metadata, act:skill, and WASM custom sections
act-build pack target/wasm32-wasip2/release/my_component.wasm
# Validate without modifying
act-build validate target/wasm32-wasip2/release/my_component.wasm
# Publish as a CNCF Wasm OCI Artifact
act-build push my_component.wasm ghcr.io/actpkg/my-component:0.1.0 \
--also-tag latest \
--source https://github.com/actpkg/my-component \
--skip-if-identical
Metadata is resolved via merge-patch from project manifests:
- Base from
Cargo.toml,pyproject.toml, orpackage.json(name, version, description) - Inline patch from the same manifest (
[package.metadata.act-component],[tool.act-component], oractComponent) act.toml— highest priority, applied last
act-build push produces artifacts conformant with the CNCF
TAG-Runtime Wasm OCI Artifact spec:
manifest config has media type application/vnd.wasm.config.v0+json
(with architecture, os, layerDigests, and
component.{exports,imports} derived from the component's exports
and imports), and the layer is application/wasm.
Authentication is resolved in order: OCI_USERNAME/OCI_PASSWORD
env, then GITHUB_TOKEN for ghcr.io, then ~/.docker/config.json
(or $DOCKER_CONFIG/config.json), then anonymous.
Platform Support
| Architecture | Linux (GNU) | Linux (musl) | macOS | Windows | Docker |
|---|---|---|---|---|---|
| x86_64 | ✓ | ✓ | ✓ | ✓ | ✓ |
| aarch64 | ✓ | ✓ | ✓ | ✓ | ✓ |
| riscv64 | ✓ | ✓ | — | — | ✓ |
RISC-V (riscv64) is a first-class target. Regressions on RISC-V are release-blocking.
Building
cargo build --release # both tools
cargo build -p act-cli # act only
cargo build -p act-build # act-build only
Set RUST_LOG=act=debug for verbose output.
License
MIT OR Apache-2.0
1 maintainer
Release files for act-cli 0.12.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| act_cli-0.12.0.tar.gz | 340.1 kB | Details |
Built distributions (wheels)
Total release size: 158.4 MB
Release files / act_cli-0.12.0.tar.gz
| Download URL | act_cli-0.12.0.tar.gz |
|---|---|
| Size | 340.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
9cae57c3ba26ecb4b29a3929712eecf080cb82fa2627351651319650a72f202c
|
|
BLAKE2b-256 checksum How to use checksums |
2db185685a3afbef2bd85d856a435724796e5378e644c08f930da4d569e8c149
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 26, 2026.
Transparency logRelease files / act_cli-0.12.0-py3-none-win_arm64.whl
| Download URL | act_cli-0.12.0-py3-none-win_arm64.whl |
|---|---|
| Size | 14.7 MB |
| Tags | Python 3 Windows ARM64 |
|
SHA-256 checksum How to use checksums |
c667cce2117539d3e9435f9641e5fa2bd832c9f4d83ca671c87fec141cdb4d5e
|
|
BLAKE2b-256 checksum How to use checksums |
642e8c6cb71202c6f95ad17688d40c37806a50862765a30925c6877c5c5caec7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 26, 2026.
Transparency logRelease files / act_cli-0.12.0-py3-none-win_amd64.whl
| Download URL | act_cli-0.12.0-py3-none-win_amd64.whl |
|---|---|
| Size | 16.4 MB |
| Tags | Python 3 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
9a2545dfb699289a2820fe692084777292c680cef8252f24823eb2fa9c6d8acb
|
|
BLAKE2b-256 checksum How to use checksums |
01d6385439933f5d912d9a16d80679fa8bca7473c36d196c588634fd19ce75af
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 26, 2026.
Transparency logRelease files / act_cli-0.12.0-py3-none-musllinux_1_2_x86_64.whl
| Download URL | act_cli-0.12.0-py3-none-musllinux_1_2_x86_64.whl |
|---|---|
| Size | 16.1 MB |
| Tags | Linux musl 1.2+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
98be096de9f5767593afcac648b2500809ba30c0efec831a7e5ef0f03469133e
|
|
BLAKE2b-256 checksum How to use checksums |
f7ae5a4a7843efd7262b85600b753bfb042b8178ceddbbdef87289260f220868
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 26, 2026.
Transparency logRelease files / act_cli-0.12.0-py3-none-musllinux_1_2_riscv64.whl
| Download URL | act_cli-0.12.0-py3-none-musllinux_1_2_riscv64.whl |
|---|---|
| Size | 15.6 MB |
| Tags | Linux musl 1.2+ RISC-V 64 Python 3 |
|
SHA-256 checksum How to use checksums |
44b992327c9271d04f4958083389cf758c2d93550fb96d69f18635c9b113c2b4
|
|
BLAKE2b-256 checksum How to use checksums |
4f849039ee24b1a8b9a525cabdf5a726e9bd69c2af33866781c0d4c5a3479381
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 26, 2026.
Transparency logRelease files / act_cli-0.12.0-py3-none-musllinux_1_2_aarch64.whl
| Download URL | act_cli-0.12.0-py3-none-musllinux_1_2_aarch64.whl |
|---|---|
| Size | 14.6 MB |
| Tags | Linux musl 1.2+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
1344b9990dea7c882b043251a74fd5fd45bb16713dbdae6839416434c453a8ec
|
|
BLAKE2b-256 checksum How to use checksums |
6d69bbf3af2de239603ad4bd2c948964676f4164c7509c952ce0d443c16cbe74
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 26, 2026.
Transparency logRelease files / act_cli-0.12.0-py3-none-manylinux_2_31_riscv64.whl
| Download URL | act_cli-0.12.0-py3-none-manylinux_2_31_riscv64.whl |
|---|---|
| Size | 15.5 MB |
| Tags | Linux glibc 2.31+ RISC-V 64 Python 3 |
|
SHA-256 checksum How to use checksums |
c2359b92012cdf165642a1e6d27215ae795ca98edc88657be77d6f6fd8ff4d1c
|
|
BLAKE2b-256 checksum How to use checksums |
86a841b2ce599fe3547a2e7550bf907eefb059cd6d012edd5307e7c9d77b4152
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 26, 2026.
Transparency logRelease files / act_cli-0.12.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
| Download URL | act_cli-0.12.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
|---|---|
| Size | 16.3 MB |
| Tags | Linux glibc 2.17+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
1d72953052eccf11cbcd1d3cb9f3926f7d7e28f006bce7ecd482ec0cd38d5b09
|
|
BLAKE2b-256 checksum How to use checksums |
7b44a777894f47642ffa1cd16be1a36a54c7ef361e71cbe7067607069965ec8e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 26, 2026.
Transparency logRelease files / act_cli-0.12.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
| Download URL | act_cli-0.12.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl |
|---|---|
| Size | 14.7 MB |
| Tags | Linux glibc 2.17+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
e89d525a70e2ae24e824b24dfa258e45f6a12d6dc8c506e584a61dcf862fec0c
|
|
BLAKE2b-256 checksum How to use checksums |
29ee5e6538e236af3e70dcd9fce5c176da1c4b96ba8fec739f1edbc4b5460767
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 26, 2026.
Transparency logRelease files / act_cli-0.12.0-py3-none-macosx_11_0_arm64.whl
| Download URL | act_cli-0.12.0-py3-none-macosx_11_0_arm64.whl |
|---|---|
| Size | 16.5 MB |
| Tags | Python 3 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
e0c75a70ab88d7bde17d55ac9aa9eec476e11ad9fe5816dd6f5bfda0b573c20f
|
|
BLAKE2b-256 checksum How to use checksums |
7854ca4c5d550bad10ae0dcbcf20b66a5392acdd1e933ad5ee09d643c6fdd9b7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 26, 2026.
Transparency logRelease files / act_cli-0.12.0-py3-none-macosx_10_12_x86_64.whl
| Download URL | act_cli-0.12.0-py3-none-macosx_10_12_x86_64.whl |
|---|---|
| Size | 17.8 MB |
| Tags | Python 3 macOS 10.12+ x86-64 |
|
SHA-256 checksum How to use checksums |
65ef5bba094334c739763bdad02a91f0b5d243da7526ddb42e4e704ce9b5a110
|
|
BLAKE2b-256 checksum How to use checksums |
2cfdf865f7ec35e3ec41b0e9ed71cd013f8e4ba31f5d0eedd5bcad0e44020821
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 26, 2026.
Transparency log
