Pinned by hash
A program is one statically linked RV64 ELF. berm compiles it once and instantiates it per invocation — arguments go in through syscalls, the result comes back out of guest memory, and the instance is gone.
The OS for agent harnesses. One statically linked RV64 ELF, pinned by hash, compiled once, and instantiated per invocation.
cargo add berm Apache-2.0 licensed Compiled by Cranelift Served over MCP
The outer result is the host's — a missing tool, a trap. The inner one is the program reporting failure, which is a result the model should see.
let berm = Berm::load(&engine, &elf, &[])?;
match berm.call("echo", br#"{"query":"hello"}"#.to_vec())? {
Ok(result) => println!("{result}"),
Err(failure) => eprintln!("{failure}"),
}$ berm push 127.0.0.1:5000/berm/fixture:v1 ./fixture
127.0.0.1:5000/berm/fixture:v1
digest sha256:222890c498ed28f4bf60670a223141489d9879020bd1890111b8c11ac79fa31d
$ shasum -a256 ./fixture
222890c498ed28f4bf60670a223141489d9879020bd1890111b8c11ac79fa31d ./fixtureA program travels as one OCI layer with no tarball around it, so the digest a registry
addresses it by is shasum of the file on your disk.
A program is one statically linked RV64 ELF. berm compiles it once and instantiates it per invocation — arguments go in through syscalls, the result comes back out of guest memory, and the instance is gone.
A program reaches the world only through the syscalls it was given, and that list is the Linker it was instantiated with. A call to anything else traps because nothing is registered for it, not because a check said no.
berm ships no syscalls at all. What a filesystem is bounded by, and where bytes persist, are decisions about a host — so they belong to whoever is building one.
Manifest::from_elf reads what an image claims to be — its tools, their schemas, when to reach for them — without compiling it and without running it.
bermd serves every deployed program on one MCP endpoint, with tools named {program}.{tool}.
$ bermd &
$ berm deploy example ./program.elf
$ berm lsPushing makes a program fetchable, not findable. The list is a git repository, so search reads a clone of it with no service and no credential.
$ berm push ghcr.io/org/example:v1 ./program.elf
$ berm publish ghcr.io/org/example:v1
$ berm search "read a file"