Home

dckc/awesome-ocap

Awesome Object Capabilities and Capability Security

Composing capability security and conflict-free replicated data types — Spritely Institute

In August, I attended the DWeb Seminar where a small group of builders gathered to discuss the state-of-the-art and open problems in the distributed web space. Some in the group are primarily concerned with distributed data and focus on sync algorithms and local-first use cases. I am mainly concerned with distributed behavior and focus on the object capability security model. Both areas of study are steeped in their own lore and research papers, which makes it difficult for the two camps to communicate effectively with each other.

FOSDEM 2025 - Goblins: The framework for your next project!

Building peer-to-peer decentralised applications remains difficult and error-prone. Most attempts at this either abandon collaborative features entirely or fall back on centralised architectures. The Spritely Institute is working on this challenge by creating (among other things) Goblins, a Guile framework that makes secure, fault-tolerant peer-to-peer applications accessible to developers. These tools are especially valuable for developers building secure collaborative applications that aim to foster healthy online communities. This talk walks you through Goblins’ most powerful features, including the actor model, object capability security, networking, time travel debugging, and persistence.

Composio

Just-in-time tool calls, secure delegated auth, sandboxed environments, and parallel execution across 1,000+ apps.

Restate - Build innately resilient distributed apps

Restate is a lightweight runtime that lets developers build innately resilient distributed apps without the complexity tax.

Secure Mode: Deno & Node.js compatible permissions for Bun, but better by kynnyhsap · Pull Request #25911 · oven-sh/bun

Summary Implements a Deno-compatible permissions model for Bun, providing granular control over system resource access. This PR introduces a security sandbox that can restrict file system, network,...

Holochain | Distributed app framework with P2P networking

Holochain delivers beyond the promises of blockchain by providing a lightweight, secure and versatile framework for everyday distributed apps.

Sooraj on Twitter / X

IronClaw (@near_ai, Rust) is the most architecturally serious alternative. Built by @ilblackdragon as a direct response to OpenClaw's security failures. Tools and channels run in isolated WASM containers with capability-based permissions. Credentials live in an encrypted vault… https://t.co/3VkLn4f0Ai— Sooraj (@iAnonymous3000) February 16, 2026

Object-capability model

The object-capability model is a computer security model. A capability describes a transferable right to perform one (or more) operations on a given object. It can be obtained by the following combination:

Build a signed web bundle | ChromeOS.dev

Learn how to set up an Isolated Web App development environment and how to test and build Isolated Web Apps.

Composable, fast, and secure dev environments | Workshop | Ubuntu

Launch agent-ready, sandboxed development environments with a single command. Define them via simple YAML configs, share them to recreate on different machines.

Introducing EmDash — the spiritual successor to WordPress that solves plugin security

Today we are launching the beta of EmDash, a full-stack serverless JavaScript CMS built on Astro 6.0. It combines the features of a traditional CMS with modern security, running plugins in sandboxed Worker isolates.

The Heart of Spritely: Distributed Objects and Capability Security

This paper is the second in a three-part series outlining Spritely's thinking and design. The first paper, Spritely: New Foundations for Networked Communities, explains the problems which face contemporary social network design. This paper details the core technical toolbox provided by Spritely Goblins and how it supplies the necessary features to feasibly build out Spritely's broader vision. The third paper in the series, Spritely for Secure Applications and Communities, ties the first two papers together by showing how the architecture for user-facing software fulfills the vision of the first paper and can be built on top of ideas from this paper.

Extensible Software in the age of LLMs | Jeremy Morrell

Solid core + capability-based sandboxes + LLMs = Users with superpowers

GitHub - openai/codex-security at 150d6f6bba5a00d9e3fcccf053fc25b68cee5a57

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security - openai/codex-security