Sabline MCP server

<!-- mcp-name: io.github.gowrishankar-infra/sabline --> <!-- The line above proves to the MCP registry that this package and the server io.github.gowrishankar-infra/sabline have the same owner. It is read from this file as published to PyPI; removing it breaks publishing to the registry. See integrations/mcp_registry/server.json. -->

Sabline

An AI wrote you a script. Run it anyway.

A language where a function's signature declares what it may touch — and the runtime refuses anything you did not allow, whatever the code says about itself.

Not a security boundary by itself: an interpreter in the program's own process enforces the budget. From 8.4 the operating system is asked to hold the same budget under it - fully on Linux, partly on macOS and on Windows - and each run says which it got (THREAT_MODEL.md, docs/confinement.md).

Playground · Documentation · Reference · Library · Errors

This project was called Velaris until 8.6.0. The name belongs to an unrelated company in the same market (velaris.io), so it was given up rather than contested. Everything else is unchanged, and nothing written against the old name stops working in 8.x: the velaris command, import velaris, the VELARIS_* environment variables, a committed velaris.capabilities, and a velaris.audit/1 or velaris.receipt/1 document are all still read, each saying once that the name has changed. docs/renamed.md lists every published address and where it now points; STABILITY.md says what goes in 9.0.

<!-- illustrative lines 1: installs from PyPI -->

pip install sabline-lang
sabline agent_output.vel

That program cannot open a socket, read a file, call Python, or ask the clock. Not "shouldn't" — the runtime refuses, and a refusal cannot be caught and carried past. You do not have to read the code, understand it, or trust the compiler's analysis of it.

Since 5.0 that is what a run with no --allow gets: io, the console. It used to be all seven effects, which meant the answer to "what may this program do?" was "everything" until an operator said otherwise. Widen it by naming what the program needs (--allow io,fs:read:./data); --allow all grants every effect and writes one line to stderr saying so.

Shortened. The full README is on GitHub.