mk8.shell is a restricted command language and .NET runtime for agent-driven system operations. It gives an agent a closed, auditable set of verbs for file I/O, directory work, HTTP calls, JSON/text transforms, environment inspection, network checks, archive extraction, and a narrow whitelist of external process templates.
The core security property is simple: mk8.shell does not compile scripts into
PowerShell, Bash, cmd, or any other general-purpose shell. Most verbs execute
directly through .NET APIs. The only process-spawning path is ProcRun, and
that path uses registered command templates with structured argument arrays.
| Project | Purpose |
|---|---|
mk8.shell |
Core compiler, executor, safety model, sandbox metadata, and built-in command templates. |
mk8.shell.startup |
Startup integration project that references the core runtime. |
- Keep the executable surface explicit and reviewable.
- Pass process arguments as structured values, never concatenated shell strings.
- Scope filesystem access to sandbox workspaces.
- Validate each verb at compile time before runtime dispatch.
- Make script execution portable across Windows and Linux without exposing a real terminal.
mk8.shell/
mk8.shell/ Core runtime library
Commands/ Whitelisted process command templates
Engine/ Script DTOs, compiler, expander, and executor
Isolation/ Sandbox/container abstractions
Models/ Sandbox registry and signed environment metadata
Safety/ Validators, allowlists, path/url sanitizers
mk8.shell.md Full language and runtime reference
mk8.shell.startup/ Startup integration project
This repository targets .NET net10.0.
dotnet restore .\mk8.shell\mk8.shell.csproj
dotnet build .\mk8.shell\mk8.shell.csproj
dotnet build .\mk8.shell.startup\mk8.shell.startup.csprojThe detailed language reference lives in
mk8.shell/mk8.shell.md.
This repo was split out of the SharpClaw workspace so the shell runtime can evolve independently from the main application and from the test module archive.