VELA
<p> Securely execute AI-generated & untrusted code </p> <p> <a href="https://www.producthunt.com/products/vela-7?utm_campaign=producthunt-atom-posts-feed&utm_medium=rss-feed&utm_source=producthunt-atom-posts-feed">Discussion</a> | <a href="https://www.producthunt.com/r/p/1174875?app_id=339">Link</a> </p>
Last verified:
What is VELA?
Vela is a secure execution runtime for AI agents and SaaS platforms that safely runs untrusted or AI-generated code. Powered by the Aegis runtime, it acts as a policy-driven execution guard that uses Firecracker micro-VMs and HMAC capability tokens to isolate code execution from your host server. This solves the massive security risk of running autonomous AI agent code directly on production infrastructure.
Key features include structured results from code execution, fine-grained filesystem and network restrictions, full JSONL audit trails with hash-chained logging, hardware-level isolation via micro-VMs, and cryptographic authorization through capability tokens. The tool provides least-privilege execution where filesystem access, network permissions, runtime limits, and auditability are all controlled per execution through policy definitions.
Vela is open-source under MIT license and specifically built for LangChain and LlamaIndex frameworks. It targets developers building autonomous AI agents, SaaS platforms integrating AI code execution, and security teams needing to guard against malicious AI-generated payloads. With ~150ms cold start times, it's workable for tool call use cases in production agent workloads.
The runtime enables developers to place a security layer between AI-generated actions and their infrastructure without sacrificing speed. Sandboxes can be launched with networking completely disabled for maximum safety, or developers can grant narrowly scoped capabilities through policy and capability tokens for legitimate outbound access like calling external APIs.
VELA pricing
Pricing model: Freemium
Vela is open-source and MIT licensed, available for free. The tool is powered by the Aegis runtime and designed for developers to integrate into their existing LangChain/LlamaIndex workflows without subscription fees.
VELA pros
- Firecracker micro-VM hardware isolation for maximum security
- HMAC capability tokens for cryptographic authorization
- Policy-driven execution guard with least-privilege model
- ~150ms cold start time works for tool call use cases
- Structured results from code execution
- Fine-grained filesystem restrictions per execution
- Fine-grained network restrictions per execution
- Full JSONL audit trail with hash-chained logging
- Open-source under MIT license
- Built for LangChain and LlamaIndex frameworks
- Networking can be completely disabled for safest mode
- Narrowly scoped capabilities through policy tokens
- Compact policy-driven boundary for risky code
- No host filesystem access by malicious payloads
- Network isolation enforced at micro-VM boundary
- Runtime limits controlled per execution
- Structured observability into execution runtime
- Passes isolation at micro-VM boundary not just process
- Safe for AI-generated scripts calling external APIs
- Solves host-level agent code execution security risk
VELA cons
- Still exploring richer network policies
- MCP tool-call support not yet implemented
- Currently focuses on raw script execution only
- Network isolation per execution still being explored
- Requires policy definition for capability grants
- Cold start may not work for ultra-low-latency needs
- Limited to LangChain/LlamaIndex ecosystem
- No binary sandboxed/not sandboxed flexibility
- Network namespace still shared in older solutions
Frequently asked questions about VELA
What is Vela and what problem does it solve?
Vela is a policy-driven execution guard powered by the Aegis runtime that solves the massive security risk of running autonomous AI agent code directly on your host server. It uses Firecracker micro-VMs and HMAC capability tokens to safely run untrusted or AI-generated code with hardware-level isolation.
How does Vela isolate code execution?
Vela enforces isolation at the micro-VM boundary using Firecracker micro-VMs, not just process isolation. This means malicious payloads cannot exfiltrate data or reach internal services even if they can't touch the host filesystem, addressing the critical distinction that process isolation alone isn't enough.
Can I disable networking completely in Vela sandboxes?
Yes, a sandbox can be launched with networking completely disabled, which is the safest mode for many AI-generated workloads. Network access is treated as a first-class policy decision rather than an implicit default.
How do I handle code that needs outbound API access?
For cases where outbound access is legitimately required like calling APIs or downloading data, developers can grant narrowly scoped capabilities through policy and capability tokens instead of giving unrestricted access, moving to a least-privilege execution model.
Is Vela open-source and what license is it under?
Yes, Vela is open-source and MIT licensed, making it freely available for developers to integrate into their projects without subscription fees.
What frameworks is Vela built for?
Vela is specifically built for LangChain and LlamaIndex frameworks, making it easy to integrate into existing AI agent workflows.
What is the cold start time for Vela sandboxes?
The Firecracker micro-VM approach provides approximately 150ms cold start time, which is totally workable for tool call use cases in production agent workloads.
Does Vela support MCP tool calls?
Vela currently focuses on raw script execution, but MCP tool-call support is actively being thought about. The sandbox and policy layer are built to be flexible enough for both raw execution and tool-call contexts.
What audit trail does Vela provide?
Vela provides a full JSONL audit trail with hash-chained logging, enabling real-time logging of tool calls, prompt contexts, and database state mappings with complete observability into every agent action.
What is the difference between Vela's approach and traditional sandboxing?
Vela moves from a binary 'sandboxed/not sandboxed' model to a least-privilege execution model where filesystem, network, runtime limits, and auditability are all controlled per execution through policy, rather than just process isolation that still shares network namespace.