Use real software from any AI agent.
An open runtime that connects AI agents to desktop and professional applications through
structured operations, native APIs, and governed system interfaces.
Connect your tools once. Use them from any compatible agent.
Quick start · Installation · Documentation · Drivers · Verification
Pre-v1: candidate builds are available for evaluation, but Semwright has not published a public v1 yet. Exact support and evidence are tracked in VERIFY.md; independent security review remains a publication gate.
AI agent → Semwright → Blender · Godot · Browser · LibreOffice · Figma · KiCad · …
AI agents can reason about a task. Reliably operating real software is a different problem: application objects have identity and state, UI layouts move, mutations have side effects, and every agent should not need its own one-off automation stack.
Semwright exposes real applications as structured operations behind one authorization boundary. It prefers the strongest interface available—application/native APIs first, semantic accessibility and governed system interfaces when needed, and controlled input or capture as explicit fallbacks. Every operation still passes through the same broker, policy and audit path.
- Structured operations first. Use application objects and typed commands instead of reducing every task to screenshots and coordinates.
- One authorization boundary. CLI, MCP, Recipes, drivers and federated providers do not create separate privilege systems.
- One runtime across compatible agents. Change the agent without rebuilding every application integration from scratch.
- Read back what happened. Effects and application observations keep requested, expected and observed outcomes distinct.
- Keep project state coherent. Project Graph can track identity, dependencies and drift across repeated work instead of treating every run as a blank slate.
- Local and inspectable. The OSS runtime can operate locally; discovery is not permission, sensitive actions can require operator approval, and execution is auditable.
A typical path looks like this:
Agent request Semwright Software
"change this material" → typed operation → policy → readback → Blender
"update this scene" → typed operation → policy → readback → Godot
"export this document" → typed operation → policy → artifact → LibreOffice
"find the Save button" → semantic query → policy → reference → accessibility
Support is scoped per integration; a green fixture does not automatically certify every version or interactive environment.
Until the first public release, candidate bundles come from exact-SHA V1 multiplatform distribution Actions runs. Verify the published checksums for that candidate, extract the archive, and run its included helper:
| Platform | Bundle | Install from the extracted directory |
|---|---|---|
| Linux x86_64 / aarch64 | .tar.gz or .deb |
./install.sh (or the system package manager for .deb) |
| Windows x86_64 / ARM64 | .zip |
.\Install-Semwright.ps1 |
| macOS Apple Silicon / Intel | .tar.gz |
./install.sh |
Every portable bundle includes the matched CLI, daemon, MCP frontend, TUI and sandbox helper, plus checksums and reversible user-local installers. Install the core once and choose which interface to use; CLI/TUI/MCP are not separate versioned downloads. Optional application integrations remain separate.
Three-step quick start → · Full installation, checksums and removal →
The installer prints the exact installed command, so onboarding does not depend on PATH. Setup is local, idempotent and non-overwriting: it creates an observe-only config plus a ready-to-copy MCP snippet, but grants no desktop authority and starts no background service.
Setup prints the exact broker, doctor, TUI and MCP paths for the current platform. Start the broker,
then run the printed doctor command from another terminal. semwright-inspect opens the read-only
terminal UI and the generated mcp-client.json points at the exact installed semwright-mcp.
For contributors, the repository also includes a synthetic desktop path. It exercises the real daemon, CLI, Recipe runner and policy path without connecting to your real desktop or credentials. This is the source-build path, not the normal installation path.
On Ubuntu 24.04 x86_64, install the development prerequisites, then:
git clone https://github.com/seradotcom/semwright.git
cd semwright
cargo build --locked -p semwright-daemon -p semwright-cli --bins
BIN_DIR=target/debug ./scripts/dev/fake-smoke.shThe smoke will:
- start an isolated fake Semwright daemon;
- discover one exact
Exportcontrol; - run a typed recipe through normal policy and dispatch;
- report the observed
changedresult and audit metadata; - stop the daemon and remove the temporary runtime.
This is a functional first-use path, not live-desktop certification or a security verdict.
Cargo.lock is committed. Keep it and use --locked; do not run scripts/dev/bootstrap.sh on an
ordinary checkout. For the full build, per-user installation, portable package layout and uninstall
flow, use the installation guide.
Semwright exposes a deliberately small MCP frontend that routes back through the same broker, policy, references and audit path as the CLI.
semwright setup writes a ready-to-copy MCP client snippet using the exact installed executable path
for the current platform. Its shape is:
{
"mcpServers": {
"semwright": {
"command": "<absolute path to semwright-mcp>"
}
}
}The MCP process does not grant desktop authority, approve mutations or start the broker for you. See MCP for socket/session configuration and governed MCP federation for connecting external MCP providers.
Applications that already own their model, persistence and transactions can integrate through the Native SDK instead of adopting a Semwright-specific storage model. The SDK exposes small optional cooperation contracts, adapts them through the canonical Driver SDK/Driver Host, and keeps Broker/Policy, Project Graph and Effect Conformance as the existing authorities. Rust and TypeScript surfaces, a file-backed reference profile and an application-owned SQLite example are included in the repository. The portable SDK baseline has executed on Linux, Windows and macOS across x64/ARM64 where native hosted runners are available; the real Host E2E is currently an accepted Linux profile. See the Native SDK verification.
Semwright has application-specific integrations in addition to generic desktop/platform backends. The table below is intentionally compact; it describes the integration path, not a blanket support certificate.
| Application / domain | Semwright path | Evidence boundary today |
|---|---|---|
| Blender | First-party driver and semantic authoring/export | Real Blender 4.5.14 DriverProvider and add-on evidence exists; broader version/desktop coverage remains scoped |
| Godot | Driver + EditorPlugin + pinned runner | Production driver is exercised through Driver Host and pinned Godot CI; broader editor interaction remains scoped |
| Chromium | Private-profile CDP adapter | Real hosted browser integration exists on the Linux development line |
| Figma | Official Plugin API through authenticated loopback driver | Typed/fake-host/sandboxed CI exists; real Figma acceptance is separate |
| LibreOffice | First-party sandboxed UNO driver | Real hosted Writer/Calc/PDF operations execute through CLI -> daemon -> Broker -> DriverProvider; the curated surface is not the full UNO API |
| OBS Studio | obs-websocket driver |
Fake-server, sandbox and disposable read-only OBS paths are exercised |
| MLT video | Offline timeline/render driver | Semantic/render tests exist; arbitrary Kdenlive/Shotcut round trips are not implied |
| KiCad | Curated driver integration | Deterministic IPC/conformance exists; fake IPC is not a real KiCad interoperability certificate |
| Motion Canvas | Typed project/render driver | Deterministic model generation and bounded render jobs |
| Audio | Faust + Ardour drivers | Curated synthesis, analysis and managed-session paths with explicit coverage gaps |
Full details live in the platform matrix, compatibility matrix, Driver SDK guide and each integration's own README.
compatible agent / MCP / CLI
|
v
+-----------------------------+
| Semwright |
| discovery · schemas · refs |
| policy · approvals · audit |
| jobs · artifacts · Effects |
+-------------+---------------+
|
Provider Runtime
|
strongest available path
|
+-------+-------------------------------+
| |
v v
application/native APIs semantic/system interfaces
| |
+-------------------+-------------------+
|
v
controlled fallbacks
(input / capture)
|
v
real applications
Semwright does not replace MCP or an agent SDK. MCP is one way to reach the runtime and one kind of provider Semwright can govern. The execution layer is responsible for capability discovery, policy, application identity, bounded jobs, references, artifact handoff and audit.
A cross-application workflow can therefore remain explicit instead of hiding the transition between tools:
Agent
|
| "Change this asset and update the project."
v
Semwright
|
+--> Blender: inspect / author / export
|
+--> artifact.handoff: verify + transfer
|
+--> Godot: import / rescan / update
|
`--> readback + Effects: verify the bounded outcome
See architecture for the full model.
A typed Recipe captures a bounded multi-step procedure. Every step still re-enters normal broker policy and reference validation.
Project Graph records persistent project identity, dependencies, derivations and drift. It can tell higher-level workflows which outputs depend on which sources without turning stored identity into permission.
Effects evaluates observations inside a declared scope. Missing readback stays unknown instead of being promoted to a global success claim.
Choose the surface by what you are trying to connect:
| I want to… | Use |
|---|---|
| Integrate an application that already owns its model, storage, revisions or transactions | Native SDK |
| Build a persistent Semwright provider around an application API or long-lived session | Application Driver SDK |
| Add a narrow, stateless external command | Plugin SDK |
| Call Semwright from an agent or tool | CLI or MCP frontend |
| Bring an existing MCP server under the same broker | Governed MCP federation |
| Move a verified file-backed artifact between integrations | artifact.handoff in the Driver SDK |
The Native SDK builds on the Driver SDK rather than replacing it. Start with the Native SDK when the application remains the source of truth for its own state and only exposes optional cooperation contracts. Use the Driver SDK directly when implementing the lower-level persistent provider protocol and Host integration.
Drivers and plugins do not get ambient authority by existing. Their manifests, executable identity, resource limits and requested filesystem/network surfaces are validated before use, and each capability still enters broker policy.
Semwright is designed so that discovery does not imply permission and an agent cannot approve its own sensitive request.
Observe is the default. Input, clipboard contents, screenshots, application launching, plugins and application-native mutation require explicit authority. A separately granted unrestricted shell can bypass this mediated surface; sandboxing a child does not sandbox an already-running application; there is no claim of universal prompt-injection immunity.
Read SECURITY.md, permissions and the threat model. Report sensitive vulnerabilities through the repository's enabled private vulnerability-reporting channel, not a public issue.
Semwright is pre-v1 and has not published a public release. The current engineering line is closed for staging, and native candidate bundles are produced for Linux x86_64/aarch64, Windows x86_64/ARM64 and macOS arm64/x86_64.
| Track | Current state |
|---|---|
| Engineering closeout | Complete for the current pre-v1 line |
| Native candidate packages | Built and validated through exact-SHA distribution workflows |
| Physical / interactive certification | Remaining environment-dependent cases are explicit post-v1 work |
| Independent security review | Required before public v1 |
| Public release | Not published |
The detailed R06/R16/R18 history, exact run IDs and environment-specific limitations remain in the release and verification records rather than dominating this landing page. Nothing deferred is converted to PASS, and publication still requires the independent security review, explicit maintainer authorization and final exact-SHA validation defined by the release policy.
For exact evidence, use VERIFY.md, platform support,
compatibility, release blockers and
security. Historical records under verification/ preserve the
source and environment they actually tested.
- Installation and removal
- Troubleshooting
- Architecture
- Platform support
- Application Driver SDK
- Native application SDK
- Agent Skills
- Events and jobs
- Workflow Distillation
- Development
- Contributing
- Support
Focused pull requests are welcome. Keep technical and verification claims bound to the exact source, environment and scope that produced the evidence.
Original core source is MIT OR Apache-2.0.
The isolated integrations/kicad-driver subtree is GPL-3.0-or-later with its own notices.
See governance, changelog and the architecture documentation.