# endojs/endo

Endo is a distributed secure JavaScript sandbox, based on SES

Repository: https://github.com/endojs/endo
Canonical: https://ross.abutalabs.com/products/endo
Homepage: https://endojs.org/
Language: JavaScript
License: Apache-2.0
License Family: permissive
Topics: capabilities, captp, hardened, javascript, multi-tenant, ocaps, powerbox, prototype-pollution, security, supply-chain, sandbox
Last push: 2026-09-03T01:31:23+00:00

## Health v2 (maintenance only)
Score: 95/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 100, release rhythm 86, longevity 100
- inputs: {"age_days": 2492, "days_push": 0, "days_rel": 16, "gap_med": 0, "n_releases_24m": 102}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1053, forks 91 (observed 2026-09-03T02:15:11.644903+00:00)

## What it is
Endo is a JavaScript framework for building secure plugin systems and resisting supply chain attacks, built on the SES (Secure ECMAScript) implementation of Hardened JavaScript. It provides in-process confinement via compartments, object-capability security, and distributed communication through Eventual Send and capability transport protocols such as CapTP and OCapN.

## Use cases
- sandbox untrusted third-party javascript code inside my application
- run third-party plugins with least privilege in node or the browser
- protect my app against supply chain attacks from npm dependencies
- prevent runtime prototype pollution attacks in javascript
- call methods on remote objects securely across processes or the network
- harden javascript globals with frozen intrinsics and secure compartments
- pass messages safely between web workers
- build a multi-tenant system where components don't trust each other

## When to choose
- You need to execute untrusted or third-party JavaScript with strict in-process confinement rather than OS-level isolation
- You are building a plugin or smart-contract system where components must not gain ambient authority
- You need capability-based, transport-agnostic message passing between workers, processes, or network peers
- You maintain a security-critical web app or browser extension (like MetaMask) that must mitigate supply chain attacks

## When to avoid
- You only need general-purpose RPC or JSON serialization without security or capability guarantees
- You need to sandbox non-JavaScript code or require strong OS/process-level isolation
- Your codebase cannot adopt hardened JavaScript constraints such as frozen intrinsics and mandatory strict mode

## Facets
- artifact type: framework
- maturity: stable
- function: security, plugin-system, rpc, concurrency, serialization
- domain: security, developer-tools, microservices, web-development
- platform: browser, cross-platform
- tags: ses, hardened-javascript, sandbox, object-capabilities, capability-based-security, supply-chain-security, prototype-pollution, eventual-send, captp, ocapn, compartments, least-authority, secure-ecmascript, multi-tenant, nodejs

## Member repositories
- endojs/endo (main) score 95

## Provenance
- Observed fields: from GitHub, fetched 2026-09-03T02:15:11.644903+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:00:22.422207+00:00, confidence not recorded.
  - readme: https://github.com/endojs/endo (fetched 2026-09-03T02:15:11.644903+00:00, sha 02f5434a00a9)
  - homepage: https://endojs.org/ (fetched 2026-08-29T13:01:42.880722+00:00, sha df7440f54442)
  - site_page: https://endojs.org/about (fetched 2026-08-29T13:01:42.890598+00:00, sha 47dc3fa09beb)
  - site_page: http://docs.endojs.org/ (fetched 2026-08-29T13:01:42.892630+00:00, sha fbd8572b5995)
- Data as of 2026-08-30T08:39:29.467469+00:00.