semwright

Use real software from any AI agent.

An open runtime that connects AI agents to desktop and professional applications through
structured operations, native APIs, and governed system interfaces.

Connect your tools once. Use them from any compatible agent.

Quick start · Installation · Documentation · Drivers · Verification

AI agent  →  Semwright  →  Blender · Godot · Browser · LibreOffice · Figma · KiCad · …

One prompt. A connected creative workflow.

Watch Semwright update an aircraft’s materials in Blender, render a new camera shot, generate branded titles in Motion Canvas, and assemble the video with audio through MLT—all using Semwright’s drivers.

Recorded in one take using an existing aircraft project. Waiting periods are accelerated; the final playback runs at normal speed. The workflow produces a new video and an editable timeline.

Watch the 60-second demo.

Why Semwright?

AI agents can reason about a task. Reliably operating real software is a different problem: application objects have identity and state, UI layouts move, mutations have side effects, and every agent should not need its own one-off automation stack.

Semwright exposes real applications as structured operations behind one authorization boundary. It prefers the strongest interface available—application/native APIs first, semantic accessibility and governed system interfaces when needed, and controlled input or capture as explicit fallbacks. Every operation still passes through the same broker, policy and audit path.

• Structured operations first. Use application objects and typed commands instead of reducing every task to screenshots and coordinates.
• One authorization boundary. CLI, MCP, Recipes, drivers and federated providers do not create separate privilege systems.
• One runtime across compatible agents. Change the agent without rebuilding every application integration from scratch.
• Read back what happened. Effects and application observations keep requested, expected and observed outcomes distinct.
• Keep project state coherent. Project Graph can track identity, dependencies and drift across repeated work instead of treating every run as a blank slate.
• Local and inspectable. The OSS runtime can operate locally; discovery is not permission, sensitive actions can require operator approval, and execution is auditable.

A typical path looks like this:

Agent request             Semwright                              Software
"change this material" → typed operation → policy → readback → Blender
"update this scene"    → typed operation → policy → readback → Godot
"export this document" → typed operation → policy → artifact → LibreOffice
"find the Save button" → semantic query  → policy → reference → accessibility

Support is scoped per integration; a green fixture does not automatically certify every version or interactive environment.

Try Semwright

1. Install the native bundle — no Rust build required

Download the matching bundle and SHA256SUMS from Semwright v1.0.0. Verify its checksum, extract the archive, and run its included helper:

Every portable bundle includes the matched CLI, daemon, MCP frontend, TUI and sandbox helper, plus checksums and reversible user-local installers. Install the core once and choose which interface to use; CLI/TUI/MCP are not separate versioned downloads. Optional application integrations remain separate.

Three-step quick start → · Full installation, checksums and removal →

2. Run semwright setup

The installer prints the exact installed command, so onboarding does not depend on PATH. Setup is local, idempotent and non-overwriting: it creates an observe-only config plus a ready-to-copy MCP snippet, but grants no desktop authority and starts no background service.

3. Start the broker and verify

Setup prints the exact broker, doctor, TUI and MCP paths for the current platform. Start the broker, then run the printed doctor command from another terminal. semwright-inspect opens the read-only terminal UI and the generated mcp-client.json points at the exact installed semwright-mcp.

Develop from source with the synthetic desktop

For contributors, the repository also includes a synthetic desktop path. It exercises the real daemon, CLI, Recipe runner and policy path without connecting to your real desktop or credentials. This is the source-build path, not the normal installation path.

On Ubuntu 24.04 x86_64, install the development prerequisites, then:

git clone https://github.com/seradotcom/semwright.git
cd semwright

cargo build --locked -p semwright-daemon -p semwright-cli --bins
BIN_DIR=target/debug ./scripts/dev/fake-smoke.sh

The smoke will:

1. start an isolated fake Semwright daemon;
2. discover one exact Export control;
3. run a typed recipe through normal policy and dispatch;
4. report the observed changed result and audit metadata;
5. stop the daemon and remove the temporary runtime.

This is a functional first-use path, not live-desktop certification or a security verdict.

Cargo.lock is committed. Keep it and use --locked; do not run scripts/dev/bootstrap.sh on an ordinary checkout. For the full build, per-user installation, portable package layout and uninstall flow, use the installation guide.

Connect your agent

Semwright exposes a deliberately small MCP frontend that routes back through the same broker, policy, references and audit path as the CLI.

semwright setup writes a ready-to-copy MCP client snippet using the exact installed executable path for the current platform. Its shape is:

{
  "mcpServers": {
    "semwright": {
      "command": "<absolute path to semwright-mcp>"
    }
  }
}

The MCP process does not grant desktop authority, approve mutations or start the broker for you. See MCP for socket/session configuration and governed MCP federation for connecting external MCP providers.

Native application SDK

Applications that already own their model, persistence and transactions can integrate through the Native SDK instead of adopting a Semwright-specific storage model. The SDK exposes small optional cooperation contracts, adapts them through the canonical Driver SDK/Driver Host, and keeps Broker/Policy, Project Graph and Effect Conformance as the existing authorities. Rust and TypeScript surfaces, a file-backed reference profile and an application-owned SQLite example are included in the repository. The portable SDK baseline has executed on Linux, Windows and macOS across x64/ARM64 where native hosted runners are available; the real Host E2E is currently an accepted Linux profile. See the Native SDK verification.

Applications

Semwright has application-specific integrations in addition to generic desktop/platform backends. The table below is intentionally compact; it describes the integration path, not a blanket support certificate.

Full details live in the platform matrix, compatibility matrix, Driver SDK guide and each integration's own README.

How it works

compatible agent / MCP / CLI
            |
            v
+-----------------------------+
|          Semwright          |
| discovery · schemas · refs  |
| policy · approvals · audit  |
| jobs · artifacts · Effects  |
+-------------+---------------+
              |
       Provider Runtime
              |
      strongest available path
              |
      +-------+-------------------------------+
      |                                       |
      v                                       v
application/native APIs              semantic/system interfaces
      |                                       |
      +-------------------+-------------------+
                          |
                          v
                  controlled fallbacks
                   (input / capture)
                          |
                          v
                   real applications

Semwright does not replace MCP or an agent SDK. MCP is one way to reach the runtime and one kind of provider Semwright can govern. The execution layer is responsible for capability discovery, policy, application identity, bounded jobs, references, artifact handoff and audit.

A cross-application workflow can therefore remain explicit instead of hiding the transition between tools:

Agent
  |
  |  "Change this asset and update the project."
  v
Semwright
  |
  +--> Blender: inspect / author / export
  |
  +--> artifact.handoff: verify + transfer
  |
  +--> Godot: import / rescan / update
  |
  `--> readback + Effects: verify the bounded outcome

See architecture for the full model.

Reuse work and keep projects coherent

Recipes — reuse a successful procedure

A typed Recipe captures a bounded multi-step procedure. Every step still re-enters normal broker policy and reference validation.

Learn about Recipes →

Project Graph — know what became stale

Project Graph records persistent project identity, dependencies, derivations and drift. It can tell higher-level workflows which outputs depend on which sources without turning stored identity into permission.

Learn about Project Graph →

Effects — verify what actually happened

Effects evaluates observations inside a declared scope. Missing readback stays unknown instead of being promoted to a global success claim.

Learn about Effects →

Build an integration

Choose the surface by what you are trying to connect:

The Native SDK builds on the Driver SDK rather than replacing it. Start with the Native SDK when the application remains the source of truth for its own state and only exposes optional cooperation contracts. Use the Driver SDK directly when implementing the lower-level persistent provider protocol and Host integration.

Drivers and plugins do not get ambient authority by existing. Their manifests, executable identity, resource limits and requested filesystem/network surfaces are validated before use, and each capability still enters broker policy.

Security

Semwright is designed so that discovery does not imply permission and an agent cannot approve its own sensitive request.

Observe is the default. Input, clipboard contents, screenshots, application launching, plugins and application-native mutation require explicit authority. A separately granted unrestricted shell can bypass this mediated surface; sandboxing a child does not sandbox an already-running application; there is no claim of universal prompt-injection immunity.

Read SECURITY.md, permissions and the threat model. Report sensitive vulnerabilities through the repository's enabled private vulnerability-reporting channel, not a public issue.

Status

Semwright 1.0.0 provides native bundle formats for Linux x86_64/aarch64, Windows x86_64/ARM64 and macOS arm64/x86_64. Application support stays scoped to each driver’s verified operations.

The 1.0.0 source is prepared for final release validation. Public assets become available only after final exact-SHA distribution/certification and genuine independent security review pass. Until publication, the release and demo download links above are reserved destinations.

Physical Hyprland and unlocked-Windows interactive certification remain explicit post-v1 work. Windows external-MCP filesystem mounts remain fail-closed where path virtualization is unproven; macOS TCC, signing and notarization are separate from hosted package validation.

The release policy requires an authentic external review of the frozen SHA, zero blocking findings, explicit maintainer authorization and final installation validation. Green CI alone does not approve publication or establish a formal security guarantee.

For exact evidence, use VERIFY.md, platform support, compatibility, release blockers and security. Historical records under verification/ preserve the source and environment they actually tested.

Documentation and contributing

• Installation and removal
• Troubleshooting
• Architecture
• Platform support
• Application Driver SDK
• Native application SDK
• Agent Skills
• Events and jobs
• Workflow Distillation
• Development
• Contributing
• Support

Focused pull requests are welcome. Keep technical and verification claims bound to the exact source, environment and scope that produced the evidence.

License

Original core source is MIT OR Apache-2.0.

The isolated integrations/kicad-driver subtree is GPL-3.0-or-later with its own notices.

See governance, changelog and the architecture documentation.