KRATEHow to run AI-generated code safely
You did not read every line, and honestly you were not going to. The question is what the app can reach if it turns out to be wrong.
The real risk is not bad code, it is reach
Most AI-generated code is not malicious. It is confidently wrong. It deletes the wrong directory, uploads something it should not have, or loops until the disk fills.
Reading it all is not realistic once it is more than a page long. The useful question is not whether the code is correct, but what it can touch when it is not.
Look at it before you run it
You can inspect a Krate app without executing a single instruction:
$ krate run notes.krate --dump-caps Identity - 467e4b0e1124b7a8aa86fb1ce39909046508819d55f161e408e282de177b0f16 This app will ask for - read files in notes (fs.read:notes/**) - save files in notes (fs.write:notes/**) - read from the clipboard (ui.clipboard:read) - copy to the clipboard (ui.clipboard:write)
That is the real output. The identity is computed from the file's contents, so you can check that what you received is what somebody else verified.
Refusing actually refuses
Withhold something the app needs and it does not start. It does not run in a degraded mode and quietly fail later:
$ krate run notes.krate --grant ui.window:create This app needs permission it was not given, so it did not run. It needs to: - read files in notes (fs.read:notes/**) - save files in notes (fs.write:notes/**)
The check happens before the host is touched, not inside the app where a bug could skip it.
Why an app cannot lie about this
A Krate app is a WebAssembly component. It has no way to call the operating system directly — only Krate's own interfaces, and every one of those verifies the capability first.
An app that imports anything outside that boundary is rejected while it is being packaged, so it never becomes a shareable file at all. That check runs whether the code came from a person or a model.
What it does not claim
Krate limits what an app can reach and enforces your decision. It does not prove the app is correct, and it is not yet a safe way to run arbitrary untrusted software from the internet.
Saying so matters: a security claim that overstates itself is worse than a smaller true one.
Try it
Krate is open source and installs with one command. Nothing to sign up for.