- Category
- Developer Tools
- Rank
- No. 1663Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- badlogic
- GitHub
- 37 stars
- Date
About
JavaScript AST interpreter for sandboxed code execution — safe eval for agent tools.
What it does
JailJS gives applications a programmable execution boundary for cooperative scripts. It parses JavaScript into a syntax tree, interprets that tree against selected globals, and can translate modern syntax into ES5 before execution. An operation counter can stop runaway computation.
Why it's ranked here
The design is compelling for plugins, user scripts, and browser extensions where the host controls inputs. Its separated parser and interpreter support lean runtime bundles, while custom globals make capabilities explicit. The verdict changes completely for hostile input: the project documents prototype pollution, escape vectors, and weak resource controls.
What's good
Native ES5 coverage includes closures, hoisting, prototypes, control flow, errors, and common operators. Optional Babel transformation handles classes, arrow functions, destructuring, spread, promises, async syntax, TypeScript, and JSX. Security tests openly demonstrate both blocked access routes and host prototype pollution.
Tradeoffs
Execution is roughly ten to one hundred times slower than native JavaScript. Generators, ES6 modules, proxies, reflection, weak references, shared memory, and atomics are unsupported. The operation counter limits interpreted work, but provides neither memory limits nor real elapsed-time enforcement. Built-in prototypes remain mutable.
How to use it well
Use JailJS for controlled plugin systems, user-authored automation, browser extensions, or pre-parsed scripts with a narrow set of supplied capabilities. Keep the exposed global surface minimal and apply operation limits. For adversarial or model-generated code, use a worker, sandboxed frame, separate process, or isolate instead.
Technical notes+
src/parser.ts wraps @babel/parser with script source mode and returns a Babel Program; callers may instead supply their own AST. src/interpreter.ts implements scoped AST evaluation, declaration hoisting, optional parser-backed eval, default globals, and maxOps accounting. src/transform.ts uses @babel/standalone with the environment preset, loose ES5 transforms, optional TypeScript and JSX presets, then reparses patched output. package.json publishes ESM and declaration files through root, parser, and transform exports. src/security.test.ts, src/interpreter.test.ts, and src/transform.test.ts use Vitest to cover language behavior, transformations, known vulnerabilities, and selected escape protections.
Observed
- License
- MIT
- Primary language
- TypeScript
- Installation
- Published on npm as @mariozechner/jailjs
- Packaging
- ES module package with JavaScript builds and TypeScript declarations
- Interface
- Importable library with separate root, parser, and transform entry points
- Platform support
- Browsers and Node.js
- Testing
- Vitest suites cover interpreter behavior, transformations, and security limitations
Read from README.md, package.json, src/index.ts, src/parser.ts, src/transform.ts, src/interpreter.ts, src/security.test.ts, src/transform.test.ts, src/interpreter.test.ts, vitest.config.ts, example/web/src/main.ts, example/node/src/index.ts, example/web/vite.config.ts, example/chrome-extension/src/content.ts, example/chrome-extension/src/sidepanel.ts.
What it can do
Execute JavaScript code safely in a sandbox
JavaScript code string → Execution result or error
Parse JavaScript code into Abstract Syntax Tree
JavaScript code string → AST representation
Interpret JavaScript AST nodes
JavaScript AST → Computed values
Evaluate JavaScript expressions without eval()
JavaScript expression → Expression result
Run untrusted JavaScript code securely
Untrusted JavaScript code → Safe execution result
Provide sandboxed environment for agent tools
Agent tool JavaScript code → Tool execution result
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.