Introduction

maiden is a filesystem-first runtime for durable backend AI agents. You author an agent as a directory on disk, and a single self-contained Rust binary compiles and runs it — no platform, no deploy step, no framework to wire up.

Every capability an agent has is a file or a folder:

my-agent/
  agent.toml          # model + per-tool policy
  instructions.md     # the system prompt
  skills/*.md         # extra guidance appended to the prompt
  tools/*.wasm        # sandboxed WASI-P2 tools (Rust or JS, one ABI)
  connections/*.toml  # MCP servers and OpenAPI specs; their tools join the registry
  subagents/<name>/   # nested agent folders, callable as tools
  schedules/*.toml    # fire a prompt on a cron expression or an interval
  channels/*.toml     # inbound events (Slack, Telegram, GitHub, …) start a run
  hooks/*.rhai        # scripted policy around each turn
  evals/*.toml        # deterministic checks: a prompt + expected substrings
  sandbox.toml        # an optional Linux container for bash/read/write/grep

Point the binary at that folder and it runs:

# one-shot, against the model in agent.toml
maiden run my-agent "what's the weather in London?"

# offline and deterministic — no API key needed
maiden run my-agent "echo hello" --mock

# serve it over HTTP with durable per-thread resume
maiden serve my-agent --port 8080

The one idea

maiden keeps its concept count deliberately low. The whole system rests on a single unification: a WASM tool, a subagent, an MCP tool and an OpenAPI operation are all just Tools in one registry, dispatched through one path. Everything else — the agent loop, HTTP serving, schedules, channels — is built on top of that.

Read How maiden fits together for the shape of the system, or jump straight into building your first agent.

What makes it different

• The folder is the agent. No SDK, no config-in-code. Names derive from paths: tools/fetch.wasm is the tool fetch.
• Tools run in a WASM sandbox. Untrusted tool code executes inside wasmtime with a wall-clock deadline, a memory ceiling, and no ambient authority. See the security model.
• Runs are durable. Every thread is checkpointed after each turn, so killing and restarting the process resumes the conversation from disk. See the execution model.
• One binary. TLS is rustls, so a release build is a single static binary with no dynamic OpenSSL — it runs on a bare Linux box.

Scope

maiden is an early, standalone runtime — not a drop-in replacement for any other agent framework. It covers the agent spine end to end: instructions, skills, sandboxed WASM tools in Rust and JavaScript, MCP and OpenAPI connections, subagents with inherited token budgets, cron and interval schedules, seven channel types with signature verification, scripted hooks and dynamic capabilities, a Docker sandbox with built-in file and shell tools, structured output validated against a JSON Schema, HTTP serving with token streaming, durable resume, deterministic evals, and OpenAI + Anthropic backends.

Two things are deliberately left out to stay small: MCP transports beyond stdio, and durable schedule catch-up after downtime. Where a page describes a boundary like this, it says so plainly.

Lineage

maiden is an independent Rust implementation of the filesystem-first agent layout introduced by eve, released under Apache-2.0. The folder convention is kept deliberately — the shape of an agent should not be something you relearn per runtime.

It differs in where the machinery lives. maiden’s durable runtime, tool sandbox and provider calls are open and contained in the binary rather than hosted, so an agent runs the same on your laptop, a small VPS, or a machine with no outbound network at all.