Masanori Misono

agentsh. Execution-Layer Security (ELS) for AI agents — policy-enforced shell with audit.

bpfix. Making eBPF verifier errors as friendly as Rust compiler errors, and let LLM fix it.

AutoCorrode. Verification infrastructure for the Isabelle/HOL interactive proof assistant

bpfsnake. snake in bpftrace

btls. 🐝 bpftrace language server

wrap-buddy. Patch ELF binaries with stub loader for NixOS compatibility

miniosv. A radically slimmed-down hard fork of the OSv unikernel.

nanvix. Lightweight Sandbox Powered by a Purpose-Built VM and OS

tdx. Rust library for Intel TDX

sail-x86. Sail

defending-code-reference-harness. Skills for threat modeling, scanning, triage, patching, plus an autonomous scanning harness you can /customize

open-tdx-nix. Nix

hosthog. announce which resources you need on collaboratively used linux hosts

mxc. Policy-driven, layered isolation and containment

arbitrary. Generating structured data from arbitrary, unstructured input.

Webwright. A simple SWE style browser agent framework that achieves SOTA results on long horizon web tasks.

private-compute-services. Kotlin

agent-sandbox. agent-sandbox enables easy management of isolated, stateful, singleton workloads, ideal for use cases like AI agent runtimes.

GuitarPedal. Linus learns analog circuits

confidential-computing.tdx.tdx-module. Trust Domain Extensions (TDX) is introducing new, architectural elements to help deploy hardware-isolated, virtual machines (VMs) called trust domains (TDs). Intel TDX is designed to isolate VMs from the virtual-machine manager (VMM)/hypervisor and any other non-TD software on the platform to protect TDs from a broad range of software.

u2f-enclave. A FIDO2/CTAP2 authenticator that runs as its own confidential VM (AMD SEV-SNP/Intel SGX)

ironcurtain. A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)

ritm. A reference implementation for enabling hypervisor policy enforcement on Android devices.

secureboot_objects. Secure boot objects recommended by Microsoft.

nono. Sandbox any AI agent in seconds - zero setup, zero latency.

opencrow. Personal AI assistant via Matrix Chat - A slightly saner alternative to OpenClaw

bf-tree-docs. Bf-Tree: A Modern Read-Write-Optimized Concurrent Larger-Than-Memory Range Index

review-prompts. AI review prompts

sashiko. Agentic review of Linux Kernel code changes

secretive. Protect your SSH keys with your Mac's Secure Enclave

oak. Meaningful control of data in distributed systems.

hvisor. safe type-1 Rust Hypervisor for edge devices

wave. Wave: Python Domain-Specific Language for High Performance Machine Learning

nixos-config-tui. A TUI to browse and diff NixOS configurations at the config-level

f9-kernel. An efficient and secure microkernel built for ARM Cortex-M cores, inspired by L4

moss-kernel. Rust Linux-compatible kernel

go-tpm. Go

security-research. This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

drawio-mcp. JavaScript

EDM. An EDM-enabled PHY + a rack-level network simulator

DeepEP. DeepEP: an efficient expert-parallel communication library

pplx-garden. Perplexity open source garden for inference technology

scope. Code for ASPLOS 2026 paper: "Detecting Inconsistencies in ARM CCA’s Formally Verified Specification"

incognitos. C

litebox. A security-focused library OS supporting kernel- and user-mode execution

bf-tree. Bf-Tree is a modern read-write-optimized concurrent larger-than-memory range index in Rust from MS Research.

vmscape. Artefacts for: "VMScape: Exposing and Exploiting Incomplete Branch Predictor Isolation in Cloud Environments"

ariel-os. Ariel OS is a library operating system for secure, memory-safe, low-power Internet of Things, written in Rust

scx_horoscope. Astrological CPU Scheduler

PureDOOM. Pure DOOM - Single Header Doom Source Port

cvm-side-channel-analysis. Python

MiniVisor. A minimum Type1 Hypervisor for AArch64

ACE-RISCV. Assured confidential execution (ACE) implements VM-based trusted execution environment (TEE) for embedded RISC-V systems with focus on a formally verified and auditable firmware.

StackWarp. Proof-of-concept for the paper "StackWarp: Breaking AMD SEV-SNP Integrity via Deterministic Stack-Pointer Manipulation through the CPU’s Stack Engine" (USENIX Security 2026)

xous-core. The Xous microkernel

printf. Tiny, fast, non-dependent and fully loaded printf implementation for embedded systems. Extensive test suite passing.

mquickjs. Public repository of the Micro QuickJS Javascript Engine

llfree-linux. LLFree in the Linux kernel

usbvfiod. A tool for USB device pass-through using the vfio-user protocol.

bitvisor. Read-only mirror of BitVisor (https://sourceforge.net/p/bitvisor/code/)

artifact_NecoFuzz. C

attestation. in-toto Attestation Framework

libaegis. Portable C implementations of the AEGIS family of high-performance authenticated encryption algorithms.

omniglot. Safe Interactions with Foreign Languages through Omniglot

mu_plus. Project Mu Microsoft Core UEFI Value

xterm.js. A terminal for the web

ttyd. Share your terminal over the web

cache_ext. cache_ext is a framework to customize Linux page cache eviction policies using BPF. Appeared in SOSP 2025.

qpdf. qpdf: A content-preserving PDF document transformer

aibrix. Cost-efficient and pluggable Infrastructure components for GenAI inference

ddio-bench. Reexamining Direct Cache Access to Optimize I/O Intensive Applications for Multi-hundred-gigabit Networks

ASNI. ASNI

svc-hook. System Call Hook for ARM64

secure-transformer-inference. [NDSS 2026] Secure Transformer Inference is a protocol for serving Transformer-based models securely.

MoonGen. MoonGen is a fully scriptable high-speed packet generator built on DPDK and LuaJIT. It can saturate a 10 Gbit/s connection with 64 byte packets on a single CPU core while executing user-provided Lua scripts for each packet. Multi-core support allows for even higher rates. It also features precise and accurate timestamping and rate control.

emt. EMT: An OS Framework for New Memory Translation Architectures

motor-os. A simple, fast, and secure operating system for the cloud.

incus. Powerful system container and virtual machine manager

incus-os. Immutable Linux OS to run Incus

attestation-sdk. C++ SDK that provides resources for implementing and validating Trusted Computing Solutions on NVIDIA hardware

FUJITSU-MONAKA.

linux-wasm. WebAssembly (Wasm) arch support for the Linux kernel

sailor_artifact. Artifact for the USENIX Security 2025 Paper: https://www.usenix.org/conference/usenixsecurity25/presentation/kalani

ssd-gpu-dma. Build userspace NVMe drivers and storage applications with CUDA support

coralnpu. A machine learning accelerator core designed for energy-efficient AI at the edge.

jingle. An FFI for Ghidra's Sleigh also providing SMT modeling and analysis

TDXplorer. C++

cyme. List system USB buses and devices. A modern cross-platform lsusb that attempts to maintain compatibility with, but also add new features

batteringram. Artifact for "Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing"

DeepSpeed. DeepSpeed is a deep learning optimization library that makes distributed training and inference easy, efficient, and effective.

mozc-devices. Circuit diagrams and firmware source code for Gboard DIY keyboards

accel-sim-framework. This is the top-level repository for the Accel-Sim framework.

microsandbox. 🧱 easy, fast and local-first microVM runtime

hopter. A Rust-based embedded operating system designed to enable memory-safe, robust, and responsive embedded applications.

pie. Pie: Programmable LLM Serving

hugin. Hugin. The type-1 hypervisor on aarch64.

Mooncake. Mooncake is the serving platform for Kimi, a leading LLM service provided by Moonshot AI.

codex. Lightweight coding agent that runs in your terminal

DeepResearch. Tongyi Deep Research, the Leading Open-source Deep Research Agent

marconi. Artifact for "Marconi: Prefix Caching for the Era of Hybrid LLMs" [MLSys '25 Outstanding Paper Award, Honorable Mention]

Asus-ROG-Aml-Deep-Dive. A deep dive into the ACPI.sys DPC latency problems on Asus ROG laptops

Python-BPF. Write eBPF programs in Pure Python

mllm. Fast Multimodal LLM on Mobile Devices

LAKE. C

borg. Deduplicating archiver with compression and authenticated encryption.

PurpleLlama. Set of tools to assess and improve LLM security.

hypervisor-in-1000-lines. Writing a hypervisor in 1,000 lines.

agni. Python

rex. Rex is a safe and usable kernel extension framework that allows loading and executing Rust kernel extension programs in the place of eBPF.

HEDB. Towards A Secure Yet Maintainable Encrypted Database

nvmevirt. NVMeVirt: A Versatile Software-defined Virtual NVMe Device

rfuse. RFUSE: Modernizing Userspace Filesystem Framework through Scalable Kernel-Userspace Communication

NDSS24-CAGE.

fides. Flow Integrity Deterministic Enforcement System. Mechanisms for securing AI agents with information-flow control.

AnyBlob. AnyBlob - A Universal Cloud Object Storage Download Manager Built For Cost-Throughput Optimal Analytics!

wallet_tamarin. Makefile

RDMI. This is the repo for remote direct memory introspection.

gpuhammer. Cuda

tilck. A Tiny Linux-Compatible Kernel

urunc. a simple container runtime that aspires to become `runc` for unikernels

snp-svsm-vtpm. AMD SEV-SNP PoC with SVSM, KBS proxy, virtio-blk device, and stateful vTPM

open-tdx. Shell

ChatDBG. ChatDBG - AI-assisted debugging. Uses AI to answer 'why'

hyperturtle. Meta repository for the USENIX ATC'25 Publication "Accelerating Nested Virtualization with HyperTurtle"

tinykvm. VMM for native-performance sandboxing

nano-vllm. Nano vLLM

mirage. Mirage Persistent Kernel: Compiling LLMs into a MegaKernel

libkcapi. Linux Kernel Crypto API User Space Interface Library

sigmaos. Go

CarbonExplorer. Carbon Explorer helps evaluating solutions make datacenters operate on renewable energy.

r9. The R9 operating system

container. A tool for creating and running Linux containers using lightweight virtual machines on a Mac. It is written in Swift, and optimized for Apple silicon.

container-use. Development environments for coding agents. Enable multiple agents to work safely and independently with your preferred stack.

fms-fsdp. 🚀 Efficiently (pre)training foundation models with native PyTorch features, including FSDP for training and SDPA implementation of Flash attention v2.

PipeLLM. C++

tiktag. TikTag: Breaking ARM's Memory Tagging Extension with Speculative Execution (IEEE S&P 2025)

EXO. Shell

GeminiFS. GeminiFS: A Companion File System for GPUs

CSMWrap. Get PC BIOS back on UEFI only systems.

WSL. Windows Subsystem for Linux

octox. Unix-like OS in Rust inspired by xv6-riscv

diffsitter. A tree-sitter based AST difftool to get meaningful semantic diffs

fastsafetensors. High-performance safetensors model loader

toolkami. Simple Agents Made Easy

machnet. Machnet provides applications like databases and finance an easy way to access low-latency DPDK-based messaging on public cloud VMs. 750K RPS on Azure at 61 us P99.9.

felix86. Run x86 and x86-64 games on RISC‑V Linux

iaprof. AI/GPU flame graph

tiny-llm. A course of learning LLM inference serving on Apple Silicon for systems engineers: build a tiny vLLM + Qwen.

AtomicDisk. A Secure Virtual Disk for TEEs against Eviction Attacks

dmt. This is the source code for our paper "On Scalable Integrity Checking for Secure Cloud Disks" published in USENIX FAST 2025.

hcc-ispass25-artifact. Artifact for ISPASS'25 paper: Dissecting Performance Overheads of Confidential Computing on GPU-based Systems

asgard. The artifact for NDSS '25 paper "ASGARD: Protecting On-Device Deep Neural Networks with Virtualization-Based Trusted Execution Environments"

Erebor. Erebor: A Drop-In Sandbox Solution for Private Data Processing in Untrusted Confidential Virtual Machines, ACM EuroSys'25

arceos. An experimental modular OS written in Rust.

site-attestation. This is the code repository for the paper 'Site Attestation: Browser-based Remote Attestation', which was presented at the 18th EuroSec workshop co-located with the EuroSys'25 conference.

vmi. Modular and extensible library for Virtual Machine Introspection

verifier-analysis. Jupyter Notebook

PhoenixOS. Fast OS-level support for GPU checkpoint and restore

OS-Course-Lab. 本仓库包含上海交通大学IPADS实验室设计的操作系统课程系列实验，以及前置课程ICS/CSAPP的系列实验。

l4re-core. The core components of the L4Re operating system.

hikami. A lightweight Type-1 hypervisor for RISC-V H-extension, featuring RISC-V extension emulation. (on Milk-V Megrez)

A9N. Capability-based 3rd-generation Microkernel/Microhypervisor with High-speed IPC Mechanism.

linux. Linux kernel source tree for PVM

EfiGuard. Disable PatchGuard and Driver Signature Enforcement at boot time

btree24. C++

BitBLAS. BitBLAS is a library to support mixed-precision matrix multiplications, especially for quantized LLM deployment.

T-MAC. Low-bit LLM inference on CPU/NPU with lookup table

vminer. Rust

acsac24-paper240-ae. C

pebble. This is the latest version of the internal repository from Pebble Technology providing the software to run on Pebble watches. Proprietary source code has been removed from this repository and it will not compile as-is. This is for information only.

badram. C

retis. Tracing packets in the Linux networking stack & friends

mlc-llm. Universal LLM Deployment Engine with ML Compilation

bpfman. An eBPF Manager for Linux and Kubernetes

storm. An LLM-powered knowledge curation system that researches a topic and generates a full-length report with citations.

cline. Autonomous coding agent as an SDK, IDE extension, or CLI assistant.

zakuro-os. Zig port of x64 MikanOS: an experimental, educational, and toy OS.

mikanos. Educational Operating System

lazypoline. The lazypoline syscall interposer

simbricks. Main Repository for the SimBricks Modular Full-System Simulation Framework.

barevisor. A bare minimum hypervisor on AMD and Intel processors for learners.

writing-hypervisor-in-zig. Writing Type-1 Hypervisor in Zig from scratch.

ymir. Ymir: The Type-1 Hypervisor.

icecap. Veracruz branches of https://gitlab.com/arm-research/security/icecap/icecap

verify-rust-std. Verifying the Rust standard library

hvmi. Hypervisor Memory Introspection Core Library

jbpf. Userspace eBPF instrumentation and control framework for deploying control and monitoring functions in a secure manner

sarathi-serve. A low-latency & high-throughput serving engine for LLMs

composite. A component-based OS

pKVM-IA. pKVM POC for x86

verus. Verified Rust for low-level systems code

Fast-and-Safe-IO-Memory-Protection. Shell

PoBF. Proof of Being Fogotten (PoBF) and PoBF-Compliant Framework (PoCF) prototypes.

raft-lite. Raft Lite is a very simple and verified implementation of the Raft consensus algorithm.

hyperlight. Hyperlight is a lightweight Virtual Machine Manager (VMM) designed to be embedded within applications. It enables safe execution of untrusted code within micro virtual machines with very low latency and minimal overhead.

starina. Rust

EagleVM. Native code virtualizer for x64 binaries

libkrunfw. A dynamic library bundling the guest payload consumed by libkrun

muvm. muvm - run programs from your system in a microVM

libkrun. A dynamic library providing Virtualization-based process isolation capabilities