Extism is a lightweight, BSD-3-Clause-licensed framework for running WebAssembly (Wasm) inside your own application, aimed at developers who want to make software extensible with untrusted, user-supplied plug-in code across servers, the edge, CLIs, IoT devices, and browsers.

What it is

Extism lives in the WebAssembly ecosystem as a framework plus a matched pair of libraries: SDKs that a host application imports, and PDKs (Plug-in Development Kits) that plug-in authors compile into their .wasm binary. The host runs the Extism SDK, loads a WebAssembly module, moves data across the boundary, and calls exported functions. Because the interface is deliberately "universal," the same plug-in contract holds whether the host is a Rust server process, a Node script, a Go CLI, or a browser page.

The concrete problem it solves is executing arbitrary, untrusted code supplied by users without handing that code the run of the machine. Extism is designed for plug-in and extension systems, and it replaces the hand-rolled sandbox, host-function plumbing, and memory management that teams otherwise build directly on top of a raw Wasm runtime. On top of the runtime it adds utilities that standard engines do not provide by default, including persistent memory and module-scope variables, secure host-controlled HTTP that works without WASI, runtime limiters and timers, and simpler host function linking.

Key capabilities

• Language SDKs that embed the runtime, including Rust (extism on Crates.io), JavaScript (@extism/extism on NPM, supporting Web, Node, Deno, and Bun), Elixir (Hex), Go (Go mod), Haskell (Hackage), Java (Sonatype), .NET for C# and F# (NuGet), OCaml (opam), Perl (CPAN), PHP (Packagist), Python (PyPI), Ruby (RubyGems), Zig, C, and C++.
• PDKs that let plug-in authors read host input, return data, read provided configuration, get and set variables, and make outbound HTTP calls when the host permits it.
• Persistent memory and module-scope variables that survive across calls into the same module.
• Host-controlled HTTP without WASI, so network access stays under the host's authority rather than the plug-in's.
• Runtime limiters and timers to bound how long plug-in code may run.
• Simpler host function linking for exposing native capabilities to a module.
• Prebuilt release targets for aarch64 and x86_64 on apple-darwin, unknown-linux-gnu, unknown-linux-musl, pc-windows-gnu, and pc-windows-msvc.

Who uses it and how

• Teams building plug-in systems use it to execute user-supplied .wasm modules inside their own process while keeping filesystem and network access under host control.
• FaaS platforms embed an SDK to run tenant code as short-lived Wasm modules with runtime limiters applied.
• Web applications use the JS SDK on Web, Node, Deno, or Bun to run modules in the same environment as the page or server.
• Edge, CLI, and IoT deployments rely on the published musl and gnu builds for Linux plus the Darwin and Windows targets.
• Code generators and similar tools use PDKs so extension authors can return generated output to the host through the standard interface.

Getting started

Install the SDK for your host language from its package manager, for example extism from Crates.io or @extism/extism from NPM, then refer to the documentation to load a module and call it. Plug-in authors separately add a PDK to their Wasm program so the compiled binary speaks the Extism interface.

How it compares

Among runtimes named in the project's own material, Extism's native path is its set of SDKs across fifteen host languages, while Android is pointed at the separate Chicory SDK, a pure Java Extism runtime. No managed hosting product is described anywhere in the project's facts; Extism is a framework and library set, not a hosted service.

When to use it — and when not

Choose Extism when the host application is yours to modify and you want plug-in execution without designing the sandbox, ABI, and host-function layer from scratch. Be aware that the host team owns everything operational around it: module distribution, sandbox configuration, and HTTP allowlisting, since the project describes no hosted or managed option and names no database, storage, or mail dependencies. Teams wanting a turnkey plug-in marketplace, or Android support without adding the Chicory SDK, are not the intended audience today.

</a>