@execbox/quickjs

Default execbox executor. It runs guest JavaScript in QuickJS and keeps the same API as you move between inline and worker-hosted execution.

Use @execbox/quickjs When

• you want the default execbox path with the easiest setup
• you do not want a native addon in local development or CI
• you want one package that can stay inline or move off-thread later

Install

npm install @execbox/core @execbox/quickjs

Smallest Working Usage

import { resolveProvider } from "@execbox/core";
import { QuickJsExecutor } from "@execbox/quickjs";

const provider = resolveProvider({
  name: "tools",
  tools: {
    echo: {
      execute: async (input) => input,
    },
  },
});

const executor = new QuickJsExecutor();
const result = await executor.execute(`await tools.echo({ ok: true })`, [
  provider,
]);

console.log(result);

Host Modes

QuickJsExecutor keeps the same execution API while changing where the runtime lives:

| Mode | Use it when | | ---------------- | --------------------------------------------------------------- | | Inline (default) | You want the smallest trusted-code path. | | host: "worker" | You want QuickJS off the main thread with pooled worker shells. |

const executor = new QuickJsExecutor({
  host: "worker",
  pool: {
    maxSize: 4,
    prewarm: true,
  },
});

await executor.prewarm();

Operational Notes

• Each execution gets a fresh QuickJS runtime with JSON-only tool and result boundaries.
• Inline mode and worker mode are local execution placement choices.
• Worker mode moves QuickJS off the main thread and keeps the same provider API.
• For hostile-code or multi-tenant deployments, put the application-level execution service behind a process, container, VM, or equivalent operational boundary.

Read Next

• Getting Started
• Providers & Tools
• Runtime Choices
• Examples
• Security & Boundaries
• MCP Integration