Automic VaultAutomic Vault

brew

Install wasmtime with Homebrew, apk, MacPorts, Nix, pacman, scoop, winget

Standalone JIT-style runtime for WebAssembly, using Cranelift. Version 46.0.1 via Homebrew; verified 2026-06-24.

install

Additional install commands

macOS

Homebrewverified · 100%
brew install wasmtime

local Homebrew formula metadata

MacPortsverified · 94%
sudo port install wasmtime

MacPorts ports tree · devel/wasmtime/Portfile · source: api.github.com

Linux

Alpine Linux apkverified · 92%
sudo apk add libwasmtime

Alpine Linux edge package indexes · libwasmtime · source: dl-cdn.alpinelinux.org

Nixverified · 92%
nix profile install nixpkgs#wasmtime

nixpkgs package indexes · pkgs/by-name/wa/wasmtime/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%
sudo pacman -S wasmtime

Arch Linux sync databases · wasmtime · source: geo.mirror.pkgbuild.com

Windows

Scoopverified · 92%
scoop install main/wasmtime

Scoop official bucket manifest trees · bucket/wasmtime.json · source: api.github.com

Windows Package Managerverified · 92%
winget install --id BytecodeAlliance.Wasmtime -e

Windows Package Manager source index · BytecodeAlliance.Wasmtime · source: cdn.winget.microsoft.com

overview

Package summary

Standalone JIT-style runtime for WebAssembly, using Cranelift

Commands and aliases

  • wasmtime

history

Project history and usage

Wasmtime is the Bytecode Alliance's standalone runtime for WebAssembly, WASI, and the WebAssembly Component Model. It is built around the Cranelift code generator and is used both as a command-line tool and as an embeddable engine for applications that need a capability-oriented Wasm sandbox.

Project history

Wasmtime became one of the founding project contributions to the Bytecode Alliance when Mozilla, Fastly, Intel, and Red Hat announced the alliance on November 12, 2019. The formation announcement described Wasmtime as a small and efficient runtime for WebAssembly and WASI, alongside Lucet, WAMR, and Cranelift.

The Mozilla announcement for the Bytecode Alliance framed Wasmtime as a configurable and scalable standalone runtime that could work as a CLI tool or be embedded into other systems, from IoT devices to cloud data centers. That early positioning explains why Wasmtime has remained both a developer executable and a library API.

Wasmtime reached 1.0 on September 20, 2022. The Bytecode Alliance announcement said the runtime was ready for production use and noted that alliance members had already been running Wasmtime in production environments during the preceding year.

After 1.0, Wasmtime continued to track standards work around WASI and the Component Model. Bytecode Alliance documentation identifies Wasmtime as the reference implementation of the Component Model, with support for command components, HTTP components through wasmtime serve, and later WASI 0.3 runtime support in Wasmtime 43 and newer.

Adoption history

Wasmtime's adoption is unusually standards-centered. Because the same organization stewards Cranelift, WASI tooling, wasm-tools, and Component Model documentation, Wasmtime often serves as the runtime people try first when experimenting with new WebAssembly proposals outside the browser.

It is also embedded into higher-level platforms. wasmCloud documentation describes Wasmtime as a Bytecode Alliance runtime that can be used standalone or as part of a larger stack, supporting WebAssembly, WASI, and the Component Model while providing a defense-in-depth runtime for wasmCloud workloads.

The runtime's security posture is part of its adoption story. Bytecode Alliance writing before the 1.0 release emphasized correctness, fuzzing, formal verification work, multi-stakeholder investment, and security processes as reasons the project considered itself ready for production.

How it is used

CLI users run .wasm modules or components with wasmtime run, expose only selected host capabilities, and can serve WASI HTTP components with wasmtime serve. Library users embed Wasmtime through Rust, C, Python, .NET, Go, and other bindings to execute untrusted or portable code inside a host application.

Wasmtime is a default choice when the goal is standards conformance, WASI experimentation, component-model execution, or a capability-secure plugin system. It is less about being a package registry or product platform than about being the runtime substrate other tools build on.

Why package nerds care

Wasmtime is significant because it made WASI and the Component Model concrete for package authors. It gave package managers, plugin systems, and platform teams a runnable target for artifacts that are not tied to a browser, CPU architecture, or one source language.

Its presence in the Bytecode Alliance also means its release notes and APIs often reveal where the Wasm ecosystem is going next: new proposals, new WASI versions, host bindings, component execution, and cross-language interface tooling.

Timeline

  • 2019-11-12: Bytecode Alliance launched with Wasmtime, Lucet, WAMR, and Cranelift among its founding project contributions.
  • 2022-09-20: Wasmtime 1.0 was released and declared production ready by the Bytecode Alliance.
  • 2023: Bytecode Alliance tooling compatibility documentation listed Wasmtime 7.0.0 with component-model support.
  • 2024-01-25: WASI 0.2.0 became a stable Component Model target, strengthening Wasmtime's role as a reference runtime.
  • 2026: Bytecode Alliance documentation describes Wasmtime 43 and later as supporting WASI 0.3 runtime features.

Related projects

  • Cranelift is Wasmtime's optimizing code generator and a core Bytecode Alliance project.
  • Lucet, Fastly's earlier AOT WebAssembly runtime, was part of the original Bytecode Alliance project set and was refactored toward Wasmtime at its core.
  • WAMR, WasmEdge, Wasmer, wazero, Spin, runwasi, and wasmCloud are common comparison or integration points.
  • WASI, WIT, wasm-tools, and the WebAssembly Component Model are standards and tools tightly connected to Wasmtime's ecosystem role.

Sources

security posture

Risk level: yellow

generalized runtime or code generation signal.

Risk classifier

yellow risk · medium confidence · runtime

Why

  • generalized runtime or code generation signal

Signals

  • text:runtime,jit

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Build metadata lists 2 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
wasmtimecliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version46.0.1
manager updated2026-06-24
local dataok
upstreamnot checked
latest detectednot detected

https://github.com/bytecodealliance/wasmtime

install metadata

Package metadata

Package keybrew:wasmtime
Version46.0.1
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/wasmtime
Homepagehttps://wasmtime.dev/
Repositoryhttps://github.com/bytecodealliance/wasmtime
Upstream docshttps://component-model.bytecodealliance.org/running-components/wasmtime.html
LicenseApache-2.0 WITH LLVM-exception
Source archivehttps://github.com/bytecodealliance/wasmtime.git
Last updated2026-06-24T22:53:31Z
Pulseupdated
Build dependenciescmake, rust
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namewasmtime
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

wasmtime

nix profile install nixpkgs#wasmtime
  • normalized package name match
  • Matched by: Wasmtime
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/wa/wasmtime/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
apk95%

libwasmtime 44.0.1-r0

Fast and secure runtime for WebAssembly

https://wasmtime.dev/

sudo apk add libwasmtime
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: wasmtime
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Wasmtime
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: libwasmtime from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
apk95%

libwasmtime-static 44.0.1-r0

Fast and secure runtime for WebAssembly (static library)

https://wasmtime.dev/

sudo apk add libwasmtime-static
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: wasmtime
  • normalized package name match
  • Matched by: Wasmtime
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: libwasmtime-static from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
apk95%

wasmtime 44.0.1-r0

Fast and secure runtime for WebAssembly

https://wasmtime.dev/

sudo apk add wasmtime
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: wasmtime
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Wasmtime
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: wasmtime from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
apk95%

wasmtime-dev 44.0.1-r0

Fast and secure runtime for WebAssembly (development files)

https://wasmtime.dev/

sudo apk add wasmtime-dev
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: wasmtime
  • 1 dependencies
  • normalized package name match
  • Matched by: Wasmtime
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: wasmtime-dev from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
pacman95%

wasmtime 45.0.1-1

Standalone JIT-style runtime for WebAssembly, using Cranelift

https://github.com/bytecodealliance/wasmtime

sudo pacman -S wasmtime
  • License: Apache-2.0
  • Architecture: x86_64
  • 1 dependencies
  • normalized package name match
  • Matched by: Wasmtime
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: wasmtime from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
MacPorts95%

wasmtime

sudo port install wasmtime
  • normalized package name match
  • Matched by: Wasmtime
MacPorts ports tree · api.github.com · MacPorts ports tree: devel/wasmtime/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1
Scoop95%

main/wasmtime

scoop install main/wasmtime
  • normalized package name match
  • Matched by: Wasmtime
Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/wasmtime.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1
winget95%

BytecodeAlliance.Wasmtime

winget install --id BytecodeAlliance.Wasmtime -e
  • normalized package name match
  • Matched by: Wasmtime
Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: BytecodeAlliance.Wasmtime from https://cdn.winget.microsoft.com/cache/source.msix
winget95%

BytecodeAlliance.Wasmtime.Portable

winget install --id BytecodeAlliance.Wasmtime.Portable -e
  • normalized package name match
  • Matched by: Wasmtime
Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: BytecodeAlliance.Wasmtime.Portable from https://cdn.winget.microsoft.com/cache/source.msix

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment