Run Untrusted Third-party Tools Inside A Wasmtime Sandbox

Microsoft's security-oriented MCP runtime that loads WebAssembly components from OCI registries and exposes them as sandboxed agent tools. Built on Wasmtime with capability-based permissions, so untrusted tools run isolated from the host. Early development, Rust, MIT.

MCP | Rust · mcp-server · wasm