Sandbox
@microsoft/wassette

MCP server for WebAssembly components

Wassette is a security-oriented runtime that exposes WebAssembly Components to AI agents through MCP. You register it with your agent, then load components from OCI artifacts and call them as tools inside a Wasmtime sandbox.

942 stars72 forksRustUpdated 7d ago
Who it's for

Builders who want their agent to call reusable WebAssembly tools through MCP.

What it delivers

You can add new agent tools without leaving chat, while keeping those tools isolated in a WebAssembly sandbox.

What it does

Runs WebAssembly components through MCP

Exposes components as tools that MCP clients can load and invoke.

Uses Wasmtime for isolation

Runs components in a security sandbox so tool execution stays separated from the host.

Loads components from OCI artifacts

Supports `oci://` component references such as the time component shown in the README.

Supports multiple MCP clients

The docs cover setup for GitHub Copilot, Copilot CLI, Claude Code, and Codex CLI.

Includes example components

Provides sample components in `examples/` for time, weather, search, files, GitHub, memory, and more.

Adds policy and conversion helpers

Includes `crates/policy` and `crates/component2json` for policy handling and component metadata work.

How to get it

  1. 1Quick start: For Linux/macOS, use our one-liner install script
    curl -fsSL https://raw.githubusercontent.com/microsoft/wassette/main/scripts/install.sh | bash

README

Wassette

A security-oriented runtime that runs WebAssembly Components via MCP

Quick Start | FAQ | Documentation | Releases | Contributing | Discord

[!WARNING] Early Development: This repository is not production ready yet. It is in early development and may change significantly.

Why Wassette?

  • Convenience: Wassette makes it easy to extend AI agents with new tools, all without ever having to leave the chat window.
  • Reusability: Wasm Components are generic and reusable; there is nothing MCP-specific about them.
  • Security: Wassette is built on the Wasmtime security sandbox, providing browser-grade isolation of tools.

Architecture

An architecture diagram showing the relationship between Wassette, MCP Clients, and Wasm Components

Installation

Quick start: For Linux/macOS, use our one-liner install script:

curl -fsSL https://raw.githubusercontent.com/microsoft/wassette/main/scripts/install.sh | bash

For complete installation instructions for all platforms (including Windows, Homebrew, Nix, Docker, and more), see our Installation Guide.

Using Wassette

With Wassette installed, the next step is to register it with your agent of choice. See our Quick Start guide (3 simple steps), or check the MCP Clients guide for detailed setup instructions for GitHub Copilot, Copilot CLI, Claude Code, and Codex CLI.

Once configured, you can start loading WebAssembly components. To teach your agent to tell the time, ask it to load a time component:

Please load the time component from oci://ghcr.io/microsoft/time-server-js:latest

Now that the time component is loaded, we can ask your agent to tell you the current time:

What is the current time?

The agent will respond with the current time, which is fetched from the time component running in a secure WebAssembly sandbox:

The current time July 31, 2025 at 10:30 AM UTC

Congratulations! You've just run your first Wasm Component and taught your agent how to tell time!

Demo

https://github.com/user-attachments/assets/8e5a371c-ac72-406d-859c-03833ee83963

Discord

You can join us via the #wassette channel on the Microsoft Open Source Discord:

Microsoft Open Source Discord

Contributing

Please see CONTRIBUTING.md for more information on how to contribute to this project.

License

This project is licensed under the MIT License.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft’s Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party’s policies.

Contributors

Thanks to all contributors who are helping shape Wassette into something great.

Files in the repo

Repository payload29 top-level entries
  • .agents
  • .cargo
  • .config
  • .github
  • assets
  • crates
  • docs
  • examples
  • Formula
  • scripts
  • tests
  • winget
  • .gitignore
  • AGENTS.md
  • Cargo.lock
  • Cargo.toml
  • CODE_OF_CONDUCT.md
  • component-registry.json
  • CONTRIBUTING.md
  • flake.lock
  • flake.nix
  • Justfile
  • LICENSE
  • NOTICE
  • README.md
  • RELEASE.md
  • rust-toolchain.toml
  • rustfmt.toml
  • SECURITY.md

Discussion (0)

Ask about usage, or say what you built with it

Sign in to join the discussion.

No comments yet. Be the first to say what this is good for.

More connectors

Real-time global intelligence dashboard. AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface

86k

High-performance code intelligence MCP server. Indexes codebases into a persistent knowledge graph — average repo in milliseconds. 158 languages, sub-ms queries, 99% fewer tokens. Single static binary, zero dependencies.

43k

Universal provider proxy for OpenAI Codex & Claude Code — use any LLM (Claude, Gemini, Grok, DeepSeek, Ollama…) with Codex CLI, App, SDK, and Claude Code

14k
okf-memory/
okf-agent-memory

Git-native persistent memory for AI coding agents. Implements Google OKF v0.2 with sub-300µs in-memory BM25 search, embedded MCP server, and progressive disclosure. Slashes token bloat by 80% with zero external databases or dependencies. Built in pure Go.

547
tirth8205/
code-review-graph

Local-first code intelligence graph for MCP and CLI. Builds a persistent map of your codebase so AI coding tools read only what matters, with benchmarked context reductions on reviews and large-repo workflows.

31k
2akouwu/
reverify

Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.

1.1k