Tool · curated 27 Jul 2026
GitHub - MauricioPerera/mcpwasm: Static MCP: your tools are files, not servers. Hash-verified static skills executed sandboxed on demand (QuickJS-wasm on Cloudflare Workers) + llms.txt gateway
First reported github.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
mcpwasm addresses MCP tool supply-chain and tampering risks by enforcing hash verification and sandboxed execution, giving defenders a hardening pattern for running untrusted agent tools.
mcpwasm is a project that reimagines MCP tools as static, hash-verified files rather than running servers, executing each "skill" sandboxed on demand via QuickJS-wasm on Cloudflare Workers, with an llms.txt gateway. Skills declare sha256 hashes and the gateway re-verifies content on every read, rejecting tampered or drifted tool code (including a deliberate corrupt_skill fixture that tests hash-based rejection).