Skip to main content
hc
Submit
mcpSource-backed
Wassette logo

Wassette MCP Server

Microsoft-maintained MCP server and security-oriented WebAssembly component runtime for loading sandboxed tools, managing component permissions, and exposing Wasm component tools to Claude through MCP.

by Microsoft · submitted by oktofeesh1·added 2026-06-06·
Claude CodeCodexCursorClaude Desktop
HarnessClaude CodeCodexCursorClaude Desktop
Review first — review before installing

Open the source and read safety notes before installing.

Citation facts

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Canonical URL
https://heyclau.de/entry/mcp/wassette-mcp-server
Source URLs
https://raw.githubusercontent.com/microsoft/wassette/main/docs/mcp-clients.md, https://github.com/microsoft/wassette
Brand
Wassette
Brand domain
microsoft.github.io
Brand asset source
brandfetch
Safety notes
Wassette can load WebAssembly components from local paths or OCI registries and expose their tools to Claude., Built-in MCP tools can load and unload components, search the component registry, list loaded components, and grant or revoke storage, network, and environment-variable permissions., Components are sandboxed and deny access by default, but granted permissions can still allow file reads, file writes, outbound network calls, and secret access., Review component source, registry provenance, policy files, requested permissions, and update channels before loading a component in a trusted workspace., Require human approval before granting write access, broad filesystem scopes, production network hosts, or sensitive environment variables.
Privacy notes
Loaded components may process prompts, files, environment variables, network responses, secrets, and generated tool outputs depending on granted permissions., Component directories, secrets directories, policy files, MCP transcripts, logs, registry URIs, and tool-call arguments can reveal sensitive project or credential details., Wassette source includes argument log sanitization for keys, tokens, secrets, and passwords, but prompts and outputs can still contain private data., Redact component ids, registry locations, local component names, granted URI scopes, environment keys, and tool outputs before sharing debug traces.
Author
Microsoft
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06

Decision playbook

Review trust signals before you adopt

Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.

Compare context
Selected

0

Current score

63

Baseline

—

Delta

No baseline selected

No major trust-signal divergence detected in the current selection.

Source and provenance checks

Needs review

Confirm ownership and provenance before trusting install instructions.

  • Source link availableRequired

    Open the canonical repository and verify ownership.

    Done

  • Source provenance statusRequired

    Marked as source-backed.

    Done

  • Metadata reviewed

    No reviewed flag detected in metadata.

    Pending

Safety and privacy checks

Complete

Validate risk disclosures before installation or API wiring.

  • Safety notes presentRequired

    Review the listed safety guidance before running commands.

    Done

  • Privacy notes presentRequired

    Review data handling notes before connecting accounts or secrets.

    Done

  • Trust level risk gateRequired

    Trust level does not block evaluation.

    Done

Package and install checks

Needs review

Check package metadata and artifact integrity signals.

  • Install payload available

    Install or copy payload is available for review.

    Done

  • Package verification flag

    No package verification flag provided.

    Pending

  • Checksum metadata

    No checksum provided for downloaded artifact.

    Pending

Compare-driven decision checks

Needs review

Use compare context to validate trade-offs before adoption.

  • Compare tray has multiple entries

    Add at least one more entry to compare trust differences.

    Pending

  • Baseline comparison available

    No baseline peer selected yet.

    Pending

  • Diverging trust signals identified

    No major trust-signal divergence found.

    Pending

Setup at a glance

CLI install

Copy-ready — paste the snippet to get started.

15 minutes

Install command

Provided

Config snippet

Provided

Copy snippet

Provided

Prerequisites

5 to clear

Platforms

4 listed

Install type

CLI install

Adoption plan

Balanced adoption plan

Current risk score 24/100. Use staged verification before broader rollout.

Risk 24

Pre-adoption checks

Validate source and review signals before any execution.

  • Confirm source provenanceRequired

    Source URL/provenance metadata is present.

    Done

  • Confirm metadata review state

    No review metadata found; increase manual validation.

    Pending

  • Verify install payload

    Install/config payload exists and can be inspected.

    Done

Security checks

Confirm safety, privacy, and package integrity signals.

  • Review safety notesRequired

    Safety notes are present.

    Done

  • Review privacy notesRequired

    Privacy notes are present.

    Done

  • Verify package integrity metadata

    No package verification/checksum metadata.

    Pending

Rollout

Adopt in controlled steps based on the selected plan.

  • Run in isolated sandbox firstRequired

    Use a constrained sandbox and observe behavior across multiple tasks.

    Pending

  • Roll out graduallyRequired

    Roll out to a small cohort before wider usage.

    Pending

  • Set monitoring and fallback

    Define rollback path and monitor errors after adoption.

    Pending

Evidence readiness

Evidence readiness matrix · balanced

Missing required evidence: Metadata review. Risk score 31.

Risk 31

Source provenance

Present

Source repository/provenance is listed.

Required in this preset

Metadata review

Missing

Review metadata is missing.

Required in this preset

Safety notes

Present

Safety notes are present.

Required in this preset

Privacy notes

Present

Privacy notes are present.

Optional in this preset

Package integrity

Missing

Package integrity metadata is missing.

Optional in this preset

Install payload

Present

Install payload is available.

Required in this preset

Required gaps: Metadata review

Decision timeline

Decision timeline · balanced

Blocking gaps: Check metadata review status. Risk 28.

Risk 28

triage

Confirm source provenanceRequired

Source/provenance metadata is available.

Done

triage

Check metadata review statusRequired

Review metadata is missing.

Pending

verify

Review safety notesRequired

Safety notes are available.

Done

verify

Review privacy notes

Privacy notes are available.

Done

verify

Validate package integrity metadata

Package integrity metadata is missing.

Pending

rollout

Verify install payload and commandsRequired

Install payload is available.

Done

Blockers: Check metadata review status

Prerequisite readiness

Prerequisite readiness

5 prerequisites to line up before setup. Includes a review or approval gate.

0/5 ready
Permissions & scopes2Network & hosting1Review & approval1General115 minutes

Safety & privacy surface

Safety & privacy surface

5 safety and 4 privacy notes across 3 risk areas. Review closely: credentials & tokens, permissions & scopes.

3 areas
  • SafetyLocal filesWassette can load WebAssembly components from local paths or OCI registries and expose their tools to Claude.
  • SafetyPermissions & scopesBuilt-in MCP tools can load and unload components, search the component registry, list loaded components, and grant or revoke storage, network, and environment-variable permissions.
  • SafetyCredentials & tokensComponents are sandboxed and deny access by default, but granted permissions can still allow file reads, file writes, outbound network calls, and secret access.
  • SafetyPermissions & scopesReview component source, registry provenance, policy files, requested permissions, and update channels before loading a component in a trusted workspace.
  • SafetyPermissions & scopesRequire human approval before granting write access, broad filesystem scopes, production network hosts, or sensitive environment variables.
  • PrivacyCredentials & tokensLoaded components may process prompts, files, environment variables, network responses, secrets, and generated tool outputs depending on granted permissions.
  • PrivacyCredentials & tokensComponent directories, secrets directories, policy files, MCP transcripts, logs, registry URIs, and tool-call arguments can reveal sensitive project or credential details.
  • PrivacyCredentials & tokensWassette source includes argument log sanitization for keys, tokens, secrets, and passwords, but prompts and outputs can still contain private data.
  • PrivacyPermissions & scopesRedact component ids, registry locations, local component names, granted URI scopes, environment keys, and tool outputs before sharing debug traces.

Disclosure: MIT-licensed Microsoft open-source project. Upstream documentation warns that Wassette is in early development and not production ready, so verify release maturity and permission behavior before deploying it broadly.

Safety notes

  • Wassette can load WebAssembly components from local paths or OCI registries and expose their tools to Claude.
  • Built-in MCP tools can load and unload components, search the component registry, list loaded components, and grant or revoke storage, network, and environment-variable permissions.
  • Components are sandboxed and deny access by default, but granted permissions can still allow file reads, file writes, outbound network calls, and secret access.
  • Review component source, registry provenance, policy files, requested permissions, and update channels before loading a component in a trusted workspace.
  • Require human approval before granting write access, broad filesystem scopes, production network hosts, or sensitive environment variables.

Privacy notes

  • Loaded components may process prompts, files, environment variables, network responses, secrets, and generated tool outputs depending on granted permissions.
  • Component directories, secrets directories, policy files, MCP transcripts, logs, registry URIs, and tool-call arguments can reveal sensitive project or credential details.
  • Wassette source includes argument log sanitization for keys, tokens, secrets, and passwords, but prompts and outputs can still contain private data.
  • Redact component ids, registry locations, local component names, granted URI scopes, environment keys, and tool outputs before sharing debug traces.

Prerequisites

  • Reviewed Wassette release or package-manager installation for the target platform.
  • MCP client that supports local stdio servers.
  • Agreement on which WebAssembly components may be loaded from local files or OCI registries.
  • Permission policy for storage, network, and environment-variable access before components are granted capabilities.
  • Separate secrets and component storage locations with appropriate filesystem permissions.

Schema details

Install type
cli
Troubleshooting
No
Source repository stats
Scope
Source repo
Collection metadata
Estimated setup
15 minutes
Difficulty
intermediate
Tool listing metadata
Disclosure
MIT-licensed Microsoft open-source project. Upstream documentation warns that Wassette is in early development and not production ready, so verify release maturity and permission behavior before deploying it broadly.
Full copyable content
{
  "mcpServers": {
    "wassette": {
      "command": "wassette",
      "args": ["run"]
    }
  }
}

About this resource

Content

Wassette MCP Server is Microsoft's security-oriented MCP runtime for loading WebAssembly components as tools. It runs as a local MCP server, exposes built-in component-management and permission-management tools, and lets Claude call tools provided by loaded Wasm components.

Use it when you want reusable WebAssembly component tools behind a sandboxed MCP runtime, with explicit storage, network, and environment-variable permissions instead of giving a component broad host access by default.

Source Review

These sources were reviewed on 2026-06-06. Prefer the live repository, MCP client guide, README, license, installation guide, built-in tools reference, permission reference, configuration reference, and MCP server source for current setup and behavior.

Features

  • Run Wassette as a local stdio MCP server with wassette run.
  • Load WebAssembly components from local files or OCI registry references.
  • List, unload, and inspect loaded components.
  • Search the known component registry for loadable tools.
  • Expose loaded component tools through the MCP tool list.
  • Grant and revoke storage permissions for specific file or directory scopes.
  • Grant and revoke outbound network access for specific hosts.
  • Grant and revoke environment-variable access for specific keys.
  • Keep components deny-by-default until permissions are explicitly granted.

Installation

Install Wassette with a reviewed release or package-manager workflow for the target platform. For example, the upstream docs include Homebrew installation on macOS and Linux:

brew tap microsoft/wassette https://github.com/microsoft/wassette
brew install wassette

Then register Wassette as a local stdio MCP server:

{
  "mcpServers": {
    "wassette": {
      "command": "wassette",
      "args": ["run"]
    }
  }
}

Review the upstream MCP client guide for client-specific setup, then load only components that have been reviewed for source, provenance, and permissions.

Use Cases

  • Load a reviewed WebAssembly component and expose its tools to Claude.
  • Give a component access only to the files, network hosts, or environment variables it needs.
  • Test reusable tool components without writing a dedicated MCP server for each tool.
  • Manage component permissions through MCP built-in tools during an agent session.
  • Use OCI-hosted components as portable tools across MCP clients.
  • Experiment with sandboxed component tooling while Wassette is still early in development.

Safety and Privacy

Wassette gives components a sandbox and deny-by-default permissions, but the MCP server also exposes tools that can grant capabilities. Treat every loaded component as code from a supply chain: review its source, registry path, policy, requested permissions, update channel, and expected outputs before granting access.

Be especially careful with storage write scopes, broad filesystem paths, production network hosts, and environment variables that contain credentials. MCP transcripts, component ids, registry URIs, policy files, secrets directories, logs, and tool outputs may reveal sensitive project details. Redact those values before sharing troubleshooting material.

Duplicate Check

No microsoft/wassette, Wassette MCP, WebAssembly component MCP, Wasm component tools, or matching source URL entry was found in content/mcp or README.md. Existing security, runtime, and tool-hosting MCP entries do not cover Wassette's Microsoft-maintained WebAssembly component runtime.

#webassembly#security#sandbox#tools#microsoft

Source citations

Add this badge to your README

Show that Wassette MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/mcp/wassette-mcp-server.svg)](https://heyclau.de/entry/mcp/wassette-mcp-server)

How it compares

Wassette MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

Field
Wassette logoWassette MCP Server

Microsoft-maintained MCP server and security-oriented WebAssembly component runtime for loading sandboxed tools, managing component permissions, and exposing Wasm component tools to Claude through MCP.

Open dossier
Burp Suite MCP Server logoBurp Suite MCP Server

PortSwigger's Burp Suite MCP Server extension connects Burp Suite to MCP clients through an SSE server or packaged stdio proxy for request, Repeater, Intruder, history, scanner, Collaborator, and configuration workflows.

Open dossier
SonarQube MCP Server logoSonarQube MCP Server

Official SonarSource MCP server that connects Claude to SonarQube Server or SonarQube Cloud for code quality, security issues, hotspots, measures, quality gates, branches, pull requests, snippets, and system context.

Open dossier
WinDbg MCP Server

MCP server that connects Claude to Windows CDB/WinDbg for crash dump discovery, dump triage, remote debugging targets, custom debugger commands, debugger cleanup, and CTRL+BREAK interrupts.

Open dossier
Next steps
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Open dossierAPI JSONOpen LLMMCP feedOpen sourceNewsletterClaim listing
Trust
Review statusNot reviewedNot reviewedNot reviewedNot reviewed
Package trustPackage not verifiedPackage not verifiedPackage not verifiedPackage not verified
Source provenanceSource-backedSource-backedSource-backedSource-backed
Submitteroktofeesh1oktofeesh1oktofeesh1oktofeesh1
Install riskReview firstReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
BrandWassette logoWassetteBurp Suite MCP Server logoBurp Suite MCP ServerSonarQube MCP Server logoSonarQube MCP Server—
Categorymcpmcpmcpmcp
SourceSource-backedSource-backedSource-backedSource-backed
AuthorMicrosoftPortSwiggerSonarSourcesvnscha
Added2026-06-062026-06-062026-06-062026-06-06
Platforms
Claude CodeCodexCursorClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Harness
Claude CodeCodexCursorClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Claude CodeClaude Desktop
Source repo————
Safety notes✓Wassette can load WebAssembly components from local paths or OCI registries and expose their tools to Claude. Built-in MCP tools can load and unload components, search the component registry, list loaded components, and grant or revoke storage, network, and environment-variable permissions. Components are sandboxed and deny access by default, but granted permissions can still allow file reads, file writes, outbound network calls, and secret access. Review component source, registry provenance, policy files, requested permissions, and update channels before loading a component in a trusted workspace. Require human approval before granting write access, broad filesystem scopes, production network hosts, or sensitive environment variables.✓Burp Suite MCP Server can send HTTP/1.1 and HTTP/2 requests, create Repeater tabs, send requests to Intruder, toggle Proxy Intercept, pause or resume Burp's task execution engine, and update the active message editor. In Burp Suite Professional it can also expose scanner issues and generate or poll Collaborator payloads for out-of-band testing. The extension includes approval flows for outbound HTTP requests and sensitive data access, but users can configure always-allow targets and disable some approval requirements. Configuration editing tools can import project-level or user-level Burp options when enabled in the extension, which can change proxy, scanner, target, and other Burp behavior. Use only on systems and applications where testing is authorized; active requests, Intruder traffic, scanner workflows, and Collaborator payloads can affect third-party services. Keep the MCP server bound to trusted local interfaces and avoid exposing the SSE server to untrusted networks.✓SonarQube MCP Server uses the permissions of the provided SonarQube token and can expose project, issue, hotspot, measure, branch, pull request, rule, source, and system information. Source code snippets, raw source, SCM details, coverage information, security findings, dependency risks, duplicated files, system logs, and health data can be sensitive. The source tree includes tools for changing issue status, changing security hotspot status, toggling automatic analysis, and creating webhooks; require human approval for actions that mutate SonarQube state. Use least-privilege tokens and separate development, staging, and production SonarQube contexts where possible. Container execution pulls and runs `mcp/sonarqube`; pin image versions or use reviewed container controls if your environment requires reproducible artifacts.✓WinDbg MCP starts CDB processes and can run arbitrary WinDbg commands supplied through the MCP tool call. Remote debugging tools can attach to live targets, inspect process state, send CTRL+BREAK, and interrupt execution. Crash dump analyses and remote connections remain active until closed or the CDB process is terminated. Symbol paths can fetch symbols from network symbol servers and can disclose module names, versions, and debugging context. Do not expose streamable HTTP mode beyond a trusted host without transport security, authentication, and network controls.
Privacy notes✓Loaded components may process prompts, files, environment variables, network responses, secrets, and generated tool outputs depending on granted permissions. Component directories, secrets directories, policy files, MCP transcripts, logs, registry URIs, and tool-call arguments can reveal sensitive project or credential details. Wassette source includes argument log sanitization for keys, tokens, secrets, and passwords, but prompts and outputs can still contain private data. Redact component ids, registry locations, local component names, granted URI scopes, environment keys, and tool outputs before sharing debug traces.✓Proxy HTTP history, WebSocket history, Organizer items, scanner issues, request and response bodies, headers, cookies, tokens, session identifiers, and Collaborator interaction data may be returned to the MCP client. The extension can read project-level and user-level Burp configuration; upstream code filters some configuration credentials when configured, but users should still treat exported options as sensitive. MCP prompts, responses, Burp logs, and client transcripts can retain target URLs, credentials, payloads, vulnerability details, and proprietary application behavior. The stdio proxy and SSE server bridge Burp traffic into the MCP client process; keep client configs, proxy paths, and Burp project files protected.✓SonarQube tokens, organization keys, server URLs, project keys, branch names, pull request identifiers, source snippets, issue messages, hotspot details, logs, and system metadata may appear in MCP client logs, model transcripts, and tool outputs. The repository includes telemetry sample documentation; review SonarSource telemetry, product, and data-processing policies before enabling the server in regulated environments. Do not paste SonarQube tokens, private server URLs, raw source, or security findings into public prompts, issues, screenshots, or repository files. Security issue and hotspot data can reveal exploitable weaknesses before fixes are released; limit model and user access accordingly.✓Crash dumps can contain memory, stack values, command lines, environment variables, file paths, registry data, sensitive values, PII, customer data, and proprietary code or symbols. WinDbg output, dump paths, remote connection strings, symbol paths, module lists, thread stacks, exception records, and debugger command output may be visible to the MCP client and model provider. Verbose logs, command transcripts, dump triage prompts, and saved analysis results can retain sensitive crash data after use. Redact dump paths, remote endpoints, symbols, process details, and command output before sharing logs, screenshots, or PR comments.
Prerequisites
  • Reviewed Wassette release or package-manager installation for the target platform.
  • MCP client that supports local stdio servers.
  • Agreement on which WebAssembly components may be loaded from local files or OCI registries.
  • Permission policy for storage, network, and environment-variable access before components are granted capabilities.
  • Burp Suite Community or Professional with Java extension support.
  • Java and the `jar` command available for building and loading the extension.
  • Gradle wrapper execution allowed for building `build/libs/burp-mcp-all.jar` from source.
  • An MCP client that can connect to the Burp SSE server or run the packaged stdio proxy.
  • Docker or another OCI-compatible container runtime.
  • SonarQube Cloud organization key or SonarQube Server URL.
  • SonarQube user token scoped to the projects and actions Claude should access.
  • Organization policy for whether an agent may inspect source snippets, issues, hotspots, measures, quality gates, pull requests, server logs, or system data.
  • Windows environment with Debugging Tools for Windows, CDB, or WinDbg installed.
  • Python 3.10 or newer.
  • MCP client configuration access for stdio or reviewed streamable HTTP transport.
  • Crash dumps, dump directories, or remote debugging targets you are authorized to inspect.
Install
Install Wassette with a reviewed package-manager or release path, then register `wassette run` as a local stdio MCP server.
./gradlew embedProxyJar
docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG mcp/sonarqube
pip install mcp-windbg
Config
{
  "mcpServers": {
    "wassette": {
      "command": "wassette",
      "args": [
        "run"
      ],
      "type": "stdio"
    }
  }
}
Manual-only setup:
./gradlew embedProxyJar
Manual-only setup:
claude mcp add sonarqube \
  --env SONARQUBE_TOKEN=$SONAR_TOKEN \
  --env SONARQUBE_ORG=$SONAR_ORG \
  -- docker run --init --pull=always -i --rm -e SONARQUBE_TOKEN -e SONARQUBE_ORG mcp/sonarqube
{
  "mcpServers": {
    "mcp_windbg": {
      "command": "python",
      "args": ["-m", "mcp_windbg"],
      "env": {
        "CDB_PATH": "<optional-cdb-executable-path>",
        "_NT_SYMBOL_PATH": "<reviewed-symbol-path>"
      }
    }
  }
}
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed
Open 4 picks in the interactive comparison tool

Related guides

Source-backed guides for putting this to work.

Build MCP Servers with Auth and Least Privilege

Design MCP servers with auth boundaries and narrow tools.

Added 1mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by MkDev11
Microsoft logo

Microsoft MCP for Beginners

Learn MCP through Microsoft's hands-on curriculum for servers, clients, security, transports, auth, deployment, Azure, VS Code, and cross-language examples.

Added 1mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by Microsoft

Prompt Injection Defense For Tool Connected Agents

Reduce prompt injection risk for MCP and tool-connected Claude Code agents.

Added 1mo ago
guidesReview firstSource-backedReview first
Safety ✓ Privacy ✓by kiannidev

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.