wasm-mcp

NPM · WASM-MCP · 2 COMPONENTS · SCANNED AUG 3

Read-only MCP server for the WebAssembly spec: instructions, types, sections, search, proposals.

Available components

remote · mcp.xyzzylabs.ai 64 npm · wasm-mcp 72

+30 this week 72 72 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security86

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency97

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to xyzzylabs/wasm-mcp). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 22 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability59

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 2807 tokens (~311/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · wasm-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add xyzzylabs-wasm-mcp -- npx -y wasm-mcp

# add to Codex CLI

codex mcp add xyzzylabs-wasm-mcp -- npx -y wasm-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "xyzzylabs-wasm-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "wasm-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add xyzzylabs-wasm-mcp --command npx --arg -y --arg wasm-mcp

# ~/.hermes/config.yaml

mcp_servers:
  xyzzylabs-wasm-mcp:
    command: "npx"
    args: ["-y", "wasm-mcp"]

// mcp.json

{
  "mcpServers": {
    "xyzzylabs-wasm-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "wasm-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +55
- Install scripts: unverified → pass ▲ security
- Provenance: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- The attested source repository moved: xyzzylabs/wasm-mcp security
- License: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Dependency health: unverified → partial ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: MIT functional
1 Aug 26 +12
- Tool coverage: unverified → 100 ▲ functional
31 Jul 26 −37
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 +18
- Tool coverage: unverified → 100 ▲ functional
28 Jul 26 −18
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
27 Jul 26 42

First indexed and scored.

Show 5 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: xyzzylabs/wasm-mcp
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/xyzzylabs/wasm-mcp/.github/workflows/release.yml@refs/tags/v0.2.16
Rekor log index:: 2141972031
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:da6f271127abb550827a0f1413af8b67172c7e1df399051745d97bc06ba3c55d05a9588f908007040f6f1e6fe42536de6d8c89aed7209ef751424908b
Discovery method:: attestation_endpoint

Dependencies 94 packages

94 packages in the resolved dependency tree · 94 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 9 exposed · ~2,070 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

instruction_get Get instruction ~246

Fetch one WebAssembly instruction by mnemonic (`i32.add`, `br_if`) or binary opcode (`0x6a`, `0xfd 0x89 0x02`) as structured JSON: opcode bytes, category, introducing version, stack type signature, validation/execution prose anchors + spec URLs, and `traps` — the runtime conditions under which it traps (each with the spec's canonical trap name; empty + `can_trap: false` for instructions that never trap). Provide `mnemonic` or `opcode` (mnemonic wins if both match).

Input Output Examples

Name	Type	Req	Description
mnemonic	string	—	Instruction mnemonic, e.g. `i32.add`, `br_if`, `local.get`. Case-insensitive. Exact match.
opcode	string	—	Binary opcode as hex bytes, e.g. `0x6a`, `6a`, or multi-byte `0xfd 0x89 0x02`. Exact match. Used when `mnemonic` is absent or doesn't match.
version	string	—	WebAssembly spec version to query. `latest` (default) is the current served version; `main` is the upstream working draft.

No output schema declared.

No examples provided.

instruction_list List instructions ~311

Enumerate WebAssembly instructions with optional filters: `category` (control, numeric, parametric, variable, table, memory, ref, i31, struct, array, extern, vec), `introduced_in` (1.0 | 2.0 | 3.0), `prefix` (mnemonic prefix like `i32.`), and `can_trap` (only trapping / only non-trapping instructions). Returns lightweight rows (incl. `can_trap`) sorted by opcode; follow up with instruction_get for full detail incl. trap conditions.

Input Output Examples

Name	Type	Req	Description
can_trap	boolean	—	Filter by trapping behavior: `true` keeps only instructions that can trap at runtime, `false` keeps only those that never trap. See instruction_get for the per-instruction trap conditions.
category	string	—	Filter by instruction category: control, numeric, parametric, variable, table, memory, ref, i31, struct, array, extern, vec (vector/SIMD).
introduced_in	string	—	Filter to instructions introduced in this WebAssembly version: `1.0`, `2.0`, or `3.0`.
prefix	string	—	Filter to mnemonics starting with this prefix, e.g. `i32.` or `v128.`. Case-insensitive.
version	string	—	WebAssembly spec version to query. `latest` (default) is the current served version; `main` is the upstream working draft.

No output schema declared.

No examples provided.

instruction_search Search instructions ~150

Search WebAssembly instructions by free-text query, matched against mnemonic (exact > substring), category name, and opcode hex. The entry point when you don't know the exact mnemonic. Returns ranked lightweight hits with a `matched_on` field; follow up with instruction_get.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	Max ranked hits returned.
query	string	yes	Search text. Matched against mnemonic (exact > substring), category name, and opcode hex. E.g. `extend`, `trunc`, `vec`, `0x6a`.
version	string	—	WebAssembly spec version to query. `latest` (default) is the current served version; `main` is the upstream working draft.

No output schema declared.

No examples provided.

proposal_list List WebAssembly proposals ~217

List WebAssembly proposals and their phases from the pinned WebAssembly/proposals repository. Filter by `status` (phase-0…phase-5, finished, inactive), `phase` (0–5), `champion` substring, `affects` (finished proposals touching core / js-api / web-api), or `contains` (name/champion substring). Each row carries name, status, phase, champion, affected_specs, spec_version, and the proposal URL.

Input Output Examples

Name	Type	Req	Description
affects	string	—	Filter to finished proposals affecting a given spec: `core`, `js-api`, or `web-api`.
champion	string	—	Champion substring, case-insensitive.
contains	string	—	Name or champion substring, case-insensitive.
phase	integer	—	Filter by numeric phase 0–5 (active + finished proposals carry a phase).
status	string	—	Filter by lifecycle status: `phase-0`…`phase-5`, `finished` (merged into the spec), or `inactive`.

No output schema declared.

No examples provided.

section_get Get spec section ~286

Fetch one spec clause by id or anchor, across `core` / `js-api` / `web-api` (set `spec`). For core: `syntax-numtype`, `valid-unreachable`, `binary-instr`, … For the embedding specs: `modules`, `memories`, `streaming-modules`, … Matches the rendered spec's stable fragment ids. Returns the clause title, cleaned prose, cross-references, the SpecTec `formal_refs` it cites (core), and the rendered URL. Core validation/execution clauses are SpecTec-generated: prose may be terse, but formal_refs + url point to the formal rule.

Input Output Examples

Name	Type	Req	Description
id	string	yes	Clause id or anchor. For `core`: `syntax-numtype`, `valid-unreachable`, `binary-instr`, … For `js-api` / `web-api`: `modules`, `memories`, `streaming-modules`, … These match the stable fragment ids i…
spec	string	—	Which WebAssembly spec to query: `core` (default; instructions, types, validation, execution, formats), `js-api` (JavaScript embedding), or `web-api` (Web platform integration).
version	string	—	WebAssembly spec version to query. `latest` (default) is the current served version; `main` is the upstream working draft.

No output schema declared.

No examples provided.

section_list List spec sections ~330

Enumerate spec clauses for navigation, across `core` / `js-api` / `web-api` (set `spec`). Filter by source `path` (core: `intro`, `syntax`, `valid`, `exec`, `binary`, `text`, `appendix`, or sub-paths like `syntax/types`), `anchor_prefix`, `titled_only`, and `max_level`. Returns lightweight rows {id, anchors, title, level, path, url}; follow up with section_get.

Input Output Examples

Name	Type	Req	Description
anchor_prefix	string	—	Filter to clauses whose id/anchor starts with this prefix, e.g. `syntax-`, `valid-`, `exec-`.
max_level	integer	—	Cap heading depth (1 = page titles only). Anchor-only blocks are unaffected.
path	string	—	Filter to a source path / prefix. Top-level areas: `intro`, `syntax` (structure), `valid` (validation), `exec` (execution), `binary`, `text`, `appendix`. Sub-paths like `syntax/types` also work.
spec	string	—	Which WebAssembly spec to query: `core` (default; instructions, types, validation, execution, formats), `js-api` (JavaScript embedding), or `web-api` (Web platform integration).
titled_only	boolean	—	Drop anchor-only content blocks (keep only clauses with a heading).
version	string	—	WebAssembly spec version to query. `latest` (default) is the current served version; `main` is the upstream working draft.

No output schema declared.

No examples provided.

spec_search Search spec ~227

Full-text search across the section index of a spec (`core` / `js-api` / `web-api`, set `spec`) — clause anchors/ids, titles, and prose. The entry point when you don't know the exact anchor. Returns ranked hits with a `matched_on` field (anchor-exact > title > anchor > prose) and a prose snippet for body matches; follow up with section_get.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	Max ranked hits returned.
query	string	yes	Search text. Matched against clause anchors/ids, titles, and prose. E.g. `block type`, `trap`, `funcref`, `streaming compilation`.
spec	string	—	Which WebAssembly spec to query: `core` (default; instructions, types, validation, execution, formats), `js-api` (JavaScript embedding), or `web-api` (Web platform integration).
version	string	—	WebAssembly spec version to query. `latest` (default) is the current served version; `main` is the upstream working draft.

No output schema declared.

No examples provided.

spec_version Pinned spec version ~55

Return self-description of this MCP server: package name + version, plus the pinned upstream commit SHA for every spec snapshot baked into the package. Use this first when citing the spec, or to verify the server's freshness and reproducibility.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

type_get Get type ~248

Look up a WebAssembly type or type form by name: concrete value types (`i32`, `i64`, `f32`, `f64`, `v128`, `funcref`, `externref`, …) or type forms (`functype`, `limits`, `memtype`, `tabletype`, `globaltype`, `reftype`, `valtype`, `rectype`, `heaptype`, …). Returns its classification, sibling members for category types, defining clause prose, SpecTec formal-rule references, and the rendered spec URL.

Input Output Examples

Name	Type	Req	Description
name	string	yes	Type or type-form name. Concrete value types: `i32`, `i64`, `f32`, `f64`, `v128`, `funcref`, `externref`, … Type forms: `functype`, `limits`, `memtype`, `tabletype`, `globaltype`, `reftype`, `valtype…
version	string	—	WebAssembly spec version to query. `latest` (default) is the current served version; `main` is the upstream working draft.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug