Wasm't That Easy: Securing MCP With Wasm Sandboxes
summary
Live demos show a random MCP binary and a container both exfiltrate an SSH key when run with dangerously skip permissions, but compiling the same tool to a Wasm Component and running it with wasmtime without an HTTP capability fails to link and blocks the leak. The team builds an OCI-packed component served by waset, applies deny-by-default policies and host allowlists, and prevents the network upload in real time, proving static interface checks plus runtime capability gating stop common MCP tool poisoning.
AI-written summary · about
chapters (7)
- 0:00MCP security risks
- 1:46MCP vulnerabilities demo
- 7:09WebAssembly secures MCP
- 12:25Wasette for MCP sandboxing
- 15:44Key takeaways on MCP security
- 17:54Call to action
- 18:58Q&A
related talks
26mSyscall Me by Your Name: Sandboxing Wasm Programs
21mTwo-Faces of WASM Security
34mPlaying Safely in the...
29mWASM in the Kernel: evolving threat detection at runtime
31mWebAssembly Component Model: Enhancing Security, Productivity, and...
45mMCPwned: Hacking MCP Servers with One Skeleton Key... (Jonathan Leitschuh)
30mShrinking Software Attack Surface with WebAssembly & CNCF Wasmcloud
35mModern Sandboxing: Using Web Assembly in Java