MCP server: One MCP server.

Telleroutlook MCP

@telleroutlookRun by its publisher: served from their own domain, namespace checked by the registry.MCP server · External

WasmAgent MCP server — WASM-sandboxed code execution with capability manifests and Tasks API.

Code execution sandboxesv1.1.1Apache-2.0TypeScript
Freeno charge per call

Runs on your machine from its package; the steps are below.

What it does

  1. Reads
  2. Writes
  3. High impact

At most: moves money, runs code or commands, deletes data, or sends messages for you.

What it costs

Free

Odel charges nothing per call. The publisher may charge for its own service.

Runs locally over stdio

This server isn't hosted — your MCP client launches it from a package registry. Use one of the commands below, or drop the config into your client (e.g. Claude Desktop).

npm@wasmagent/mcp-serverv1.1.1

Run

npx -y @wasmagent/mcp-server

MCP client config

{
  "mcpServers": {
    "telleroutlook-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@wasmagent/mcp-server"
      ]
    }
  }
}
README9 min read

wasmagent-js

npm version License: Apache-2.0 CI Quick Start Docs

WasmAgent adds a verifiable evidence layer to agent tool use: protect tool calls, record what happened, audit the result, and admit trusted traces into downstream systems.

Protect → Record → Audit → Admit · Sync — agent↔UI shared state


Start in 30 seconds

Pick your entry point:

GoalInstall
Protect tools — runtime firewall, policy enforcement, taint tracking with a provenance-preserving information-flow gate wired through the agent runtimenpm add @wasmagent/mcp-firewall
Record evidence — signed AEP records after every agent runnpm add @wasmagent/aep
Admit from traces — compliance scoring produces ComplianceEvalRecords for downstream trainingnpm add @wasmagent/aep @wasmagent/compliance
Sync state — reducer-backed agent↔UI shared state, agent reads projections + writes intentnpm add @wasmagent/core (/shared-state subpath)

Trust Pack — 30-minute end-to-end: docs/quickstarts/trust-pack-30min.md


Quickstart

Three paths — pick the one that fits your use case:

Path 1 — Protect: MCP runtime firewall

Wrap any MCP server: vet tools before execution, enforce policy per call, track taint across results.

bash
npm install @wasmagent/mcp-firewall
ts
import { evaluatePolicy, snapshotTool, taintObservation, vetTool } from "@wasmagent/mcp-firewall";

const entry = {
  name: "read_file",
  description: "Read a file from disk",
  inputSchema: { type: "object", properties: { path: { type: "string" } } },
};
const args = { path: "/tmp/report.txt" };
const consentRecords = [];

// Before calling a tool
const snap     = snapshotTool(entry, "my-server");   // hash descriptor at registration
const vetting  = vetTool(entry);                     // static scan: injection / exfil / rug-pull
const decision = evaluatePolicy(entry.name, args, vetting, consentRecords);

if (decision.decision === "deny")   throw new Error(`Blocked: ${decision.reasons.join("; ")}`);
if (decision.decision === "ask_user") {
  // surface consent UI, then call recordConsent(...)
}

// After receiving result
const rawResult = "example report contents";
const obs = taintObservation(entry.name, rawResult);  // boundary-tagged, safe to assemble into prompt

→ Security pack · OWASP Agentic Top 10 · Attack demos

Path 2 — Record: AEP evidence export

Emit a signed evidence record after every agent run — consumable by trace-pipeline for audit and training.

bash
npm install @wasmagent/aep
ts
import { AEPEmitter } from "@wasmagent/aep";

const emitter = new AEPEmitter({ run_id: "run-001", model_id: "claude-sonnet-4-6" });

// During the run — add tool call evidence
emitter.addAction({ tool_name: "bash", outcome: "pass", exit_code: 0 });

// At the end — emit the record
const record = emitter.build();
// record satisfies aep/v0.3 JSON Schema — ready for evomerge validate-aep

→ AEP schema · trace-pipeline 10-min tutorial

Path 3 — Execute: Sandboxed code execution

Run agent-generated code in an isolated WASM kernel — no host-process access.

bash
npm install @wasmagent/aisdk @wasmagent/kernel-quickjs
ts
import { sandboxedJsTool } from "@wasmagent/aisdk";
import { QuickJSKernel } from "@wasmagent/kernel-quickjs";

// Drop into any AI SDK / LangChain / OpenAI Agents setup
const codeTool = sandboxedJsTool({ kernel: new QuickJSKernel() });

→ Kernel comparison · Getting started

Path 4 — Sync: Human-agent shared state

Reducer-backed collaborative state where the LLM reads projections, dispatches semantic actions, and respects affordances — all through standard tools.

bash
npm install @wasmagent/core
ts
import { defineStateModel, SharedStateStore, stateTools } from "@wasmagent/core/shared-state";

// 1. One reducer, shared by both UI and agent.
const model = defineStateModel({
  initial: () => ({ page: "list", selectedId: null as string | null }),
  reduce: (s, a) => {
    if (a.type === "SELECT") return { ...s, page: "detail", selectedId: a.id };
    if (a.type === "BACK")   return { ...s, page: "list", selectedId: null };
    return s;
  },
  project: (s) => ({ page: s.page, selectedId: s.selectedId }),
  affordances: (s) => s.page === "list" ? ["SELECT"] : ["BACK"],
});

// 2. Server-side store keyed by session.
const store = new SharedStateStore(model);

// 3. Give the agent read_state + dispatch_action tools.
const tools = stateTools(store, "session-001");
// Pass `tools` to any ToolCallingAgent — the LLM reads state and dispatches intent.

The semantic action stream doubles as AEP evidence — every dispatch is a provenance-ready record (see #141 for the full confluence design).


📚 Docs · Getting started · Kernels · OWASP governance · Security pack · Changelog


What is shipped vs alpha

WasmAgent uses a five-tier maturity scale to prevent "shipped" from becoming a vague claim:

TierMeaningSemver guaranteeProduction use
stablePublic API locked; breaking changes require major-version bumpYesYes
betaFunctional and used in production, but a specific limitation is documented (e.g. first-line filter only, contract still evolving)Minor/patch onlyYes, with caveats documented
alphaSchema versioned; fields may be added without a breaking-change bumpNoInformed use
demoDemonstration or example code; not hardened for productionNoNo
researchResearch-grade prototype; interfaces may change without noticeNoNo

Packages not listed here (model adapters, UI cards, etc.) follow the same scale — see each package's README or package.json wasmagent.stability field.


Package maturity

PackageMaturityNotes
@wasmagent/corestablePublic API; semver guaranteed
@wasmagent/kernel-quickjsstable
@wasmagent/kernel-remotestable
@wasmagent/mcp-gatewaystablePublished 0.1.0; gateway composes all firewall layers
@wasmagent/mcp-firewallbetaFirst-line filter, not adversarial-grade — keyword bag + lightweight n-gram classifier; use defence-in-depth
@wasmagent/aepbetav0.2 signature contract (Ed25519) shipped; schema versioned
@wasmagent/otel-exporteralphaGENAI_SEMCONV, AEP↔OTel bridge
@wasmagent/aisdk / @wasmagent/mastra-sandboxalphaAPI stable, may add fields
@wasmagent/compliancealphaSchema versioned; may add fields without breaking
@wasmagent/mcp-policyalpha — privateNot yet published to npm
@wasmagent/mcp-attestationalpha — privateNot yet published to npm
@wasmagent/evals-runneralpha
@wasmagent/devtoolsalpha

WasmAgent Ecosystem

WasmAgent is a portable, governable agent runtime for safe code execution, verifiable rollouts, and post-training data loops.

RepoRole
wasmagent-js (this repo)Embedded Agent Runtime / WASM Kernel / policy / verifier / adapters
bscodeCloudflare flagship demo and deploy template for safe coding agents
trace-pipelinePublic datafactory and eval-trust backend for rollout data
text
Task → Safe Runtime → Verifiable Rollout → Trajectory Export → DPO/PPO Data → Better Models

What makes wasmagent different

Three wedges where wasmagent stands apart from generic agent frameworks:

WedgeWhat it means
Sandboxed executionThree isolation tiers — VmKernel / WASM (QuickJS·Pyodide·Wasmtime) / microVM — with a single CapabilityManifest and MCP runtime firewall across all
Runtime complianceTaskSpec → ConstraintIR → ComplianceEvalRecord — every run produces an auditable, cross-repo training contract, not just a log
Trace-to-training contractVerifiable rollout branching, objective scoring, DPO/PPO export — the loop from runtime evidence to training data is first-class, not an afterthought
Full feature axis table (10 axes vs. other JS agent frameworks)
#AxisStatus
1Multi-provider adapters — one Model interface across Anthropic, OpenAI, Doubao, DeepSeek, Kimi, Qwen, GLM, MiniMax, local llama.cppshipped
2Three isolation tiers — VmKernel (in-process) / QuickJS·Pyodide·Wasmtime (WASM) / RemoteSandboxKernel (microVM) — same CapabilityManifest across allshipped
3Cross-runtime + offline — Node / edge / browser / air-gapped laptop; @wasmagent/model-local + WASM kernel = zero outbound trafficshipped
4Memory layers — MemoryBlockSet (prompt-cache stable) + observational memory + Checkpointer + 4 KV backendsshipped
5Durable workflows — LocalWorkflowEngine + CloudflareWorkflowEngine — observable, terminable, resumableshipped
6Code-mode MCP — N tools → 2 tools (docs_search + execute_code); 13.6% token cost at N=30shipped
7Devtools + OTel — local Studio, gen_ai.* semantic conventions (Datadog / Honeycomb / Grafana)shipped
8Goal-directed loop — agent synthesises success criteria, verifies, retries with hintsshipped 2026-06-18
9Adaptive execution — registered fallbacks (L1) → synthesised tool (L2) → relaxed goal (L3)shipped 2026-06-18
10MCP runtime firewall — @wasmagent/mcp-firewall: descriptor snapshot, static vetting (injection / exfiltration / rug-pull / taint), per-call policy, consent ledger, provenance gate auto-threaded through the agent runtimeshipped 2026-06-25 · provenance wiring 2026-10-04

Full comparison with Vercel AI SDK, LangGraph.js, OpenAI Agents JS, Mastra, CF Agents SDK: docs/compare.md


Quick Start

Tool-Calling Agent

ts
import { ToolCallingAgent, AnthropicModel } from "@wasmagent/core";
import { z } from "zod";

const agent = new ToolCallingAgent({
  model: new AnthropicModel("claude-haiku-4-5-20251001"),
  tools: [{
    name: "search", description: "Search the web",
    inputSchema: z.object({ query: z.string() }),
    readOnly: true, idempotent: true,
    forward: async ({ query }) => `Results for: ${query}`,
  }],
  stopPolicies: ["steps:10", "cost:0.5"],
});

for await (const ev of agent.run("Search for recent AI news")) {
  if (ev.event === "final_answer") console.log(ev.data.answer);
}

Sandboxed Code Agent

ts
import { CodeAgent, AnthropicModel } from "@wasmagent/core";

const agent = new CodeAgent({
  model: new AnthropicModel("claude-sonnet-4-6"),
  tools: [],  // kernel executes code; no extra tools needed
  maxSteps: 10,
});

for await (const ev of agent.run("What is 42 * 1337?")) {
  if (ev.event === "final_answer") console.log(ev.data.answer);
}

CLI

bash
npm install -g @wasmagent/cli

# Agent runs
wasmagent run "What is the square root of 144?"
wasmagent run "Summarise AI news" --stream | jq .

# Rollout / training data
wasmagent rank-rollout rollouts.jsonl --out ranked.jsonl
wasmagent validate-rollouts ranked.jsonl
wasmagent export-rollouts --in ranked.jsonl --format dpo --out dpo.jsonl

# MCP security (scan → guard → evidence)
wasmagent init --guard               # generate wasmagent.policy.yaml
wasmagent scan-mcp tools.json        # static risk scan, exits 1 on critical findings
wasmagent guard --config wasmagent.policy.yaml --upstream tools.json
wasmagent evidence export --input aep-records.jsonl --format json

GitHub Action — enforce policy in CI:

yaml
- uses: WasmAgent/wasmagent-js/.github/actions/agent-evidence-gate@main
  with:
    policy: wasmagent.policy.yaml
    tools-file: mcp-tools.json
    fail-on-policy-violation: "true"

→ MCP Guard guide · Attack demos


Key Capabilities

CapabilityGuide
Shared state — reducer-backed agent↔UI sync, projections, affordancespackages/core/src/shared-state/
MCP firewall — vetTool, ScopeLease, ApprovalReceiptdocs/guides/mcp-guard.md
AEP v0.2 evidence — causal chain, scope lease, taint, memory refspackages/aep/src/types.ts
OWASP MCP Top 10 crosswalkdocs/security/standards-crosswalk.yaml
OWASP security demo (10 scenarios)examples/owasp-demo/
Security benchmark runnerexamples/security-benchmark/
AEP ↔ OTel bidirectional mappingpackages/otel-exporter/src/aep-otel-bridge.ts
AgentTeam delegation chainpackages/core/src/agents/AgentTeam.ts
Claim dashboardnode scripts/verify-claims.mjs --html → docs/claims/claims.html
Quality runners (self-consistency, reflect-refine, parallel fork-join)docs/guides/quality-runners.md
Durable runtime (checkpoints, SSE resume, HITL)docs/guides/durable-runtime.md
Observational memory — ~22% tokens on 50-turn tracesdocs/guides/observational-memory.md
Goal-directed agent with verifiersdocs/guides/goal-directed.md
Production APIs (retry, evals, OTel, React hook)docs/api/production-apis.md
API stability policydocs/api/stability-policy.md

Model Providers

First-class adapters: Anthropic · OpenAI · Doubao · DeepSeek · Kimi · Qwen · GLM · MiniMax · local llama.cpp

ts
// Chinese providers with thinking support
import { DoubaoModel, DoubaoModels } from "@wasmagent/model-doubao";
import { DeepSeekModel, DeepSeekModels } from "@wasmagent/model-deepseek";

// Local / offline
import { LocalModel } from "@wasmagent/model-local";  // node-llama-cpp, multi-mirror download

Full provider reference and proxy/custom endpoint setup: docs/guides/openai-compat-recipes.md


Ecosystem

ProjectRole
bscodeFlagship Cloudflare deploy template — wires every wasmagent-js capability into a real edge product
trace-pipelineTraining data factory — converts ranked rollouts into DPO/PPO datasets

Upstream integration status (PRs filed to Vercel AI SDK, Mastra, LangChain.js, ElizaOS, MCP registry, …) is tracked in docs/distribution/upstream-prs.md.


Development

bash
bun install && bun run build
bun test packages/
bun run typecheck
bun run bench          # reproduce all README benchmarks
bun run check:branding # CI guard: no old brand references
bun run verify:claims  # CI guard: all benchmark claims have evidence scripts

See CONTRIBUTING.md · Changelog · License: Apache-2.0

Similar modules

Browse Code execution sandboxes