wasm-mcp

io.github.xyzzylabsPublished by GitHub account xyzzylabsv0.2.16Updated Oct 24, 2026

Read-only MCP server for the WebAssembly spec: instructions, types, sections, search, proposals.

VerifiedStreamable HTTPWeb executableKnowledge & MemoryDeveloper Tools

Overview

AI-generated overview

Read-only MCP server for the WebAssembly spec, letting an assistant look up instructions, types, spec clauses and proposals.

What you can do
Look up a single instruction by mnemonic or binary opcode, including stack signature and trap conditions, or list and search instructions by category, version or prefix. Look up value types and type forms with their defining prose. Fetch, navigate and full-text search spec clauses across the core, JS API and web API specs. List WebAssembly proposals with their phases, filterable by status, champion or affected spec. Report the package version and the pinned upstream commit the data was indexed from.
When to use it
Useful when working on WebAssembly tooling, compilers, runtimes or learning the spec, and you want the assistant to answer from the pinned official specification rather than from memory. Also handy for checking which proposal phase a feature is in.
Requirements
Either the hosted remote endpoint over streamable HTTP, or a local process run with npx from the npm package wasm-mcp over stdio. No account, API key or header is needed, and no network access is required at request time because the spec data is bundled.
Before you install
Read-only and anonymous: it does not execute, compile or run any WebAssembly code, and it does not write data. The hosted endpoint is rate-limited per source IP. The project states it is not affiliated with the W3C WebAssembly groups, so treat answers as tied to the pinned commit reported by spec_version.

Installation

In SourceWeft

  1. Open wasm-mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.xyzzylabs%2Fwasm-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "wasm": {
      "type": "http",
      "url": "https://mcp.xyzzylabs.ai/wasm/mcp"
    }
  }
}

README

wasm-mcp

Model Context Protocol server for the WebAssembly core specification. SHA-pinned, read-only, deterministic — safe to host as a public unauthenticated endpoint.

Not affiliated with, endorsed by, or sponsored by the W3C WebAssembly Community Group or Working Group.

What it gives you

  • spec_version — the pinned upstream commit and package version.
  • instruction_get — opcode bytes, category, introducing version, stack type signature, validation + execution prose anchors / URLs, and trap conditions (traps + can_trap), by mnemonic (i32.add) or binary opcode (0x6a).
  • instruction_list — enumerate, filterable by category (numeric, vector, reference, parametric, variable, table, memory, control, ref, i31, struct, array, extern), introducing version, or prefix.
  • instruction_search — ranked free-text search across mnemonics, categories, and opcodes.
  • type_get — value types (number / vector / reference) and type forms (functype, limits, memtype, …) with defining prose.
  • section_get — one spec clause by id / anchor (structure, validation, execution, binary, text), with prose, cross-references, SpecTec formal-rule references, and the rendered URL.
  • section_list — navigate the clause tree by area or anchor prefix.
  • spec_search — full-text search across anchors, titles, and prose.
  • proposal_list — WebAssembly proposals and their phases (from the pinned WebAssembly/proposals repo), filterable by status, phase, champion, or affected spec.

section_get, section_list, and spec_search take a spec argument covering all three specs in the WebAssembly/spec repo: core (default), js-api (the JavaScript embedding API), and web-api (Web-platform integration). The instruction and type tools are core-only.

Contract

Every tool is:

  • Read-only. No state mutation, no writes outside an optional local cache.
  • Deterministic. Same input → same output, over the pinned spec commit recorded in vendor/PINNED.txt.
  • No execution. Never compiles, validates-by-running, instantiates, or runs any WebAssembly or arbitrary code. Validation and reduction rules are returned as data.
  • No auth, no secrets, no PII. Usable anonymously.
  • No network at request time. All spec data is fetched and indexed at build time and baked into the package.

Install (stdio, local)

bash
npx wasm-mcp

Wire it into any MCP client by adding the server to its config (the launch command is the same everywhere; only the config file differs):

json
{  "mcpServers": {    "wasm": {      "type": "stdio",      "command": "npx",      "args": ["wasm-mcp"]    }  }}

Hosted Worker

The Cloudflare Worker in worker/ exposes the same tool surface as the stdio package over streamable HTTP at a single unauthenticated endpoint, rate-limited per source IP (30 req / 60 s):

https://mcp.xyzzylabs.ai/wasm/mcp

GET /wasm/health reports status and the pinned SHAs; GET /wasm/privacy states the anonymous, no-storage posture. All spec data is bundled into the Worker, so it does pure in-memory lookups — no storage, no network at request time.

Releases & data refresh

The pinned commits live in vendor/PINNED.txt and are reported by spec_version. A scheduled GitHub Actions workflow (refresh.yml) SHA-diffs the upstream repos daily; when a pin moves it re-pins, bumps the patch version, and tags a release, which publishes the npm package (release.yml) and redeploys the Worker (deploy-worker.yml).

Maintainers:

  • npm publish uses Trusted Publishing (OIDC) — no NPM_TOKEN. Configure it once on npmjs.com (wasm-mcp → Settings → Trusted Publisher → GitHub Actions: org xyzzylabs, repo wasm-mcp, workflow release.yml).
  • Worker deploy needs CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID, stored as environment secrets on the cloudflare GitHub Environment (not repo-wide) with a main + v* deployment rule — see Securing the deploy credentials.
  • For the refresh workflow's tag push to trigger release + deploy, add a WORKFLOW_PAT PAT (contents: write + workflows) — without it, refresh still re-pins and tags, but you run release / deploy manually. (Same secret name tc39-mcp uses, so one PAT — or an xyzzylabs org secret — can serve both repos.)

License

MIT — see LICENSE.

Source: README.md at commit 3a46742

Tools

9

spec_version

Return this server's package version plus the pinned upstream commit SHA(s) the bundled data was indexed from.

Takes no parameters.

instruction_get

Fetch one WebAssembly instruction by mnemonic (`i32.add`) or binary opcode (`0x6a`, multi-byte `0xfd 0x89 0x02`): opcode bytes, category, introducing version, stack type signature, validation/execution anchors + URLs, and `traps` (runtime trap conditions with canonical names; empty + `can_trap:false` when it never traps).

Parametersopcodemnemonic

instruction_list

Enumerate WebAssembly instructions, filterable by `category`, `introduced_in` (1.0|2.0|3.0), mnemonic `prefix`, and `can_trap` (only trapping / only non-trapping). Rows (incl. `can_trap`) sorted by opcode.

Parametersprefixcan_trapcategoryintroduced_in

type_get

Look up a value type (`i32`, `funcref`, `v128`, …) or type form (`functype`, `limits`, `memtype`, …): classification, sibling members, defining clause prose, formal refs, and URL.

Parametersnamerequired

section_get

Fetch one spec clause by id or anchor across `core` / `js-api` / `web-api` (`syntax-numtype`, `valid-unreachable`, `modules`, `streaming-modules`, …): title, prose, cross-references, SpecTec formal refs, and rendered URL.

Parametersidrequiredspec

section_list

Navigate the clause tree of a spec (`core` / `js-api` / `web-api`), filterable by source `path` (`syntax`, `valid`, `exec`, `binary`, `text`, `appendix`), `anchor_prefix`, `titled_only`, and `max_level`.

Parameterspathspecmax_leveltitled_onlyanchor_prefix

proposal_list

List WebAssembly proposals + phases. Filter by `status` (phase-0…phase-5, finished, inactive), `phase` (0–5), `champion`, `affects` (core|js-api|web-api), or `contains`.

Parametersphasestatusaffectschampioncontains

Version history

1
  1. v0.2.16LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts