Hyper MCP Server

WebAssembly-based plugins enable extensible AI server capabilities.

Data last scanned yesterday · Reviewed today

453 tools★ 880RustApache-2.0

Overview

Hyper MCP Server acts as a versatile bridge that allows you to extend AI assistant functionality using plugins compiled to WebAssembly. By leveraging the Extism framework, it provides a sandboxed environment where plugins can be dynamically loaded and unloaded, supporting deployment across diverse environments ranging from mobile and edge devices to cloud infrastructure. Developers can distribute these plugins via standard OCI registries, such as Docker Hub, simplifying the management of custom AI tools. The server emphasizes sandboxing, allowing for granular control over file system, memory, and network access to maintain isolation for plugin operations.

Our verdict

With a security score of 45/100, this server is currently classified as high risk. While it provides features like WASM sandboxing and Sigstore signature verification for OCI plugins, key security aspects such as OAuth support and read-only mode behavior remain unreviewed by external auditors. Given its status as a community-maintained project rather than an official vendor release, users should exercise caution and thoroughly vet any third-party plugins loaded into their environment.

Uses Rust for memory-safe plugin execution
Zero direct dependencies reduces supply chain attack surface
Cryptographic verification of OCI plugins using Sigstore
Includes active development with commits recorded today

Community-maintained project lacks official vendor backing
Security score reflects high risk due to unreviewed authentication
Missing public homepage link for simplified project discovery

Tools

Tool	Description	Risk
hyper_mcp-list_plugins	List all loaded plugins.	low
hyper_mcp-load_plugin	Dynamically load a plugin at runtime.	medium
hyper_mcp-unload_plugin	Dynamically unload a plugin at runtime.	medium

Compatibility

Client	Local	Docker	Remote	Read-only
Claude Desktop
Cursor
VS Code
Windsurf
ChatGPT

Frequently asked questions

›Is the 'cosign' CLI tool required for all plugin installations?

No, cosign is only required when loading plugins from OCI registries using 'oci://' URLs. It is not necessary if you are loading plugins via 'file://', 'http://', 'https://', or 's3://' URL schemes.

›Can I bypass cryptographic signature verification for OCI plugins?

Yes, you can bypass verification by setting 'insecure_skip_signature: true' in your configuration file or by using the 'HYPER_MCP_INSECURE_SKIP_SIGNATURE=true' environment variable. However, this is not recommended for production environments.

›How are plugins restricted from accessing my system?

Plugins run in a sandboxed WebAssembly environment that limits access to the filesystem, network, and memory. Additionally, you can define specific runtime configurations, such as 'allowed_hosts', to restrict plugin network interactions.

›Where should I place the configuration file?

The configuration file location depends on your operating system: '$HOME/.config/hyper-mcp/config.json' on Linux, '%APPDATA%\hyper-mcp\config.json' on Windows, or '$HOME/Library/Application Support/hyper-mcp/config.json' on macOS.