Automic VaultAutomic Vault

brew

wassette mit Homebrew, winget installieren

Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für wassette in AI-Agent-Workflows.

Installation

Weitere Installationsbefehle

macOS

Homebrewverifiziert · 100%
brew install wassette

local Homebrew formula metadata

Windows

Windows Package Managerverifiziert · 92%
winget install --id Microsoft.Wassette -e

Windows Package Manager source index · Microsoft.Wassette · Quelle: cdn.winget.microsoft.com

Überblick

Paketzusammenfassung

Security-oriented runtime that runs WebAssembly Components via MCP

Verlauf

Projektgeschichte und Nutzung

Wassette is a Microsoft open source runtime and MCP server that exposes WebAssembly Components as tools for AI agents. Its history is short, but it is notable because it applies Wasmtime, the Component Model, OCI artifacts, and deny-by-default permissions to the emerging Model Context Protocol tool ecosystem.

Projektgeschichte

The project's changelog records v0.1.0 on August 5, 2025 as the initial Wassette release, adding the core MCP server, SSE and stdio transports, component lifecycle management, policy-based permissions, examples, CLI support, installation, and documentation.

Microsoft's open source blog introduced Wassette on August 6, 2025 through the Azure Core Upstream team. The announcement described it as a security-oriented runtime for running WebAssembly Components via MCP, able to fetch components from OCI registries and execute them with Wasmtime-backed sandboxing.

Adoptionsgeschichte

As of its early public releases, Wassette is explicitly marked by its repository as early development and not production ready. Its adoption story is therefore mostly experimental: agent developers can wire it into MCP-capable clients such as GitHub Copilot, Cursor, Claude Code, and Gemini CLI, then load Wasm components as tools.

Its significance comes from timing. MCP made agent tools easy to connect, but also raised the risk of giving agents arbitrary local executables. Wassette's answer is to package tools as WebAssembly Components, inspect typed interfaces, and enforce a deny-by-default permission model before granting filesystem, network, or other host access.

Wie es verwendet wird

Users register Wassette as an MCP server with an agent, then ask the agent to load a WebAssembly Component. Wassette translates the component's typed exports into MCP tools and brokers calls through a Wasmtime sandbox.

Component authors can build tools in languages that target the WebAssembly Component Model, publish them as OCI artifacts, and let Wassette fetch and run them. That makes it a package-oriented security layer for agent tools rather than a general-purpose Wasm CLI.

Warum Paket-Nerds sich dafür interessieren

Wassette is package-nerd interesting because it combines three packaging interfaces that usually live separately: MCP tool registration, OCI artifact distribution, and Wasm Component interfaces. It treats tool installation as something an agent may request dynamically, but tries to keep the runtime authority narrow and auditable.

For the WebAssembly ecosystem, it is a concrete example of the Component Model's promise: tools can expose typed functions instead of ad hoc JSON-over-process contracts, and the host can reason about permissions before executing untrusted code.

Zeitleiste

  • 2025-08-05: Wassette v0.1.0 initial release added the core MCP server, component lifecycle management, and permission system.
  • 2025-08-06: Microsoft Open Source introduced Wassette publicly as WebAssembly-based tools for AI agents.
  • 2025-2026: Documentation and repository warnings continued to frame Wassette as early-stage, security-oriented infrastructure for MCP and WebAssembly Component experiments.

Related projects

  • Wasmtime provides the underlying WebAssembly runtime sandbox.
  • The WebAssembly Component Model and WIT provide the typed interfaces Wassette exposes as tools.
  • The Model Context Protocol is the protocol surface through which AI agents call Wassette-managed tools.
  • OCI registries are used as a distribution mechanism for WebAssembly Components.

Sicherheitslage

Risikostufe: yellow

generalized runtime or code generation signal.

Risikoklassifikator

yellow Risiko · mittel Konfidenz · runtime

Warum

  • generalized runtime or code generation signal

Signale

  • text:runtime

Installationsverhalten

  • In den Formelmetadaten ist kein Homebrew-Post-install-Hook erfasst.
  • Homebrew-Bottle-Metadaten sind für 6 Plattformziele verfügbar.
  • Build-Metadaten listen 2 Build-Abhängigkeiten.

Empfohlene Prüfung

Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.

Executables

Installierte Executables

BefehlArtSichtbarkeitHinweis
wassettecliglobales Executable

Aktualität

Version und Aktualität

Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.

Seite generiert2026-07-25
Manager-Version0.5.0
Manager aktualisiert2026-07-23
lokale DatenOK
Upstreamaktuell
neueste erkannte Versionv0.5.0

https://github.com/microsoft/wassette

  • OKEs wurden keine Aktualitätswarnungen generiert.

Installationsmetadaten

Paketmetadaten

Paketschlüsselbrew:wassette
Version0.5.0
PaketmanagerHomebrew
Paketmanager-Seitehttps://formulae.brew.sh/formula/wassette
Homepagehttps://microsoft.github.io/wassette/
Repositoryhttps://github.com/microsoft/wassette
Upstream-Dokumentationhttps://github.com/microsoft/wassette#readme
LizenzMIT
Quellarchivhttps://github.com/microsoft/wassette/archive/refs/tags/v0.5.0.tar.gz
Zuletzt aktualisiert2026-07-23T01:09:26Z
Pulseupdated
Build-Abhängigkeitenpkgconf, rust
Bottleverfügbar (auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnicht definiert
Dienstkeiner deklariert

Registry-Fakten

Details aus der Quelldatenbank

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namewassette
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

Source-Datenbank-Treffer

Andere Paketmanager-Einträge

Treffer stammen aus externen Paketmanager-Indizes und bleiben von lokalen Automic-Vault-Paketlinks getrennt.

winget95%

Microsoft.Wassette

winget install --id Microsoft.Wassette -e
  • normalized package name match
  • Abgeglichen nach: Wassette
Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: Microsoft.Wassette from https://cdn.winget.microsoft.com/cache/source.msix

Quellspur

Aus Repository-Daten generiert

Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.

Verwendete Quellen

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment