hyper-mcp

Plugins run in a WebAssembly sandbox provided by Extism, with configurable resource limits (memory, execution time), allowed network hosts, and allowed filesystem paths. OCI plugin images are cryptographically verified by Sigstore by default upon loading, adding a strong layer of supply chain security. An explicit `--insecure-skip-signature` flag exists but is clearly labeled as insecure. Host functions exposed to plugins (e.g., for logging, progress, eliciting user input) are controlled, minimizing direct plugin access to the host system. Authentication details, including sensitive credentials, can be loaded from configuration files, environment variables, or system keyrings (macOS, Linux, Windows), avoiding hardcoding.