go-mcp-js-eval-wasi

The server's core function is to evaluate arbitrary JavaScript code, which is inherently a high-risk operation. However, it implements significant security measures: * Execution occurs within a WebAssembly (WASM) sandbox using `wazero`. * WASM memory limits are enforced (`WithMemoryLimitPages`). * Execution timeouts are applied (`context.WithTimeout`). * Standard HTTP server hardening (body size limit, read/write timeouts, max header bytes) is used. * Input/output is explicitly handled for JSON. The primary remaining risk lies in potential vulnerabilities within the `wazero` runtime or WASI implementation, or in the supplied WASM JavaScript engine itself (e.g., `js-eval-boa.wasm`). The `example.sh` explicitly warns about supply chain attacks for the WASM bytecode, highlighting this dependency as a critical trust boundary.