hyper-mcp

The server leverages Extism for plugin sandboxing with configurable `allowed_hosts`, `allowed_paths`, and `memory_limit`. OCI-based plugin distribution supports Sigstore verification, crucial for supply chain security. The `insecure_skip_signature` option allows bypassing signature verification, but it is explicitly named as insecure. Authentication for registries uses system keyrings or direct credentials, preventing hardcoded secrets. Environment variable references (`${ENVVARKEY}`) in `runtime_config` are resolved by the host, which is generally acceptable for admin-controlled configurations. No `eval` or direct code injection vulnerabilities were found in the core server logic.