ISOLYTH INITIALISING…
ISOLYTH
WASM Sandboxed MCP Tool Server · v0.1.0

ISOLYTH

Zero-trust execution server for untrusted AI agent tool calls. Isolated Wasmtime WASM sandboxing, SSRF guards, JWT auth, and OpenTelemetry monitoring.

Try Interactive Tool TesterLive Dashboard
Security Matrix

Defense in Depth, Built for LLM Agents

Click or hover any card to inspect internal sandbox parameters on the flip side.

WASM Sandboxing

Every tool invocation runs inside a Wasmtime WebAssembly module with hard instruction-fuel caps and wall-clock epoch timeouts.

wasmtimeClick to flip 🔄
Wasmtime Engine Specs
Instruction Budget10,000,000 fuel
Memory Boundary16 MB RAM limit
Epoch Timeout3.0s wall-clock
Host IsolationNo OS syscalls
Click to flip back 🔄

SSRF & Path Jail

Pre-DNS IP resolution blocks RFC-1918 + AWS metadata ranges. Path.resolve() enforces an absolute workspace filesystem jail.

ssrf-guardClick to flip 🔄
Zero-Trust Guards
IP Blocklist10/8, 172/16, 192/168
Cloud Metadata169.254.169.254
Path ResolutionPath.resolve() jail
Redirect Interceptor301/302 SSRF check
Click to flip back 🔄

JWT Auth & Redis Limits

HS256/RS256 JWT gating on every tool call. Sliding token-bucket rate limiter backed by Redis atomic Lua scripts.

redis-limiterClick to flip 🔄
Gating Parameters
AlgorithmHS256 / RS256 JWT
Rate BackendRedis 7 Lua scripts
Fallback EngineIn-memory token bucket
Token Lifespan24h dev / 1h prod
Click to flip back 🔄

Full Observability

OpenTelemetry spans for every tool call, Prometheus metrics scraped at /metrics, structured JSON logs on stderr.

opentelemetryClick to flip 🔄
Telemetry Stack
Tracing StandardOpenTelemetry Spans
Metrics FormatPrometheus 0.0.4
Scrape Endpoint/metrics
Active GaugesWASM execution count
Click to flip back 🔄
Pinned Interactive Pipeline

Request Execution Pipeline

1. AI Agent Request
HTTP POST /tools/call
2. JWT Auth Guard
HS256 Signature Check
3. Redis Rate Limiter
Sliding Window Lua Script
4. Tool Registry
Schema Validation & Dispatch
5. WASM Sandbox
Isolated Wasmtime Execution
CURRENT SCROLL STEP:1. AI Agent Request (HTTP POST /tools/call)
Locust Verified Metrics

Production Benchmark Results

Sustained load test with 500 concurrent virtual users.

0.0 req/s
Sustained Throughput
0.0 ms
P95 Latency
0.00%
Error Rate
0.0 ms
WASM Overhead