MCP Server

What mavdol/capsule/mcp-server does

mavdol/capsule/mcp-server gives an MCP-compatible agent two code execution tools: execute_python and execute_javascript. Each tool runs supplied source code in an isolated WebAssembly environment rather than in the host process. This makes the server suitable for delegated calculations, small data-processing tasks, and other situations where an agent needs to write and run code without direct access to the machine running the MCP client.

The server includes separate precompiled WebAssembly modules for Python and JavaScript. Executions are isolated from one another, so the environment is reset for every tool call.

How it works

When an agent calls a tool, the server runs the requested language through Capsule inside a dedicated Wasm sandbox. Every execution receives its own memory space. Fuel-based execution limits control CPU and RAM usage and help stop runaway code, such as an accidental infinite loop.

The sandbox does not provide host filesystem access. Network access is also unavailable unless it is explicitly allowed by the execution environment. Python programs that depend on standard networking libraries are not compatible with this Wasm sandbox.

The execution model is stateless. Variables, files, and other state do not carry over from one call to the next. To perform a multi-step workflow, the agent must pass the output from an earlier call into the next execution.

Setup and configuration

Add the server to an MCP client using a standard stdio entry. The configuration launches the published package through npx:

{
  "mcpServers": {
    "capsule": {
      "command": "npx",
      "args": ["-y", "@capsule-run/mcp-server"]
    }
  }
}

This setup downloads or invokes @capsule-run/mcp-server through the Node package runner. The server can then be selected by the client when an agent needs to execute Python or JavaScript.

Tools and capabilities

• execute_python: Runs Python source code in an isolated WebAssembly sandbox.
• execute_javascript: Runs JavaScript source code in an isolated WebAssembly sandbox.
• Isolated memory: Gives each execution its own address space.
• Resource controls: Applies fuel-metered CPU and RAM limits.
• Restricted host access: Prevents filesystem access and does not provide network access by default.

A typical use is asking an agent to calculate statistics from an in-memory list. The agent can write a short Python program, run it, and use the returned result in its response without creating a host-side script.

Limitations and notes

Each call starts clean, so the server does not provide a persistent Python or JavaScript session. Pass prior results explicitly when chaining executions. Python code that uses standard networking libraries will not work with the Wasm sandbox. Host filesystem access is unavailable, and network access requires explicit allowance.