mcp-v8 — a JavaScript/TypeScript runtime for AI agents
mcp-v8 is a Model Context Protocol server,
written in Rust, that lets an AI agent run JavaScript and TypeScript in a
sandboxed V8 isolate. Instead of wiring up dozens of narrow tools, you give the
agent one tool — run_js — and it writes code: looping, branching, transforming
data, and calling other tools, often with far fewer tokens than equivalent
tool-call chains.
In its default stateful mode the V8 heap is saved as a content-addressed snapshot, so an agent can build up state across many turns. Host capabilities (network, filesystem, subprocess, WebAssembly, module imports, and calls to other MCP servers) are all off by default and unlocked only by explicit OPA/Rego policies.
Why mcp-v8
- One tool, unbounded capability. The agent runs a program, not a fixed menu of tools.
- Durable state. Heap snapshots persist variables and objects across calls.
- Secure by default.
fetch, filesystem, subprocess, and external imports are denied until you grant them via policy. - Kernel-enforced confinement. Opt-in
--sandbox-manifestconfines the whole process with a nono capability manifest (Landlock on Linux, Seatbelt on macOS) as defense in depth beneath the policy layer. - Production-ready. stdio / Streamable HTTP / SSE transports, a REST sidecar, async execution with pagination, JWKS auth, and Raft-replicated clustering.
