Capability-based WASM sandbox for MCP tools — wasmtime, WASI-isolated, fuel/memory/time/I/O capped, signed execution records. Sub-ms, 8/8 attacks blocked.
MichaelS1011 / ephemora-cell
