Security

Built with security-first mindset:

• Sandboxed plugins that can't access your system without permission
• Memory-safe execution with resource limits
• Secure plugin distribution through container registries
• Fine-grained access control for host functions
• OCI plugin images are signed at publish time and verified at load time with sigstore.

Getting Started

1. Create your config file:
   • Linux: $HOME/.config/hyper-mcp/config.json
   • Windows: {FOLDERID_RoamingAppData}\hyper-mcp\config.json. Eg: C:\Users\Alice\AppData\Roaming\hyper-mcp\config.json
   • macOS: $HOME/Library/Application Support/hyper-mcp/config.json

{
  "plugins": {
    "time": {
      "url": "oci://ghcr.io/hyper-mcp-rs/time-plugin:latest"
    },
    "qr_code": {
      "url": "oci://ghcr.io/hyper-mcp-rs/qrcode-plugin:latest"
    },
    "hash": {
      "url": "oci://ghcr.io/hyper-mcp-rs/hash-plugin:latest"
    },
    "myip": {
      "url": "oci://ghcr.io/hyper-mcp-rs/myip-plugin:latest",
      "runtime_config": {
        "allowed_hosts": ["1.1.1.1"]
      }
    },
    "fetch": {
      "url": "oci://ghcr.io/hyper-mcp-rs/fetch-plugin:latest",
      "runtime_config": {
        "allowed_hosts": ["*"...