HI
Developer Tools

Higress MCP Server Hosting via Envoy WASM plugins

Deploy MCP server with Higress by extending your Envoy-based API Gateway using WASM plugins for scalable, secure hosting.

View on GitHub
Quick Install
npx -y @wasm-go/mcp-servers

Overview

The Higress MCP (Model Context Protocol) server hosted via Envoy WASM plugins lets you extend an Envoy-based API gateway with lightweight, deployable WebAssembly modules that serve model context to upstream or downstream services. By packaging MCP servers as WASM plugins, you can run model-context handling logic inside the Envoy data plane, reducing round-trips to external services and enabling high-throughput, low-latency model routing and metadata enrichment.

This approach is particularly useful in environments that already run Higress (Alibaba’s Envoy-based API Gateway) and want to host model-related control or metadata functionality alongside regular gateway behavior. WASM modules are isolated, versionable, and portable, making them a scalable way to add MCP capabilities without changing application code or adding separate model-context microservices.

Features

  • Host MCP server logic as Envoy WASM filters for low-latency execution
  • Seamless integration with Higress / Envoy filter chains
  • Portable WebAssembly artifacts that can be versioned and deployed via Kubernetes
  • Can enrich requests with model context (headers, routing decisions) at the gateway
  • Minimal dependencies: WASM runtime managed by Envoy, no extra sidecars required
  • Extensible: implement custom model selection, validation, or discovery logic in Go (WASM) or other supported languages

Installation / Configuration

Below are the typical steps to get the MCP server WASM module built and running in a Higress environment. Adjust commands for your build environment and CI pipelines.

  1. Clone the Higress repository (contains wasm-go/mcp-servers)
git clone https://github.com/alibaba/higress.git
cd higress/plugins/wasm-go/mcp-servers
  1. Build the WASM module
  • If the repository includes a Makefile or build script:
# Use the provided build helper if available
make build
# or
./build.sh
  • Or build locally with TinyGo (example):
# install tinygo: https://tinygo.org/getting-started/
tinygo build -o mcp_server.wasm -target=wasi ./cmd/mcp-server
  1. Make the WASM module available to Envoy (via Kubernetes ConfigMap, HTTP server, or container image) Example: store the module in a ConfigMap (not recommended for very large modules):
kubectl -n higress create configmap mcp-wasm --from-file=mcp_server.wasm
  1. Configure Envoy / Higress to load the WASM filter Create an EnvoyFilter or equivalent Higress plugin resource to insert the wasm filter into the HTTP filter chain. Example EnvoyFilter (Kubernetes CRD):
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: mcp-wasm-filter
  namespace: higress
spec:
  workloadSelector:
    labels:
      app: higress-gateway
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          portNumber: 80
          filterChain:
            filter:
              name: envoy.filters.network.http_connection_manager
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.wasm
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
            config:
              vm_config:
                vm_id: mcp_server_vm
                runtime: envoy.wasm.runtime.v8
                code:
                  local:
                    filename: /etc/envoy/wasm/mcp_server.wasm
              configuration:
                # plugin-specific config passed as bytes
                "@type": type.googleapis.com/google.protobuf.StringValue
                value: |
                  {
                    "mcp_bind": "0.0.0.0:15010",
                    "log_level": "info"
                  }
  1. Mount the WASM binary into the Envoy container (example using a volume from the ConfigMap) Modify the Higress Gateway Deployment / DaemonSet to mount the ConfigMap at /etc/envoy/wasm
# snippet: add to the higress gateway Pod spec
volumes:
  - name: wasm-modules
    configMap:
      name: mcp-wasm
containers:
  - name: higress-gateway
    volumeMounts:
      - name: wasm-modules
        mountPath: /etc/envoy/wasm
        readOnly: true

After applying the ConfigMap, deployment changes, and EnvoyFilter, Envoy will load the WASM module and

Tags:developer-tools