Implement WASM guard runtime with wasmtime component model

- Add wasmtime and wasmtime-wasi dependencies to Cargo.toml
- Implement full WASM guard runtime in wasm.rs using wasmtime component model
- Wire up WasmGuard in initialize_guards() when wasm-guards feature enabled
- Update Dockerfile.acr to build with wasm-guards feature
- Add azure-config.yaml for Azure Container Apps deployment
- Fix simple-pattern-guard example to work with component model exports

The WASM guard implementation supports:
- Loading WASM components from file path
- Host functions: log, get-time, get-config
- WIT interface for evaluate-tools-list
- WASI preview 2 compatibility via wasmtime-wasi
- Timeout protection and memory limits

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: surinderunitone

Cargo.lock

@@ -228,6 +228,8 @@ core_affinity = "0.8.3"
 frozen-collections = "0.8.0"
 heck = "0.5"
 macro_rules_attribute = "0.2.2"
+wasmtime = { version = "27.0", default-features = false, features = ["component-model", "cranelift", "runtime"] }
+wasmtime-wasi = "27.0"
 
 # Release optimized but without as many dependencies, suitable for incremental development
 [profile.quick-release]

Cargo.toml

@@ -84,7 +84,7 @@ RUN sh -c 'export VERSION="${VERSION}" && \
     if [ "$BUILDER" = "musl" ]; then \
       export CFLAGS="${CFLAGS} -static"; \
     fi && \
-    cargo build --features ui --target "$(cat /build/target)" --profile ${PROFILE} || exit 1 && \
+    cargo build --features ui,wasm-guards --target "$(cat /build/target)" --profile ${PROFILE} || exit 1 && \
     mkdir /out && \
     mv /app/target/$(cat /build/target)/${PROFILE}/agentgateway /out'
 

Dockerfile.acr

@@ -0,0 +1,60 @@
+# Azure Container Apps Configuration
+# This is the default config baked into the Docker image.
+# For hot-reload, mount a config file to /app/mounted-config/config.yaml
+
+binds:
+  - port: 8080
+    listeners:
+      - routes:
+          - policies:
+              cors:
+                allowOrigins:
+                  - "*"
+                allowHeaders:
+                  - mcp-protocol-version
+                  - content-type
+                  - cache-control
+                  - authorization
+                allowMethods:
+                  - GET
+                  - POST
+                  - OPTIONS
+            backends:
+              - mcp:
+                  # Security guards configuration
+                  security_guards:
+                    # Native tool poisoning detection
+                    - id: tool-poisoning
+                      type: tool_poisoning
+                      enabled: true
+                      priority: 50
+                      failure_mode: fail_closed
+                      timeout_ms: 50
+                      runs_on: [response]
+                      strict_mode: true
+                      custom_patterns:
+                        - "(?i)SYSTEM:\\s*override"
+                        - "(?i)ignore\\s+previous\\s+instructions"
+                        - "(?i)disregard\\s+safety"
+                      scan_fields:
+                        - name
+                        - description
+                        - input_schema
+                      alert_threshold: 1
+
+                    # Native PII detection
+                    - id: pii-detector
+                      type: pii
+                      enabled: true
+                      priority: 100
+                      failure_mode: fail_closed
+                      timeout_ms: 100
+                      runs_on: [response]
+                      action: mask
+
+                  # Default MCP targets (placeholder - override via mounted config)
+                  targets:
+                    - name: test
+                      stdio:
+                        cmd: echo
+                        args: ["No MCP servers configured"]

azure-config.yaml

@@ -16,7 +16,7 @@ schema = ["schemars"]
 tls-ring = ["rustls/ring", "tokio-rustls/ring"]
 internal_benches = ["divan"]
 testing = ["dep:reqwest"]
-wasm-guards = []
+wasm-guards = ["dep:wasmtime", "dep:wasmtime-wasi"]
 
 [dependencies]
 a2a-sdk.workspace = true
@@ -136,6 +136,8 @@ uuid.workspace = true
 x509-parser.workspace = true
 reqwest = { optional = true, workspace = true }
 websocket-sans-io.workspace = true
+wasmtime = { workspace = true, optional = true }
+wasmtime-wasi = { workspace = true, optional = true }
 
 # Linux only dependencies
 [target.'cfg(target_family = "unix")'.dependencies]

crates/agentgateway/Cargo.toml

@@ -355,11 +355,8 @@ fn initialize_guards(configs: Vec<McpSecurityGuard>) -> Result<Vec<InitializedGu
 				Arc::new(native::PiiGuard::new(cfg.clone()))
 			},
 			#[cfg(feature = "wasm-guards")]
-			McpGuardKind::Wasm(_cfg) => {
-				// WASM guards need special handling
-				return Err(GuardError::ConfigError(
-					"WASM guards not yet fully implemented".to_string()
-				));
+			McpGuardKind::Wasm(cfg) => {
+				Arc::new(wasm::WasmGuard::new(config.id.clone(), cfg.clone())?)
 			},
 		};