// the find
bytecodealliance/wasm-tools
CLI and Rust libraries for low-level manipulation of WebAssembly modules
wasm-tools is the Bytecode Alliance's official Swiss Army knife for WebAssembly — parsing, printing, validating, mutating, shrinking, and generating .wasm binaries, plus first-class support for the Component Model and WIT interfaces. It's a dual-purpose project: a CLI for humans and a suite of Rust crates for toolchain authors who need to programmatically touch wasm at the binary level. If you're building a wasm runtime, compiler, or toolchain, several of these crates (wasmparser, wasm-encoder, wit-parser) are already your transitive dependencies whether you know it or not.
The crate decomposition is unusually clean — wasmparser, wasm-encoder, wat, wast, wit-parser are all independently usable, which is why they show up as deps in wasmtime, wasm-bindgen, cargo-component, and others. The mutation and shrinking tooling (wasm-mutate + wasm-shrink) is genuinely useful for fuzzing infrastructure; using egg-based peephole rewriting to produce semantically valid mutations is a real technique, not a hack. Proposal coverage is comprehensive and tracked explicitly: every Stage 4+ proposal is on-by-default, pre-Stage-4 proposals are off but implemented and flaggable. The stdin/stdout piping convention means the tools compose naturally in shell pipelines without temp files.
The crate versioning scheme is a maintenance trap: all non-wat crates are versioned at 0.x, meaning every release can break your API with no semver protection — the README says so plainly, but if you're vendoring any of these crates in a stable product you will get burned. wasm-compose (the tool for composing components together) is explicitly deprecated in the table but still ships; the replacement path to wit-component/cargo-component is not explained in this repo at all, leaving users to figure it out externally. The C API (crates/c-api) is partial and the header itself says coverage is incomplete, so if you need to call this from non-Rust code you're on your own for anything beyond the documented subset. The release process note — 'close the PR then reopen it. Don't ask questions.' — is a sign that the CI automation has a quirk no one has fixed.