MCP SDK for Rust 3.1.4

Last reviewed Sep 25, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Rust 1.98136 lines · 3.6K tokens
  2. MCP SDK for Rust 3.1.471 lines · 3.2K tokens
Total207 lines · 6.8K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 89
  • 90
  • 117
  • 125
  • 190
  • 197
  • 201
  • 208
  • 209
  • 250
  • 295
  • 306
  • 319
  • 330
  • 338
  • 347
  • 354
  • 362
  • 367
  • 378
  • 407
  • 409
  • 416
  • 502
  • 532
  • 639
  • 643
  • 674
  • 770
  • 772
  • 787
  • 807
  • 829
  • 841
  • 862
  • 863
  • 918
  • 940
  • 1336
  • 1395
  • 1427

Prompt Preview

Apply the Rust 1.98 baseline first, including its requirement for a supported fixed compiler. These rules cover official rmcp and rmcp-macros 3.1.4; the SDK uses Rust edition 2024 and requires Rust 1.88 or later.

Features and protocol lifecycle

  • Enable only needed crate features. Client-only builds should disable default features, which include server and macros; choose a TLS feature explicitly for HTTP because transport-streamable-http-client-reqwest alone does not select a TLS backend.
  • Select the lifecycle deliberately through ClientServiceExt::serve_with_lifecycle. serve() uses legacy initialization and ProtocolVersion::LATEST is 2025-11-25; use ClientLifecycleMode::Discover with V_2026_07_28 when modern semantics are required. Permit Auto fallback only when legacy behavior satisfies the same security policy.
  • Restrict ServerHandler::supported_protocol_versions to implemented and reviewed versions. For modern-only HTTP servers, set with_legacy_session_mode(false) and with_stateless_protocol_metadata_required(true); the latter checks metadata presence and does not replace the version allowlist.
  • Use RequestContext::protocol_version() and client_capabilities() for the current request. Client metadata and capabilities describe protocol support, not authenticated identity. Modern HTTP creates a handler per request, so keep authorization and continuation state outside connection-local assumptions.
  • Bind legacy session ownership and external SessionStore/event replay records to the authenticated principal. Check ownership on