MCP SDK for Rust 3.2.0

Last reviewed Sep 24, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Rust 1.98136 lines · 3.6K tokens
  2. MCP SDK for Rust 3.2.0116 lines · 5.9K tokens
Total252 lines · 9.5K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 89
  • 90
  • 117
  • 125
  • 190
  • 197
  • 201
  • 208
  • 209
  • 250
  • 295
  • 306
  • 319
  • 330
  • 338
  • 347
  • 354
  • 362
  • 367
  • 378
  • 407
  • 409
  • 416
  • 502
  • 532
  • 613
  • 639
  • 643
  • 674
  • 770
  • 772
  • 787
  • 807
  • 829
  • 841
  • 862
  • 863
  • 918
  • 940
  • 1336
  • 1395
  • 1427

Prompt Preview

Apply the Rust 1.98 baseline first. These rules cover the official rmcp 3.2.0 SDK, its protocol negotiation, OAuth client, tools and resources, multi-round-trip state, tasks, caching, subscriptions, Streamable HTTP, stdio processes, and deployment.

Version, features, and protocol scope

  • Declare rmcp with a caret requirement on the 3.x line and lock it in Cargo.lock. rmcp and rmcp-macros ship together from one workspace but resolve as separate crates, so upgrade them as a pair with cargo update -p rmcp -p rmcp-macros, and review the enabled transports and the release notes on every upgrade.
  • Build with a Rust toolchain no older than the SDK's 1.88 minimum, selected by the Rust 1.98 baseline's toolchain rule.
  • Set default-features = false and enable only the required role, macros, auth, request-state, and transport features; the default set is base64, macros, and server.
  • Select a TLS backend explicitly for HTTPS: auth and transport-streamable-http-client-reqwest enable the reqwest dependency without enabling TLS. Add reqwest, reqwest-native-tls, or reqwest-tls-no-provider with an installed crypto provider as appropriate.
  • Do not assume ProtocolVersion::LATEST selects 2026-07-28: in 3.2.0 it remains V_2025_11_25. Select V_2026_07_28 explicitly through the client lifecycle only after testing its stateless HTTP, subscription, header, and multi-round-trip semantics.
  • Override ServerHandler::supported_protocol_versions with the revisions the application actually supports; its default advertises every known version from