MCP SDK for Rust 3.7

Apply the Rust 1.99 baseline first. These rules cover the official rmcp client and server SDK, its optional transports and OAuth client, and the MCP capabilities the application enables.

Protocol and enabled surface

• Enable only the rmcp role, macro, OAuth, request-state, and transport Cargo features the application uses; the default features include server, macros, and base64. Select an HTTPS TLS feature deliberately when enabling reqwest-based transport or OAuth.
• Select the MCP lifecycle explicitly. serve() still starts the legacy initialize lifecycle even though ProtocolVersion::LATEST names 2026-07-28; use ClientServiceExt::serve_with_lifecycle with Discover when the application requires per-request discovery, and allow Auto fallback only when the older lifecycle meets policy.
• Override ServerHandler::supported_protocol_versions to advertise only revisions whose lifecycle, request metadata, headers, and capabilities the application implements. Treat negotiated versions, peer names, advertised capabilities, and tool annotations as compatibility data, never identity or permission.
• Expose only capabilities the handler actually implements. Require authentication and a current authorization decision for discovery, listings, tools/call, prompts/get, completion, resource reads, subscriptions, and task operations; hiding a name from a list does not protect its direct handler.

HTTP server and identity

• Put authentication, authorization, request deadlines, rate limits, connection limits, and response limits in front of