| Filename | Latest commit message | Latest commit date |
|---|---|---|
66712db808* fix(auth): redact secrets in Debug output for StoredCredentials and StoredAuthorizationState
Removes `Debug` from the derive macros on `StoredCredentials` and
`StoredAuthorizationState` and replaces them with manual `Debug` impls
that print `[REDACTED]` for sensitive fields (access/refresh tokens,
PKCE verifiers, and CSRF tokens), preventing accidental credential
leakage via `{:?}` formatters, log calls, and error chains.
Fixes #741
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test(auth): assert Debug output redacts secrets for credential types
Adds regression tests for the fix in the previous commit, verifying
that `{:?}` formatting of `StoredAuthorizationState` and
`StoredCredentials` does not emit plaintext secrets.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test(auth): address review feedback on debug redaction tests
- Remove redundant VendorExtraTokenFields from use super:: in
test_stored_credentials_debug_redacts_token_response (already
imported at module scope)
- Add assert!(debug_output.contains("created_at")) to
test_stored_authorization_state_debug_redacts_secrets to verify
non-secret fields remain visible in Debug output
- Run cargo fmt
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Update crates/rmcp/src/transport/auth.rs
Co-authored-by: Dale Seo <5466341+DaleSeo@users.noreply.github.com>
* fix: remaining formatting issue
* fix: formatting
* fix: formatting
* fix: please
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Dale Seo <5466341+DaleSeo@users.noreply.github.com>
|
||
| .. | ||
| src | ||
| tests | ||
| build.rs | ||
| Cargo.toml | ||
| CHANGELOG.md | ||
| README.md | ||
rmcp
The official Rust SDK for the Model Context Protocol. Build MCP servers that expose tools, resources, and prompts to AI assistants — or build clients that connect to them.
For getting started, usage guides, and full MCP feature documentation (resources, prompts, sampling, roots, logging, completions, subscriptions, etc.), see the main README.
Feature Flags
| Feature | Description | Default |
|---|---|---|
server |
Server functionality and the tool system | ✅ |
client |
Client functionality | |
macros |
#[tool] / #[prompt] macros (re-exports rmcp-macros) |
✅ |
schemars |
JSON Schema generation for tool definitions | |
auth |
OAuth 2.0 authentication support | |
elicitation |
Elicitation support |
Transport features
| Feature | Description |
|---|---|
transport-io |
Server-side stdio transport |
transport-child-process |
Client-side stdio transport (spawns a child process) |
transport-async-rw |
Generic async read/write transport |
transport-streamable-http-client |
Streamable HTTP client (transport-agnostic) |
transport-streamable-http-client-reqwest |
Streamable HTTP client with default reqwest backend |
transport-streamable-http-server |
Streamable HTTP server transport |
TLS backend options (for HTTP transports)
| Feature | Description |
|---|---|
reqwest |
Uses rustls — pure Rust TLS (recommended default) |
reqwest-native-tls |
Uses platform-native TLS (OpenSSL / Secure Transport / SChannel) |
reqwest-tls-no-provider |
Uses rustls without a default crypto provider (bring your own) |
Transports
The transport layer is pluggable. Two built-in pairs cover the most common cases:
| Client | Server | |
|---|---|---|
| stdio | TokioChildProcess |
stdio |
| Streamable HTTP | StreamableHttpClientTransport |
StreamableHttpService |
Any type that implements the Transport trait can be used. The IntoTransport helper trait provides automatic conversions from:
(Sink, Stream)or a combinedSink + Stream(AsyncRead, AsyncWrite)or a combinedAsyncRead + AsyncWrite- A
Workerimplementation - A
Transportimplementation directly
License
This project is licensed under the terms specified in the repository's LICENSE file.