Trait PlatformProbe 

pub trait PlatformProbe: Send + Sync {
    // Required methods
    fn id(&self) -> &'static str;
    fn target_roots(&self, paths: &Paths) -> Vec<(String, PathBuf)>;
    fn mcp_config_paths(&self, paths: &Paths) -> Vec<PathBuf>;
    fn extract_mcp_servers(
        &self,
        content: &str,
        path: &Path,
    ) -> Result<Vec<McpServerEntry>>;

    // Provided methods
    fn decompose_file(
        &self,
        _category: &str,
        _path: &Path,
        _content: &[u8],
    ) -> Result<Option<Vec<FragmentEntry>>> { ... }
    fn critical_categories(&self) -> &'static [&'static str] { ... }
}

One platform’s probe. Implementations are typically owned by a sibling crate (e.g. agentsec-platform-claude::ClaudeCodePlatform) and registered with the agentsec binary at startup.

All methods are read-only. Implementations must not mutate any path under the user’s home or project tree — the scan pipeline relies on this invariant to remain safe to run repeatedly.

Required Methods

fn id(&self) -> &'static str

Stable identifier used in scan reports and registry metadata. Convention: kebab-case, e.g. "claude-code", "cursor", "gemini-cli". Must not change across versions of the probe.

fn target_roots(&self, paths: &Paths) -> Vec<(String, PathBuf)>

Inventory target roots — the (category-label, absolute-path) pairs that crate::scan::inventory::collect walks. Category labels appear verbatim in crate::scan::inventory::PathEntry and downstream snapshot diffs, so probes must keep them stable across versions for diff continuity.

fn mcp_config_paths(&self, paths: &Paths) -> Vec<PathBuf>

Config files that may declare MCP servers. The registry / unknown-classifier reads these to enumerate installed servers for Typosquat detection. May overlap with Self::target_roots.

fn extract_mcp_servers( &self, content: &str, path: &Path, ) -> Result<Vec<McpServerEntry>>

Parse one MCP-server-bearing config file’s contents and extract all declared server entries. path is supplied so the impl can build accurate display_path strings and pick the right schema (a probe may handle multiple config layouts, e.g. global vs per-project).

Provided Methods

fn decompose_file( &self, _category: &str, _path: &Path, _content: &[u8], ) -> Result<Option<Vec<FragmentEntry>>>

Optionally split a single inventory file into virtual JSON-block fragments. Returning Ok(None) means “use the default whole-file SHA-256”. Returning Ok(Some(fragments)) means crate::scan::inventory::collect should emit one virtual <path>#<fragment> entry per element instead. category is the (probe-supplied) category label of the file being scanned; impls typically gate on a specific category string (e.g. Claude Code uses this for local_config = ~/.claude.json).

Default impl returns Ok(None) so every probe gets whole-file hashing by default without boilerplate.

fn critical_categories(&self) -> &'static [&'static str]

Category labels this probe considers security-critical. Diff renderers prefix changes to these categories with a critical marker. Default impl returns an empty slice. Labels should be a subset of the categories returned by Self::target_roots.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors