gaze-mcp-core 0.12.0

Transport-free MCP-shaped chokepoint runtime for Gaze. Enforces redact→manifest→return ordering at the type level.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

//! # gaze-mcp-core
//!
//! ### Scope
//!
//! `gaze-mcp` enforces the chokepoint on the **data-source ↔ model** path. Any data
//! flowing **from a source through an MCP tool to the model** passes through
//! `PiiEnvelope::dispatch` and is redacted before the model sees it.
//!
//! `gaze-mcp` **does not** cover the **user ↔ model** path. Pasted text, uploaded
//! files, and screenshots in the agent host's chat UI reach the model unredacted.
//! For that axis, see `gaze-proxy` (planned for v0.8 — multi-vendor reverse proxy
//! supporting Anthropic, OpenAI, Gemini).
//!
//! # Session ownership boundary
//!
//! A single `gaze::Session` MUST cover exactly one authorization domain.
//! The operator-tier `export_session_tokens` tool dumps the full
//! per-Session token↔raw map. Hosts that share one `Session` across
//! conversations leak the union of all conversations' tokens through
//! that tool. See `README.md` §"Session ownership boundary" for the
//! full pattern.
//!
//! ---
//!
//! Transport-free MCP-shaped runtime that enforces the Gaze chokepoint contract:
//! every tool dispatch flows redact → manifest → invoke → redact → persist → return.
//! The ordering is hard-coded inside [`PiiEnvelope::dispatch`] (the only construction
//! site for [`ToolCtx`]) so a tool implementation cannot fabricate a context, escape
//! the manifest, or return a response without a persisted audit trail.
//!
//! Transports plug in via the [`Frontend`] trait. The companion crate
//! `gaze-mcp-rmcp` ships an [`rmcp`](https://docs.rs/rmcp) implementation;
//! adopters who want a different transport implement [`Frontend`] themselves.
//!
//! See `docs/explanation/mcp/mcp-runtime.md` and the verdict in scratchpad 1453
//! (`brainstorm-gaze-mcp-crate-2026-05-08`) for the architectural rationale.

#![forbid(unsafe_code)]
#![warn(missing_docs)]

pub mod auth;
pub mod ctx;
pub mod dispatch;
pub mod frontend;
pub mod manifest;
pub mod registry;
pub mod session_id;
pub mod tool;
pub mod tools;

#[cfg(feature = "core-tools")]
pub mod core_tools {
    //! Re-exports of the default agent-tier tools (feature `core-tools`).
    pub use crate::tools::clean::CleanTool;
    pub use crate::tools::safety_net::SafetyNetCheckTool;
    pub use crate::tools::tokenize::TokenizeFieldTool;
}

#[cfg(feature = "operator-tier")]
pub mod operator_tools {
    //! Re-exports of the operator-tier tools (feature `operator-tier`).
    pub use crate::tools::export::ExportSessionTokensTool;
    pub use crate::tools::restore::RestoreTool;
    pub use crate::tools::restore_strict::RestoreStrictTool;
}

pub use crate::auth::{AuthError, AuthHook, DenyAllAuthHook, Principal};
pub use crate::ctx::{SessionHandle, ToolCtx, ToolResources};
pub use crate::dispatch::{DispatchError, PiiEnvelope};
pub use crate::frontend::{DispatchHost, Frontend, FrontendError, ShutdownToken};
pub use crate::manifest::{
    BeginCallContext, CallHandle, FailureReason, ManifestError, ManifestStore, SnapshotRef,
};
pub use crate::registry::{ToolRegistry, ToolRegistryError};
pub use crate::session_id::{SessionIdError, SessionIdFormat, SessionIdPolicy};
pub use crate::tool::{ResponseRedaction, Tool, ToolDescriptor, ToolError, ToolResponse, ToolTier};