# MCP guide
## Scope
Connects configured MCP servers, discovers tools, and routes cancellable calls.
## Where to look
| Initialize and request lifecycle | `client.rs`, `protocol.rs`, `jsonrpc.rs` |
| Server isolation and registry | `manager.rs` |
| Qualified names and schema conversion | `names.rs`, `tool_schema.rs` |
| Child transport | `stdio.rs` |
| HTTP requests and notification streams | `http.rs`, `sse.rs` |
| Literal header validation and redaction | `headers.rs` |
| OAuth facade and helpers | `oauth.rs`, `oauth/discovery.rs`, `oauth/login.rs`, `oauth/storage.rs`, `oauth/tokens.rs` |
## Local rules
- Initialization uses protocol `2025-03-26`. Keep validation with the protocol/client boundary.
- Construct and parse routes through `QualifiedMcpToolName`: `mcp__server__tool`, at most 64 bytes, non-empty ASCII name components without `__`. Server names must not end in `_` because that makes routing ambiguous.
- Keep bad-server isolation and duplicate-route detection in the manager; do not advertise ambiguous names.
- Stdio uses newline JSON-RPC, not LSP Content-Length framing. Preserve the 1 MiB frame limit and pending-request failure on EOF.
- POST accepts JSON or SSE and carries the HTTP session id. GET notification SSE is best effort; unsupported GET must not break POST calls.
- The isolated current-thread Tokio runtime is only for GET-SSE notifications. Preserve shutdown/cancellation and HTTP-session DELETE teardown.
- Request timeout terminates the connection; do not leave a timed-out request usable for later calls.
- Configuration parses all `.mcp.json` definitions structurally, but expands environment references and validates runtime fields only for enabled entries. Missing variables in disabled entries do not block loading. Enabling validates before saving approval; approval is path/name-based and survives definition edits, not fingerprint-bound. Accept resulting literal header values at runtime, including sensitive headers; never expand them again. Redact all header values in every output path.
- OAuth storage remains behind its private facade with token locks and protected files under the configured home.