mcp-execution-core 0.10.0

Core types, traits, and error handling for MCP execution
Documentation

mcp-execution-core

Crates.io docs.rs codecov MSRV License

Foundation types, traits, and error handling for MCP Code Execution.

Installation

[dependencies]
mcp-execution-core = "0.10"

Or with cargo-add:

cargo add mcp-execution-core

[!IMPORTANT] Requires Rust 1.91 or later.

Usage

Server Configuration

use mcp_execution_core::{ServerConfig, ServerId};

let config = ServerConfig::builder()
    .command("docker".to_string())
    .arg("run".to_string())
    .arg("-i".to_string())
    .arg("--rm".to_string())
    .arg("ghcr.io/org/mcp-execution-server".to_string())
    .env("LOG_LEVEL".to_string(), "debug".to_string())
    .build();

let server_id = ServerId::new("github").unwrap();

Domain Types

use mcp_execution_core::{ServerId, ToolName};

// Type-safe identifiers prevent mixing up strings
let server = ServerId::new("github").unwrap();
let tool = ToolName::new("create_issue").unwrap();

assert_eq!(server.as_str(), "github");
assert_eq!(tool.as_str(), "create_issue");

[!TIP] Strong types prevent accidentally passing a ToolName where a ServerId is expected.

[!IMPORTANT] ServerId::new/ToolName::new enforce a UTS #39 Identifier_Status=Allowed invariant: every character must be an allowed Unicode identifier character. This rejects spaces and most punctuation (@/+/(/&/</>/etc.) outright, closing a spoofing class where a hostile MCP server could publish a tool name that is visually near-identical to a legitimate one using invisible or confusable characters.

Error Handling

use mcp_execution_core::{Error, Result};

fn process_server(id: &str) -> Result<()> {
    if id.is_empty() {
        return Err(Error::ValidationError {
            field: "id".to_string(),
            reason: "Server ID cannot be empty".to_string(),
        });
    }
    Ok(())
}

Command Validation

use mcp_execution_core::{ServerConfig, validate_server_config};

let config = ServerConfig::builder()
    .command("npx".to_string())
    .arg("-y".to_string())
    .arg("@modelcontextprotocol/server-github".to_string())
    .build();

// Validates against command injection
validate_server_config(&config)?;

[!WARNING] Always validate server configurations before execution to prevent command injection attacks.

Features

  • Strong Domain Types: ServerId, ToolName instead of raw strings
  • Error Hierarchy: Contextual errors with thiserror
  • Server Configuration: Type-safe config with security validation
  • Command Validation: Prevents command injection attacks
  • Thread-Safe: All types are Send + Sync
  • Zero Unsafe: No unsafe code blocks

Types Reference

Type Description
ServerId Unique server identifier (newtype over String)
ToolName MCP tool name (newtype over String)
ServerConfig Server configuration with command, args, env
Transport Transport-specific config enum (Stdio, Http, Sse)
Error Error type with contextual information
Result<T> Alias for std::result::Result<T, Error>

Modules

Module Description
confinement Shared resolve-and-confine filesystem walk (resolve_confined_path), symlink-safe writes (write_confined_file, open_confined_write)
provenance GenerationProvenance/ConfigFingerprint/ToolDigest — SHA-256 digests recording when and against what server state a _meta.json sidecar was generated
untrusted sanitize_untrusted_text/sanitize_untrusted_inline — neutralizes attacker-controlled text (control chars, bidi overrides, invisible Unicode) before it reaches LLM-facing prompts or error messages
metadata ServerMetadata, METADATA_SCHEMA_VERSION, shared generated-file naming constants
cli Shared CLI helpers reused by mcp-execution-cli

Related Crates

This crate is part of the mcp-execution workspace:

MSRV Policy

Minimum Supported Rust Version: 1.91

MSRV increases are considered minor version bumps.

License

Licensed under either of Apache License 2.0 or MIT license at your option.