pmcp-code-mode 0.5.4

Code Mode validation and execution framework for MCP servers
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

[package]
name = "pmcp-code-mode"
version = "0.5.4"
edition = "2021"
license = "MIT"
repository = "https://github.com/paiml/rust-mcp-sdk"
description = "Code Mode validation and execution framework for MCP servers"
readme = "README.md"
keywords = ["mcp", "code-mode", "validation", "llm", "cedar"]
categories = ["development-tools", "web-programming"]

[package.metadata.docs.rs]
all-features = true
rustdoc-args = ["--cfg", "docsrs"]

[dependencies]
# `default-features = false` + the one default feature this crate actually wants.
#
# WHY, and do NOT "simplify" this back to a bare `path` dep: `pmcp-code-mode` is
# also a DEV-DEPENDENCY of `pmcp` itself (root Cargo.toml, for the s41 code-mode
# example). Taking `pmcp`'s default feature set here therefore unifies
# `default = ["logging", "v1-compat"]` back ON for every `cargo test` of `pmcp`
# — including
# `cargo test -p pmcp --test v2_client_carries_no_session_on_severed_build
#  --no-default-features --features full-v2`, whose whole-file `cfg` then
# compiles the file away and reports `0 tests, exit 0`: a severance proof that
# silently proves nothing (plan 117-14). `v1-compat` is a marker feature this
# crate uses no item from, so dropping it costs nothing here.
pmcp = { version = ">=2.2.0", path = "../../", default-features = false, features = [
    "logging",
] }
async-trait = "0.1"
tokio = { version = "1", features = ["sync"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
thiserror = "2"
tracing = "0.1"
base64 = "0.23"
hmac = "0.13"
secrecy = "0.10"
sha2 = "0.11"
zeroize = { version = "1.8", features = ["derive"] }
uuid = { version = "1", features = ["v4"] }
hex = "0.4"
chrono = "0.4"
graphql-parser = "0.4"
toml = "1.0"

# JavaScript parsing (optional, for OpenAPI Code Mode).
# Aligned to the coherent swc "41" generation (parser 41, ast 25, visit 25,
# common 23). These four crates share generated AST/visitor types and MUST move
# together — a mixed set (e.g. parser 41 + ast 23) resolves two copies of
# swc_ecma_ast and breaks the `Visit` impl in javascript.rs with E0053.
swc_ecma_parser = { version = "41", optional = true }
swc_ecma_ast = { version = "25", optional = true }
swc_ecma_visit = { version = "25", optional = true }
swc_common = { version = "23", optional = true }

# SQL parsing (optional, for SQL Code Mode)
sqlparser = { version = "0.62", optional = true }

# Local Cedar policy evaluation (optional)
cedar-policy = { version = "4.9", optional = true }

# AWS Verified Permissions (optional)
# Why: default features enable `rustls` → aws-smithy-runtime/tls-rustls →
# aws-smithy-http-client/legacy-rustls-ring → rustls 0.21 / rustls-webpki 0.101
# (RUSTSEC-2026-0098/0099/0104). Opt into the modern `default-https-client`
# path (rustls 0.23 via aws-lc-rs) instead.
aws-config = { version = "1", default-features = false, features = ["default-https-client", "rt-tokio", "credentials-process", "sso", "behavior-version-latest"], optional = true }
aws-sdk-verifiedpermissions = { version = "1", default-features = false, features = ["default-https-client", "rt-tokio", "behavior-version-latest"], optional = true }

[features]
default = []
openapi-code-mode = ["dep:swc_ecma_parser", "dep:swc_ecma_ast", "dep:swc_ecma_visit", "dep:swc_common"]
sql-code-mode = ["dep:sqlparser"]
js-runtime = ["openapi-code-mode"]
mcp-code-mode = ["js-runtime"]
cedar = ["dep:cedar-policy"]
avp = ["dep:aws-config", "dep:aws-sdk-verifiedpermissions"]

[dev-dependencies]
tokio = { version = "1", features = ["rt-multi-thread", "macros"] }
cedar-policy = "4.9"
proptest = "1.7"