Enum McpCliAction 

pub enum McpCliAction {
    Serve {
        allowed_keys: Option<String>,
        denied_keys: Option<String>,
        contract: Option<String>,
        workdir: Option<String>,
        allow_reveal: bool,
        audit_source: Option<String>,
    },
    Install {
        host: String,
        name: Option<String>,
        global: bool,
        project: Option<String>,
        dry_run: bool,
        allowed_keys: Option<String>,
        denied_keys: Option<String>,
        contract: Option<String>,
        workdir: Option<String>,
        allow_reveal: bool,
    },
    Config {
        host: String,
        name: Option<String>,
        contract: Option<String>,
        workdir: Option<String>,
    },
    Uninstall {
        host: String,
        name: Option<String>,
    },
    Doctor {
        code: String,
        contract: String,
        workdir: String,
        receipt_id: Option<String>,
        json: bool,
    },
    Status,
}

tsafe mcp ... subcommands per design §5.2 / ADR-006. Gated behind the mcp feature.

Variants

Serve

Start the MCP stdio JSON-RPC server bound to the current profile.

Hosts invoke this directly via the entry written by tsafe mcp install. Running it interactively is mainly useful for diagnostics.

Fields

allowed_keys: Option<String>

Comma-separated glob list of vault keys this server may expose.

denied_keys: Option<String>

Comma-separated glob list of vault keys to exclude even when matched by --allowed-keys or the bound contract.

contract: Option<String>

Bind an authority contract for stricter scope and per-key intent.

workdir: Option<String>

Bind this server to a single repository/work directory.

allow_reveal: bool

Enable the opt-in tsafe_reveal tool. Off by default.

audit_source: Option<String>

Label written to the audit source field (e.g. mcp:claude:1234).

Install

Write an MCP server entry into the host’s config file.

Refuses to write without an explicit --allowed-keys or --contract.

Fields

host: String

Host name. One of: claude, cursor, continue, windsurf, codex.

name: Option<String>

Server entry name. Defaults to tsafe-<profile>.

global: bool

Write to the global per-user config (default when no scope flag is set).

project: Option<String>

Write to a project-local config under the given directory.

dry_run: bool

Print the proposed file change without modifying disk.

allowed_keys: Option<String>

Comma-separated glob list of vault keys the server may expose.

denied_keys: Option<String>

Comma-separated glob list of vault keys to exclude.

contract: Option<String>

Bind an authority contract for stricter scope.

workdir: Option<String>

Bind the installed server entry to a single repository/work directory.

allow_reveal: bool

Enable the opt-in tsafe_reveal tool on the installed entry.

Config

Emit a safe MCP config entry for a host without embedding secret values.

Fields

host: String

Host name. Currently: codex.

name: Option<String>

Server entry name. Defaults to tsafe-<profile>.

contract: Option<String>

Bind an authority contract for command execution.

workdir: Option<String>

Bind this server entry to a single repository/work directory.

Uninstall

Remove an MCP server entry from the host’s config file.

Fields

host: String

Host name. One of: claude, cursor, continue, windsurf, codex.

name: Option<String>

Server entry name. Defaults to tsafe-<profile>.

Doctor

Render model-safe remediation for a bound MCP denial code.

Fields

code: String

Bound MCP authority denial code, e.g. missing_contract.

contract: String

Bound authority contract name.

workdir: String

Bound repository or work directory.

receipt_id: Option<String>

Existing receipt id if the denial already produced one.

json: bool

Emit structured JSON instead of the human summary.

Status

Print binary version + resolved scope. Lightweight diagnostic; does not speak JSON-RPC.

Trait Implementations

impl FromArgMatches for McpCliAction

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for McpCliAction

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand