Crate mcp_execution_core 

Core types, traits, and errors for MCP Code Execution.

This crate provides the foundational types and abstractions used across all other crates in the MCP execution workspace.

Architecture

The core consists of:

• Strong domain types (ServerId, ToolName)
• Error hierarchy with contextual information
• Server configuration with security validation
• Command validation utilities

Examples

use mcp_execution_core::{ServerConfig, ServerId};

// Create a server configuration
let config = ServerConfig::builder()
    .command("docker".to_string())
    .arg("run".to_string())
    .env("LOG_LEVEL".to_string(), "debug".to_string())
    .build()
    .unwrap();

// Server ID
let server_id = ServerId::new("github").unwrap();

Modules

cli

CLI-specific types and utilities.

metadata

Structured sidecar metadata describing a server’s generated tools.

provenance

Generation provenance for the _meta.json sidecar: when, and against what server state, a generate run produced its output.

untrusted

Helpers for safely embedding untrusted MCP-server-supplied metadata into Markdown documents and LLM-facing prompts.

Structs

RedactedItems

Debug-formats a list of strings, replacing every entry wholesale with REDACTED_PLACEHOLDER.

RedactedMapValues

Debug-formats a String-valued map with keys visible and every value replaced by REDACTED_PLACEHOLDER.

RedactedUrl

Debug-formats a URL with userinfo credentials and query string hidden, keeping the scheme, host, and path readable.

ServerConfig

MCP server configuration with command, arguments, and environment.

ServerConfigBuilder

Builder for constructing ServerConfig instances.

ServerId

Server identifier (newtype over String).

ToolName

Tool name identifier (newtype over String).

Enums

ConfinementError

Errors from walking and confining a path to a base directory.

ConfinementTarget

The terminal path component a resolve_confined_path walk resolves and confinement-checks but deliberately does not create.

Error

Main error type for MCP Code Execution.

ResourceKind

Identifies which bounded resource a Error::ResourceLimitExceeded rejection concerns.

ServerIdError

Error returned when a candidate string fails the invariant ServerId::new enforces.

ServerIdSlugError

Errors returned by validate_server_id_slug.

ToolNameError

Error returned when a candidate string fails the invariant ToolName::new enforces.

Transport

Transport-specific configuration for connecting to an MCP server.

Constants

MAX_ARG_COUNT

Maximum number of positional arguments accepted in a ServerConfig (denial-of-service protection, CWE-400).

MAX_ARG_LEN

Maximum byte length for a single command string, argument, or environment variable name.

MAX_ENV_COUNT

Maximum number of environment variables accepted in a ServerConfig.

MAX_ENV_VALUE_LEN

Maximum byte length for a single environment variable value.

MAX_HEADER_COUNT

Maximum number of HTTP headers accepted for Http/Sse transport.

MAX_HEADER_VALUE_LEN

Maximum byte length for a single HTTP header value.

MAX_SERVER_ID_LENGTH

Maximum length, in bytes, of a slug-shaped server id (see validate_server_id_slug).

MAX_URL_LEN

Maximum byte length for the HTTP/Sse transport url.

REDACTED_PLACEHOLDER

Fixed placeholder substituted for every redacted value.

Functions

contains_parent_dir

Returns true if path contains a .. (parent-directory) component.

env_name_charset_desc

Returns the human-readable description of the environment-variable-name identifier charset used in this module’s own rejection message ("[A-Za-z_][A-Za-z0-9_]*").

env_name_charset_pattern

Returns the environment-variable-name identifier charset as an anchored, JavaScript RegExp-compatible pattern source.

first_disallowed_identifier_char

Returns the first char in s that is not UTS #39 Identifier_Status=Allowed, or None if every character is Allowed.

forbidden_chars

Returns the shell metacharacters considered forbidden in a command or argument string.

forbidden_env_names

Returns the exact-match forbidden environment variable names.

forbidden_env_prefix

Returns the environment-variable-name prefix rejected regardless of exact match (currently DYLD_, macOS’s dynamic-linker variable family).

open_confined_write

Opens path for writing, refusing to follow a pre-existing symlink planted at that exact location.

redact_urls_in_text

Finds every URL-shaped token in text and redacts each one.

resolve_confined_path

Resolves segment, then relative_dirs, then target (if any), confining every step to base_dir/segment.

sanitize_path_for_error

Sanitizes a file path for inclusion in an error message, to prevent information disclosure.

validate_path_segment

Validates that segment is a single plain path component: non-empty, and with no .., path separator, or root/prefix component.

validate_server_config

Validates a ServerConfig for safe execution, dispatching on transport type.

validate_server_id_slug

Validates that id is a filesystem-safe server id slug: 1-64 lowercase ASCII letters, digits, or hyphens (^[a-z0-9-]+$).

validate_url_scheme

Validates that a URL uses the http:// or https:// scheme.

write_confined_file

Writes content to path, refusing to follow a symlink planted at path’s exact location after a caller’s ConfinementTarget::File confinement check but before this call.

Type Aliases

Result

Result type alias for MCP operations.