Function validate_url_scheme 

pub fn validate_url_scheme(url: &str) -> Result<()>

Validates that a URL uses the http:// or https:// scheme.

This is defense in depth: rejects file://, unix://, and similar schemes at the mcp-core validation boundary rather than relying on the HTTP client to reject them. The scheme comparison is case-insensitive per RFC 3986 (HTTP://host is a valid URL, not a different scheme).

This is a minimal, string-based scheme check — it does not validate the rest of the URL’s structure (e.g. it does not require a host). It is exposed publicly so that other crates checking URL validity for the same http/sse transport (e.g. mcp-execution-cli’s server status/validation commands) can share this exact rule instead of drifting from it with a second, differently-behaved check.

Errors

Returns Error::SecurityViolation if url does not start with an http:// or https:// scheme (case-insensitive).

Examples

use mcp_execution_core::validate_url_scheme;

assert!(validate_url_scheme("https://example.com/mcp").is_ok());
assert!(validate_url_scheme("HTTP://example.com").is_ok());
assert!(validate_url_scheme("ftp://example.com").is_err());
assert!(validate_url_scheme("  https://example.com").is_err());