Struct McpServerConfig 

pub struct McpServerConfig {
    pub name: String,
    pub command: String,
    pub args: Vec<String>,
    pub env: BTreeMap<String, String>,
    pub env_passthrough: Vec<String>,
    pub sandbox: bool,
    pub network: Option<bool>,
    pub capabilities: CapabilityOverride,
    pub disabled: bool,
}

Fields

name: String

Prefixed onto every tool the server exposes, so two servers can both have a search without colliding.

command: String

args: Vec<String>

env: BTreeMap<String, String>

Values handed to the server explicitly. Use this for a token the server needs, so granting it is a decision written down rather than a side-effect of what happened to be exported.

env_passthrough: Vec<String>

Variables inherited from mecha’s own environment, by name.

Empty by default, and that default is the point: an MCP server is third-party code, and a process that inherits your whole environment inherits every provider key in it. PATH, HOME, LANG, LC_ALL and TZ always pass through — without them most runtimes cannot start.

sandbox: bool

Confine this server with the configured [sandbox] backend.

Off by default because a confined server sees only the workspace and, unless allowed, no network — which is wrong for most of the servers people actually run. Worth turning on for anything you did not write.

network: Option<bool>

Network for this server alone, overriding [sandbox] network.

The case this exists for: a third-party server that has to reach its own API, confined, while shell still has no way off the machine. With one shared switch you would have to open shell to satisfy the server.

capabilities: CapabilityOverride

Capabilities forced onto every tool this server exposes, on top of whatever it declares for itself.

MCP capability flags come from the server’s own annotations, which means a third-party server decides how much the interlock distrusts it. An unannotated tool is treated as private-but-trusted — wrong in the dangerous direction for anything that reaches the open world. A Google Docs server is the worked example: a document someone shared with you is third-party text, and writing into a document an attacker can read is an exfiltration channel, so it is all three legs at once and says none of them.

Only ever widens — see crate::tool::Capabilities::union.

disabled: bool

Skip this server without deleting its config.

Trait Implementations

impl Clone for McpServerConfig

fn clone(&self) -> McpServerConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for McpServerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for McpServerConfig

fn default() -> McpServerConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for McpServerConfig

where McpServerConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for McpServerConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.