Struct Capabilities 

pub struct Capabilities {
    pub private_data: bool,
    pub untrusted_input: bool,
    pub external_send: bool,
    pub destructive: bool,
}

What a tool can do — the vocabulary MCP standardized (readOnly, destructive, openWorld) plus the two axes that decide whether an agent can be turned into an exfiltration tool.

The lethal trifecta is private data + untrusted content + a way out. Any agent holding all three can be instructed, by text hidden in the content it reads, to take the private data and send it somewhere. Annotating tools on these axes is what lets the loop refuse that combination structurally.

Fields

private_data: bool

Returns data the user considers private.

untrusted_input: bool

Returns content a third party can influence — a web page, an email body, a calendar invite title. Treat everything it returns as hostile.

external_send: bool

Can transmit data outside the user’s control. Note that a plain HTTP GET qualifies: the secret goes in the query string.

destructive: bool

May destroy or overwrite data.

Implementations

impl Capabilities

pub fn private(self) -> Self

pub fn untrusted(self) -> Self

pub fn sends(self) -> Self

pub fn destructive(self) -> Self

pub fn union(self, other: Capabilities) -> Self

Everything either side declares.

Union rather than assignment, because the only safe direction for an override is wider. Letting config narrow a tool’s declared capabilities would disarm the interlock on the strength of a claim nothing enforces — the same mistake as a sandbox that silently degrades, and it would make the cheapest configuration the most dangerous one. A server that genuinely over-declares is what TrifectaPolicy is for: one deliberate, visible decision instead of a quiet per-server exemption.

Trait Implementations

impl Clone for Capabilities

fn clone(&self) -> Capabilities

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Capabilities

impl Debug for Capabilities

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Capabilities

fn default() -> Capabilities

Returns the “default value” for a type.

impl Eq for Capabilities

impl From<CapabilityOverride> for Capabilities

fn from(o: CapabilityOverride) -> Self

Converts to this type from the input type.

impl PartialEq for Capabilities

fn eq(&self, other: &Capabilities) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Capabilities