Struct ContentTrustConfig 

pub struct ContentTrustConfig {
    pub trusted_mcp_servers: Vec<String>,
    pub untrusted_tools: Vec<String>,
    pub trusted_tools: Vec<String>,
}

Which tool sources count as untrusted for memory purposes (§10.1).

Mirrors Codex’s pollutes_memory posture: web/fetch and provider-native search are always untrusted; MCP servers are untrusted by default with an explicit trusted_mcp_servers allowlist. Note meerkat’s ToolAccessPolicy::AllowList is invocation gating and cannot serve this role.

Fields

trusted_mcp_servers: Vec<String>

MCP servers whose tools do not taint. Joinable in P1 only for server-qualified tool names (mcp__<server>__<tool>).

untrusted_tools: Vec<String>

Explicit tool names that taint the session when their results enter context. The escape hatch for unqualified MCP tool names.

trusted_tools: Vec<String>

Explicit tool names that never taint (cannot override the builtin web/fetch class or untrusted_tools).

Implementations

impl ContentTrustConfig

pub fn from_json_value(value: &Value) -> Result<Self, String>

Fail-loud JSON parse for the gateway config block agent_memory.content_trust { ... }. Unknown fields and wrong types are errors, never silently ignored.

pub fn classify_tool(&self, name: &str) -> ToolContentTrust

Classify a tool by NAME (the only fact the observe-stream event surface carries - module docs). Precedence: builtin web/fetch (non-overridable) > untrusted_tools > trusted_tools > MCP-qualified names against the server allowlist > trusted.

pub fn classify_tool_with_provenance( &self, name: &str, provenance: Option<&ToolProvenance>, ) -> ToolContentTrust

Classify a tool with the typed ToolDef.provenance owner when the caller has it (the dispatch-time join - module docs). Precedence is Self::classify_tool’s, with the MCP step widened: typed ToolSourceKind::Mcp provenance attributes the tool to provenance.source_id regardless of the name shape; absent or non-MCP provenance falls back to the mcp__<server>__<tool> name join. Explicit trusted_tools entries still override server-level distrust, exactly as on the name-only path.

Trait Implementations

impl Clone for ContentTrustConfig

fn clone(&self) -> ContentTrustConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ContentTrustConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ContentTrustConfig

fn default() -> ContentTrustConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ContentTrustConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ContentTrustConfig

impl PartialEq for ContentTrustConfig

fn eq(&self, other: &ContentTrustConfig) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ContentTrustConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ContentTrustConfig