Struct McpPackagePin 

pub struct McpPackagePin {
    pub runner: String,
    pub name: String,
    pub version: String,
    pub install_dir: String,
    pub lockfile_sha256: String,
    pub signatures_missing: Option<u32>,
    pub provenance: Option<String>,
}

A package MUR installed itself, and the fingerprint that proves the installed tree hasn’t changed.

lockfile_sha256 hashes the install’s package-lock.json, which already records an integrity hash for every package in the dependency tree — so one small file covers the whole tree, and startup verification stays cheap no matter how large node_modules grows.

The lockfile pins what was installed. Editing a file inside node_modules afterwards would not change it; catching that needs a full tree hash, which is deliberately not done here — see the module docs on mur-core::cmd::agent_mcp_vendor for where that line is drawn.

Fields

runner: String

Package ecosystem — npm today.

name: String

Package name, including any @scope/ prefix.

version: String

Exact installed version.

install_dir: String

Directory MUR installed into, absolute.

lockfile_sha256: String

SHA-256 (lowercase hex) of <install_dir>/package-lock.json.

signatures_missing: Option<u32>

How many packages in the installed tree published no registry signature, as reported by npm audit signatures at vendor time.

None — the audit did not run (npm too old, or offline). Some(0) — every package in the tree carried a verified signature. Some(n) — n packages are unsigned; the rest verified.

A signature that verifies proves the bytes came from the registry, which the content hash cannot: it would faithfully pin a poisoned cache. An invalid signature is not recorded here because it blocks the vendor outright — that is an integrity failure, not a property to note.

provenance: Option<String>

SLSA predicate type of the package’s build provenance, when it publishes one — e.g. https://slsa.dev/provenance/v1. None means no attestation was published (still the common case).

Provenance ties a release back to a source repository and CI run, and is the only signal here that can catch a malicious publish: a content hash pins whatever was released, faithfully preserving a poisoned version rather than detecting it. Recorded and shown, never required — ecosystem coverage is far too thin to gate on.

Implementations

impl McpPackagePin

pub fn lockfile_name(&self) -> &'static str

Name of the lockfile whose hash is lockfile_sha256.

npm writes package-lock.json itself; for PyPI, MUR generates one with uv pip compile --generate-hashes, which records a sha256 for every package in the resolved tree — the same property that lets one small file stand in for the whole install.

pub fn lockfile_path(&self) -> PathBuf

Absolute path of the lockfile this pin covers.

The startup check, inspect, and the deep audit all resolve it through here, so a newly supported ecosystem cannot end up verified against the wrong file in one of them and silently pass.

Trait Implementations

impl Clone for McpPackagePin

fn clone(&self) -> McpPackagePin

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for McpPackagePin

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for McpPackagePin

fn default() -> McpPackagePin

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for McpPackagePin

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for McpPackagePin

impl PartialEq for McpPackagePin

fn eq(&self, other: &McpPackagePin) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for McpPackagePin

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for McpPackagePin