Enum McpNetMode 

pub enum McpNetMode {
    Inherit,
    Restricted,
    BroadAudited,
    Off,
}

How an MCP server’s outbound network is scoped.

Variants

Inherit

No per-server policy and no proxy — the default.

NOT “inherits entitlements.network.outbound.allow_hosts”, despite the name. That list is enforced in-process (a DNS guard on the runtime’s own HTTP client, plus the B0 gate on the agent’s network.* tools), and a spawned server never runs either. What a server here actually inherits is the OS sandbox — which restricts by PORT, with the host left open.

So an agent whose allow_hosts names one API still lets an Inherit server reach any host on an allowed port. Use Restricted to bound a server by host. The variant keeps its name because it is a serialized wire value; the lie was the doc, and it is fixed here rather than migrated.

Restricted

Allow only allow_hosts, routed through the runtime egress proxy.

BroadAudited

Allow ALL hosts EXCEPT deny_hosts, routed through the runtime egress proxy, with every CONNECT audited. For trusted-but-broad tools (e.g. a web-research browser) that cannot enumerate their destinations. Requires explicit operator consent (records authorization); downgraded to Inherit on import (lowest trust). Advisory enforcement (see egress_proxy).

Off

No outbound for this server at all.

Trait Implementations

impl Clone for McpNetMode

fn clone(&self) -> McpNetMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for McpNetMode

impl Debug for McpNetMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for McpNetMode

fn default() -> McpNetMode

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for McpNetMode

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for McpNetMode

impl PartialEq for McpNetMode

fn eq(&self, other: &McpNetMode) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for McpNetMode

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for McpNetMode