Struct McpServerConfig 

pub struct McpServerConfig {

    pub id: String,
    pub command: Option<String>,
    pub args: Vec<String>,
    pub env: HashMap<String, String>,
    pub url: Option<String>,
    pub timeout: u64,
    pub policy: McpPolicy,
    pub headers: HashMap<String, String>,
    pub oauth: Option<McpOAuthConfig>,
    pub trust_level: McpTrustLevel,
    pub tool_allowlist: Option<Vec<String>>,
    pub allow_untrusted_without_allowlist: bool,
    pub expected_tools: Vec<String>,
    pub roots: Vec<McpRootEntry>,
    pub tool_metadata: HashMap<String, ToolSecurityMeta>,
    pub elicitation_enabled: Option<bool>,
    pub env_isolation: Option<bool>,
    pub media_passthrough: bool,
}

Fields

id: String

command: Option<String>

Stdio transport: command to spawn.

args: Vec<String>

env: HashMap<String, String>

Environment variables for the spawned Stdio process. Values may hold vault references (${VAULT_KEY}) or, in a hand-written config, raw secrets.

Security

Intentionally not redacted in Serialize: --init persists this map to config.toml, so a redacting Serialize would corrupt the round-trip. The redacting Debug impl on this struct is the approved representation for any log/dump/status output — never emit this field’s values via Serialize or any other non-Debug representation.

url: Option<String>

HTTP transport: remote MCP server URL.

timeout: u64

policy: McpPolicy

Optional declarative policy for this server (allowlist, denylist, rate limit).

headers: HashMap<String, String>

Static HTTP headers for the transport (e.g. Authorization: Bearer <token>). Values support vault references: ${VAULT_KEY}.

Security

Intentionally not redacted in Serialize — same rationale as env: --init persists this map to config.toml, and the redacting Debug impl is the approved representation for log/dump/status output — never emit this field’s values via Serialize or any other non-Debug representation.

oauth: Option<McpOAuthConfig>

OAuth 2.1 configuration for this server.

trust_level: McpTrustLevel

Trust level for this server. Default: Untrusted.

tool_allowlist: Option<Vec<String>>

Tool allowlist. None means no override (inherit defaults). Some(vec![]) is an explicit empty list (deny all for Untrusted/Sandboxed). Some(vec!["a", "b"]) allows only listed tools.

allow_untrusted_without_allowlist: bool

Explicit opt-in to expose all tools for an Untrusted server that has no tool_allowlist declared. Default: false — secure by default (fails closed).

When false (default) and trust_level == Untrusted with tool_allowlist = None, zero tools are exposed. Set true only when you intentionally want this server to expose all its tools while still running the full untrusted pipeline (SSRF checks, sanitization, injection detection, attestation, data-flow filtering) — this is distinct from trust_level = trusted, which additionally relaxes SSRF/data-flow enforcement. Has no effect on Trusted/Sandboxed servers or when tool_allowlist is set.

expected_tools: Vec<String>

Expected tool names for attestation. Supplements tool_allowlist.

When non-empty: tools not in this list are filtered out (Untrusted/Sandboxed) or warned about (Trusted). Schema drift is logged when fingerprints change between connections.

roots: Vec<McpRootEntry>

Filesystem roots exposed to this MCP server via roots/list. Each entry is a {uri, name?} pair. URI must use file:// scheme. When empty, the server receives an empty roots list.

tool_metadata: HashMap<String, ToolSecurityMeta>

Per-tool security metadata overrides. Keys are tool names. When absent for a tool, metadata is inferred from the tool name via heuristics.

elicitation_enabled: Option<bool>

Per-server elicitation override. None = inherit global elicitation_enabled. Some(true) = allow this server to elicit regardless of global setting. Some(false) = always decline for this server.

env_isolation: Option<bool>

Isolate the environment for this Stdio server.

When true (or when [mcp].default_env_isolation = true), the spawned process only sees a minimal base env (PATH, HOME, etc.) plus this server’s env map. Overrides [mcp].default_env_isolation when set explicitly. Default: false (backward compatible).

media_passthrough: bool

Opt-in: decode and attach images this server returns as native MessagePart::Image siblings for vision-capable providers (spec-072). Default: false.

Independent of trust_level but always hard-blocked when trust_level == McpTrustLevel::Sandboxed, regardless of this flag.

Trait Implementations

impl Clone for McpServerConfig

fn clone(&self) -> McpServerConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for McpServerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for McpServerConfig

fn deserialize<__D>( __deserializer: __D, ) -> Result<McpServerConfig, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for McpServerConfig

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.