Struct McpToolExecutor 

pub struct McpToolExecutor { /* private fields */ }

ToolExecutor implementation that dispatches tool calls to MCP servers.

McpToolExecutor bridges the zeph-tools dispatch layer and McpManager. It maintains a local snapshot of the registered MCP tools (updated via set_tools) and resolves tool calls by matching the sanitized tool ID against the snapshot before forwarding to the manager.

Security invariant

execute_tool_call sets ToolOutput::tool_name to McpTool::qualified_name (i.e. "server_id:name"). The ':' in the name is the signal used by zeph-core’s sanitize_tool_output() to route responses through the quarantine pipeline. Do not change this.

Fenced-block execution

execute parses ```mcp fenced blocks from LLM output and validates each server:tool pair against the registered list before dispatching, preventing prompt injection from routing calls to unknown servers.

Implementations

impl McpToolExecutor

pub fn new(manager: Arc<McpManager>, tools: Arc<RwLock<Vec<McpTool>>>) -> Self

Create a new executor from a shared McpManager and a shared tool list.

The tools RwLock is updated via set_tools after each connect or refresh. Pass the same Arc<RwLock<Vec<McpTool>>> to both the executor and the code that handles tools/list_changed events.

pub fn set_tools(&self, tools: Vec<McpTool>)

Replace the registered tool snapshot.

Logs a WARN for each sanitized_id collision: when two tools map to the same sanitized ID the second is unreachable via execute_tool_call.

Trait Implementations

impl Clone for McpToolExecutor

fn clone(&self) -> McpToolExecutor

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for McpToolExecutor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ToolExecutor for McpToolExecutor

fn tool_definitions(&self) -> Vec<ToolDef>

Return the tool definitions this executor can handle.

async fn execute_tool_call( &self, call: &ToolCall, ) -> Result<Option<ToolOutput>, ToolError>

Execute a structured tool call. Returns Ok(None) if call.tool_id is not handled.

async fn execute(&self, response: &str) -> Result<Option<ToolOutput>, ToolError>

Parse response for fenced tool blocks and execute them.

fn execute_confirmed( &self, response: &str, ) -> impl Future<Output = Result<Option<ToolOutput>, ToolError>> + Send

Execute bypassing confirmation checks (called after user approves).

fn execute_tool_call_confirmed( &self, call: &ToolCall, ) -> impl Future<Output = Result<Option<ToolOutput>, ToolError>> + Send

Execute a structured tool call bypassing confirmation checks.

fn set_skill_env(&self, _env: Option<HashMap<String, String>>)

Inject environment variables for the currently active skill. No-op by default.

fn set_effective_trust(&self, _level: SkillTrustLevel)

Set the effective trust level for the currently active skill. No-op by default.

fn is_tool_retryable(&self, _tool_id: &str) -> bool

Whether the executor can safely retry this tool call on a transient error.

fn is_tool_speculatable(&self, _tool_id: &str) -> bool

Whether a tool call can be safely dispatched speculatively (before the LLM finishes).

fn requires_confirmation(&self, _call: &ToolCall) -> bool

Return true when call would require user confirmation before execution.