@@ -177,6 +177,97 @@ const forbiddenContentRules = [
177177 } ,
178178 ] ,
179179 } ,
180+ {
181+ path : 'src/crates/core/src/service/mcp/server/config.rs' ,
182+ patterns : [
183+ {
184+ regex : / \b p u b e n u m M C P S e r v e r T r a n s p o r t \b / ,
185+ message : 'core MCP server config facade must not redefine MCPServerTransport; use the integrations contract' ,
186+ } ,
187+ {
188+ regex : / \b p u b s t r u c t M C P S e r v e r O A u t h C o n f i g \b / ,
189+ message : 'core MCP server config facade must not redefine OAuth config; use the integrations contract' ,
190+ } ,
191+ {
192+ regex : / \b p u b s t r u c t M C P S e r v e r X a a C o n f i g \b / ,
193+ message : 'core MCP server config facade must not redefine XAA config; use the integrations contract' ,
194+ } ,
195+ {
196+ regex : / \b p u b s t r u c t M C P S e r v e r C o n f i g \b / ,
197+ message : 'core MCP server config facade must not redefine server config; use the integrations contract' ,
198+ } ,
199+ {
200+ regex : / \b f n d e f a u l t _ t r u e \b / ,
201+ message : 'core MCP server config facade must not redefine config serde defaults; use the integrations contract' ,
202+ } ,
203+ {
204+ regex : / \b p u b f n r e s o l v e d _ t r a n s p o r t \b / ,
205+ message : 'core MCP server config facade must not redefine transport defaults; use the integrations contract' ,
206+ } ,
207+ {
208+ regex : / \b p u b f n v a l i d a t e \b / ,
209+ message : 'core MCP server config facade must not redefine config validation; use the integrations contract' ,
210+ } ,
211+ ] ,
212+ } ,
213+ {
214+ path : 'src/crates/core/src/service/mcp/config/cursor_format.rs' ,
215+ patterns : [
216+ {
217+ regex : / \b f n p a r s e _ s o u r c e \b / ,
218+ message : 'core MCP cursor facade must not redefine source parsing; use the integrations contract' ,
219+ } ,
220+ {
221+ regex : / \b f n p a r s e _ t r a n s p o r t \b / ,
222+ message : 'core MCP cursor facade must not redefine transport parsing; use the integrations contract' ,
223+ } ,
224+ {
225+ regex : / \b f n p a r s e _ l e g a c y _ t y p e \b / ,
226+ message : 'core MCP cursor facade must not redefine legacy type parsing; use the integrations contract' ,
227+ } ,
228+ ] ,
229+ } ,
230+ {
231+ path : 'src/crates/core/src/service/mcp/protocol/jsonrpc.rs' ,
232+ patterns : [
233+ {
234+ regex : / \b f n s e r i a l i z e _ p a r a m s \b / ,
235+ message : 'core MCP jsonrpc facade must not redefine request parameter serialization; use the integrations contract' ,
236+ } ,
237+ {
238+ regex : / \b p u b f n c r e a t e _ i n i t i a l i z e _ r e q u e s t \b / ,
239+ message : 'core MCP jsonrpc facade must not redefine initialize request builders; use the integrations contract' ,
240+ } ,
241+ {
242+ regex : / \b p u b f n c r e a t e _ r e s o u r c e s _ l i s t _ r e q u e s t \b / ,
243+ message : 'core MCP jsonrpc facade must not redefine resources/list request builders; use the integrations contract' ,
244+ } ,
245+ {
246+ regex : / \b p u b f n c r e a t e _ r e s o u r c e s _ r e a d _ r e q u e s t \b / ,
247+ message : 'core MCP jsonrpc facade must not redefine resources/read request builders; use the integrations contract' ,
248+ } ,
249+ {
250+ regex : / \b p u b f n c r e a t e _ p r o m p t s _ l i s t _ r e q u e s t \b / ,
251+ message : 'core MCP jsonrpc facade must not redefine prompts/list request builders; use the integrations contract' ,
252+ } ,
253+ {
254+ regex : / \b p u b f n c r e a t e _ p r o m p t s _ g e t _ r e q u e s t \b / ,
255+ message : 'core MCP jsonrpc facade must not redefine prompts/get request builders; use the integrations contract' ,
256+ } ,
257+ {
258+ regex : / \b p u b f n c r e a t e _ t o o l s _ l i s t _ r e q u e s t \b / ,
259+ message : 'core MCP jsonrpc facade must not redefine tools/list request builders; use the integrations contract' ,
260+ } ,
261+ {
262+ regex : / \b p u b f n c r e a t e _ t o o l s _ c a l l _ r e q u e s t \b / ,
263+ message : 'core MCP jsonrpc facade must not redefine tools/call request builders; use the integrations contract' ,
264+ } ,
265+ {
266+ regex : / \b p u b f n c r e a t e _ p i n g _ r e q u e s t \b / ,
267+ message : 'core MCP jsonrpc facade must not redefine ping request builders; use the integrations contract' ,
268+ } ,
269+ ] ,
270+ } ,
180271 {
181272 path : 'src/crates/core/src/service/remote_ssh/workspace_state.rs' ,
182273 patterns : [
@@ -357,6 +448,56 @@ function runManifestParserSelfTest() {
357448 throw new Error ( `remote SSH workspace boundary rule must forbid helper: ${ helper } ) ;
358449 }
359450 }
451+
452+ const mcpJsonrpcRule = forbiddenContentRules . find (
453+ ( rule ) => rule . path === 'src/crates/core/src/service/mcp/protocol/jsonrpc.rs' ,
454+ ) ;
455+ if ( ! mcpJsonrpcRule ) {
456+ throw new Error ( 'missing MCP JSON-RPC boundary rule' ) ;
457+ }
458+ const mcpJsonrpcHelpers = [
459+ 'serialize_params' ,
460+ 'create_initialize_request' ,
461+ 'create_resources_list_request' ,
462+ 'create_resources_read_request' ,
463+ 'create_prompts_list_request' ,
464+ 'create_prompts_get_request' ,
465+ 'create_tools_list_request' ,
466+ 'create_tools_call_request' ,
467+ 'create_ping_request' ,
468+ ] ;
469+ const mcpJsonrpcRuleText = mcpJsonrpcRule . patterns
470+ . map ( ( pattern ) => pattern . regex . source )
471+ . join ( '\n' ) ;
472+ for ( const helper of mcpJsonrpcHelpers ) {
473+ if ( ! mcpJsonrpcRuleText . includes ( helper ) ) {
474+ throw new Error ( `MCP JSON-RPC boundary rule must forbid helper: ${ helper } ) ;
475+ }
476+ }
477+
478+ const mcpServerConfigRule = forbiddenContentRules . find (
479+ ( rule ) => rule . path === 'src/crates/core/src/service/mcp/server/config.rs' ,
480+ ) ;
481+ if ( ! mcpServerConfigRule ) {
482+ throw new Error ( 'missing MCP server config boundary rule' ) ;
483+ }
484+ const mcpServerConfigContracts = [
485+ 'MCPServerTransport' ,
486+ 'MCPServerOAuthConfig' ,
487+ 'MCPServerXaaConfig' ,
488+ 'MCPServerConfig' ,
489+ 'default_true' ,
490+ 'resolved_transport' ,
491+ 'validate' ,
492+ ] ;
493+ const mcpServerConfigRuleText = mcpServerConfigRule . patterns
494+ . map ( ( pattern ) => pattern . regex . source )
495+ . join ( '\n' ) ;
496+ for ( const contract of mcpServerConfigContracts ) {
497+ if ( ! mcpServerConfigRuleText . includes ( contract ) ) {
498+ throw new Error ( `MCP server config boundary rule must forbid contract: ${ contract } ) ;
499+ }
500+ }
360501}
361502
362503function checkCargoManifest ( crateDir ) {
0 commit comments