refactor: migrate to rmcp-based architecture#95
Merged
Conversation
Rivet project initialized with STPA schema for rmcp migration safety analysis. 58 artifacts covering losses, hazards, constraints, UCAs, and loss scenarios for migrating from full MCP stack to rmcp extensions. Phase 0+1 design spec and implementation plan ready for execution.
Working PoC proving Tower middleware can intercept rmcp HTTP requests, enforce Bearer auth, and propagate AuthContext into MCP tool handlers via http::request::Parts extensions.
Implements PoC 3 proving rmcp 1.3 supports the MCP Apps extension pattern (SEP-1865) for serving interactive HTML via resources and tools.
Implements a matchit-based ResourceRouter that maps MCP URI templates (file:///, config://) to handler functions, overriding list_resource_templates and read_resource on ServerHandler alongside #[tool_handler] tools.
Generic structured logging crate — not MCP-specific. Provides credential scrubbing, metrics, alerting, correlation IDs.
Generic Axum/Tower security middleware — not MCP-specific. Remove unused mcp-protocol dependency.
URI-template-based resource router built on matchit for rmcp MCP servers. Provides ResourceRouter<S> with scheme-aware URI matching, handler dispatch, and template listing for ServerHandler integration.
Generic auth/RBAC/session crate — not MCP-specific. Remove mcp-protocol dependency, rename MCP-prefixed types (McpPermission → Permission, McpPermissionChecker → PermissionChecker). Middleware now operates on generic (method, params) instead of MCP Request.
mcp-logging/ → pulseengine-logging/ mcp-auth/ → pulseengine-auth/ mcp-security-middleware/ → pulseengine-security/ Remove poc/ directory — validation complete, results in poc/RESULTS.md preserved in git history.
Code Coverage Report 📊Local Coverage: 8.08%
Coverage Details📋 Full Report: View on Codecov |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
PR Validation ResultsQuick Validation: ✅
Validation Framework: ✅
Compatibility Check: ✅
Summary: ✅ All checks passed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrate from full parallel MCP SDK to targeted extensions built on the official
rmcpSDK (v1.3, 6.3M downloads).What changed:
pulseengine-mcp-logging→pulseengine-loggingpulseengine-mcp-security-middleware→pulseengine-securitypulseengine-mcp-auth→pulseengine-auth(removed mcp-protocol dependency, -212 LOC)pulseengine-mcp-resources— resource URI template router for rmcppulseengine-mcp-apps— MCP Apps / UI Resources extension for rmcpdocs/MIGRATION.mdWhy: rmcp now covers protocol types, transports, and macros well. Maintaining a parallel implementation is unsustainable. We keep only what rmcp lacks: security middleware, auth/RBAC, observability, resource routing, and MCP Apps.
12 → 5 maintained crates. ~31K lines of spec-tracking code offloaded to rmcp.
Test plan
cargo check --workspacepassespulseengine-logging: 133 tests passpulseengine-security: 65 tests passpulseengine-auth: 265 tests passpulseengine-mcp-resources: 15 tests passpulseengine-mcp-apps: 16 tests passrivet validatepasses (98% traceability coverage)