If you discover a security vulnerability in rust-mcp-sdk, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Use GitHub Security Advisories

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

1. We acknowledge receipt within the timeline above
2. We investigate and confirm the vulnerability
3. We develop a fix in a private branch
4. We release the fix and publish a security advisory
5. We credit the reporter (unless they prefer anonymity)

This policy covers:

• rust-mcp-sdk — MCP protocol implementation
• rust-mcp-transport — Transport layer (stdio, SSE, streamable HTTP)
• rust-mcp-axum — Axum HTTP integration
• rust-mcp-actix — Actix HTTP integration
• rust-mcp-macros — Proc-macro code generation
• rust-mcp-schema — Protocol schema types

• DNS Rebinding: Localhost MCP servers must validate Host/Origin headers. The SDK provides DnsRebindingOptions middleware for this purpose.
• Transport Security: Stdio transport is local-only. HTTP transports should use TLS in production.
• Input Validation: Tool input schemas are validated by the SDK. Servers should additionally validate business logic.