Review: rust-rmcp 3.3.0-1

Package Information

Description	Rust SDK for Model Context Protocol - Rust source code Source code for Debianized Rust crate "rmcp"
Maintainer	Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
Changed By	Brian Cosgrove <cosgroveb@gmail.com>
Sponsor	tsimonq2@debian.org
Distribution	unstable
Architecture	any
VCS	git: https://salsa.debian.org/rust-team/debcargo-conf.git [src/rmcp] (browse)
Tracker	https://tracker.debian.org/pkg/rust-rmcp
Uploaded	30 days ago

New Package Report

.changes◂

Distribution	unstable
Date	Thu, 08 Oct 2026 10:53:19 -0500
Source	rust-rmcp
Version	3.3.0-1
Changed-By	Brian Cosgrove <cosgroveb@gmail.com>
Architecture	source amd64

Changelog◂

rust-rmcp (3.3.0-1) unstable; urgency=medium
 .
   * Package rmcp 3.3.0 from crates.io using debcargo 2.8.4

.dsc◂

Priority	optional
Component	main
Package-List	librust-rmcp-dev deb rust optional arch=any
Section	rust

debian/copyright◂

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: rmcp
Source: https://github.com/modelcontextprotocol/rust-sdk/

Files: *
Copyright: 2024-2025 Model Context Protocol a Series of LF Projects, LLC
License: Apache-2.0 and Expat
Comment:
 The upstream LICENSE records a transition from MIT to Apache-2.0. New and
 consented code is Apache-2.0, while earlier contributions without consent
 remain MIT (Expat). Upstream does not identify those contributions by file.
 The copyright holder above is the explicit project notice in that LICENSE.

Files: README.md CHANGELOG.md
Copyright: 2024-2025 Model Context Protocol a Series of LF Projects, LLC
License: CC-BY-4.0
Comment:
 The rmcp-v3.3.0 upstream LICENSE covers documentation under CC-BY-4.0.
 The published crate omits that file. See the license reference below.

Files: debian/*
Copyright:
 2026 Debian Rust Maintainers <pkg-rust-maintainers@alioth-lists.debian.net>
 2026 Jelmer Vernooĳ <jelmer@debian.org>
 2026 Brian Cosgrove <cosgroveb@gmail.com>
License: Apache-2.0

License: Apache-2.0
 Debian systems provide the Apache 2.0 license in
 /usr/share/common-licenses/Apache-2.0

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: CC-BY-4.0
 Creative Commons Attribution 4.0 International
 .
 On Debian systems, the full license text is available in
 /usr/share/common-licenses/CC-BY-4.0.

DFSG Assistant LLM REVIEW 1 blocker, 0 important, 1 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 24 days ago.

Report◂

DFSG NEW review for rust-rmcp version 3.3.0-1

Summary

Licensing is DFSG-compliant and debian/copyright is accurate: No
Packaging is of good quality: Yes
Issues: 1 blocker, 0 important, 1 minor
debian/watch: version 5
debian/copyright: machine-readable

Licensing

The licences in play (Apache-2.0, Expat and CC-BY-4.0) are all DFSG-free and mutually compatible, and their texts are either included or available under /usr/share/common-licenses, so there is no non-free content. debian/copyright is not complete, however: src/model/extension.rs is a copy of the hyperium/http extensions.rs (MIT/Expat) but the http crate's copyright holder is nowhere credited - the only holder named for Files: * is the MCP project - and the Expat notice requires that the upstream copyright statement be reproduced. The Files: * licence expression "Apache-2.0 and Expat" is also a conjunction that the file's own Comment contradicts. Several licensing claims rest on the upstream LICENSE, which is not shipped in the source package and cannot be checked here.

Packaging

This is an ordinary debcargo-generated Rust library package and it is in good shape: correct Build-Depends/Build-Depends-Arch split with nocheck markers, debhelper compat 13 with dh-sequence-cargo, Architecture: any and Multi-Arch: same as other librust-*-dev packages, rustc (at least 1.88) matched by Breaks: rustc (below 1.88), DEP-3 headers on the hand-written patches, 3.0 (quilt) source format, a full autopkgtest suite and sane changelog/Vcs/upstream metadata. Nothing beyond the copyright issues above would hold up an upload.

Issues

blocker licensing 1. src/model/extension.rs is copied from hyperium/http and its copyright holder is not credited in debian/copyright ◂

Files: src/model/extension.rs:1-6, debian/copyright:5-12
Evidence: src/model/extension.rs line 3: This file is copied and modified from crate [http](https://github.com/hyperium/http).; lines 5-6: - Original code license: https://github.com/hyperium/http/blob/master/LICENSE-MIT and - Original code: https://github.com/hyperium/http/blob/master/src/extensions.rs. debian/copyright Files: * gives Copyright: 2024-2025 Model Context Protocol a Series of LF Projects, LLC and states The copyright holder above is the explicit project notice in that LICENSE.
Problem: The whole Extensions/AnyMap/IdHasher machinery in this file is a copy of the http crate's extensions.rs, which is under the MIT (Expat) licence of the http crate's authors, and the file only links to that licence rather than reproducing it. debian/copyright names a single holder for every file, so the copyright notice the Expat licence requires to be reproduced (and that Debian Policy 12.5 requires recorded in debian/copyright) is missing for this file; the Expat attribution that is present points at the wrong holder.
Fix: Add a Files: src/model/extension.rs stanza (or extend the Files: * Copyright field) naming the http crate's copyright holder as stated in the LICENSE-MIT the file points to, with License: Expat, keeping the stand-alone Expat paragraph.

minor licensing 2. Files: * uses License: Apache-2.0 and Expat, a conjunction its own Comment contradicts ◂

Files: debian/copyright:7-12
Evidence: License: Apache-2.0 and Expat with Comment: The upstream LICENSE records a transition from MIT to Apache-2.0. New and consented code is Apache-2.0, while earlier contributions without consent remain MIT (Expat).
Problem: Per copyright-format 1.0 section 7.2, and means the work must simultaneously comply with both licences, whereas the Comment says different contributions carry different licences (and upstream does not say which). The crate's own metadata declares license = "Apache-2.0" (Cargo.toml:27), so the Expat alternative has no basis in the packaged source other than the unshipped LICENSE.
Fix: Split the stanzas by actual licence - at minimum a src/model/extension.rs stanza under Expat (see above) and a catch-all stanza stating the licence the remaining files are actually under - instead of a conjunctive expression.

Verified ◂

debian/copyright is machine-readable (DEP-5) with the exact https Format line; three Files stanzas (star, README.md CHANGELOG.md, debian/*) and stand-alone License paragraphs for Apache-2.0, Expat and CC-BY-4.0; /usr/share/common-licenses/Apache-2.0 and /usr/share/common-licenses/CC-BY-4.0 both exist on the reviewing system.
Inventoried the whole tree (about 150 files) excluding .pc/ and debian/: only .rs, .json, .toml, .md, .js, .py and two .gitignore files. No images, fonts, binaries, archives, minified JavaScript or vendored copies of packaged libraries.
Grepped the tree (gitignore disabled) for Copyright, (C), the copyright sign, SPDX-License-Identifier, Licensed under, Permission is hereby granted, GNU ..., Apache License, MPL, public domain, All rights reserved, MIT, and for copied/derived/adapted/based on: the only third-party-origin notice is the hyperium/http header in src/model/extension.rs. Source files carry no per-file licence headers, which is normal for a crate whose licence is stated in Cargo.toml.
Read every file under debian/: control, changelog, rules, source/format, debcargo.toml, copyright.debcargo.hint, cargo-checksum.json, patches/series and all four patches, tests/control, upstream/metadata. debian/watch was not reviewed.
Packaging conventions: Build-Depends (debhelper-compat (= 13), dh-sequence-cargo) versus Build-Depends-Arch with nocheck markers, correct for an Architecture: any crate; dh-cargo 34 provides dh-sequence-cargo; rustc (at least 1.88) matches rust-version and the Breaks on older rustc; Multi-Arch: same as in other librust-*-dev packages; Standards-Version 4.7.4 against current Policy 4.7.4.1.
Patches: the two hand-written patches carry DEP-3 headers (Description, Author, Forwarded, Last-Update); the two auto/* patches are debcargo-generated and marked as such. Source format is 3.0 (quilt). Changelog version 3.3.0-1, distribution unstable.
No maintainer scripts, debconf templates, init scripts, systemd units, install/links/dirs files or binary package split to check.
debian/copyright.debcargo.hint is shipped beside the hand-written debian/copyright and still contains debcargo's FIXME (overlay) UNKNOWN-AUTHORS placeholders; it is not referenced by any build file.
uscan found upstream releases with debian/watch; a newer upstream version is available (upstream 3.5.1, packaged 3.3.0), which is not a fault of the package.

Not confirmed ◂

The upstream LICENSE is not in the source package (the CHANGELOG records an entry include LICENSE in final crate tarball), so the MIT-to-Apache transition and the documentation under CC-BY-4.0 claims in debian/copyright cannot be checked here; both are also at odds with the crate's own Apache-2.0 SPDX field (Cargo.toml:27).
librust-rmcp-macros-3+default-dev (and the +local variant) is in neither the package lists nor ftp-master's NEW queues; presumably a separate source package awaiting acceptance, so not reported as a fault.
Many debian/tests/control entries run --all-features, but their Depends list only the crate's dev-dependencies plus the build-dependency marker; they do not name librust-oauth2-5-dev, librust-reqwest-0.13-*, librust-hmac/sha2/zeroize or librust-tokio-stream, which the remaining auth, reqwest, request-state, client and transport-worker features pull in. Whether cargo-auto-test needs these explicitly was not verified; a build would show it.
relax-base64-dependency.patch lowers the base64 requirement from 0.23 to 0.22; whether the code compiles and passes against Debian's base64 0.22.1 was not built here.
tests/test_with_js/package.json declares an ISC licence for the test fixture, while debian/copyright covers those files by Files: * / Apache-2.0; not resolved.

Proposed changes ◂

None.

Review Information

accepted — allocated to mechtilde 23 days ago, started 23 days ago, completed 23 days ago.

Final Comment

Back to Dashboard | View all reviews for this package