Upgrade rmcp to 3.2 and drop the audit suppression

[cleak]

Why

RUSTSEC-2026-0189 is DNS rebinding in rmcp's Streamable HTTP server transport. It never applied here — the workspace enables only transport-io and tempyr-mcp serves over rmcp::transport::stdio — and that reasoning was recorded in .cargo/audit.toml rather than carried silently. Moving off the affected version retires the entry outright: cargo audit now passes with no ignore list, and the file is deleted.

Why not 1.8

I tried the minimum bump first and it is not shippable. Under rmcp 1.8, a server→client roots/list round trip leaves two readers on the process stdin, which split single JSON-RPC lines between them. From strace -f -e trace=read,write on a failing run:

1544081 read(0, "{\"jsonrpc\":\"2.0\",", 8192) = 17
1544081 read(0, "\"method\":", 8192)          = 9
1544082 read(0, "\":\"", 8192)                = 3
        write(1, "{\"jsonrpc\":\"2.0\",\"error\":{\"code\":-32700,\"message\":\"Parse error\"}}")

test_mcp_relative_project_root_arg_uses_client_roots_when_server_cwd_is_wrong failed ~40% of runs on 1.8 versus 0/20 on 1.3.

Things I ruled out along the way, so nobody repeats them: the test harness discarding buffered bytes via BufReader::into_inner() (still failed with a 1-byte buffer); client write timing (a 250 ms delay made it worse); fragmented writes (reproduced cleanly outside the harness, 6/6 pass); and the call site itself — relocating the request into ServerHandler::on_initialized made it worse, which is what showed the extra reader is not something this repository creates.

3.2 fixes it. 0/25 on that test, with the original call site left exactly as it was — so this PR does not touch lib.rs at all.

API changes that came with it

• peer_info() returns owned data, so the capability test can no longer borrow out of the closure (is_some_and).
• #[tool_handler] now defaults its router to the static Self::tool_router(), which would leave the instance field unread under -D warnings. Named explicitly as #[tool_handler(router = self.tool_router)] to keep the pre-upgrade behaviour.
• Roots is deprecated by SEP-2577 and rmcp marks list_roots, ListRootsResult::roots, and Root::uri accordingly. The allow sits on the whole function with the reasoning: the replacement is unsettled, and the capability check already prevents sending to a client that does not advertise it. When SEP-2577 lands a replacement this is the one place to revisit.

Verification

cargo fmt --check                                       PASS
cargo clippy --workspace --all-targets -- -D warnings   PASS
cargo test --workspace --locked   x4                    0/4 runs with failures
cargo audit --file Cargo.lock  (no ignore list)         PASS
roots test, 25 consecutive runs                         0 failures

Diff is 4 files: Cargo.toml, Cargo.lock, 11 lines of handler.rs, and the deleted suppression.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EwBDuaQS537MdX3GUtmhqj

Summary by CodeRabbit

• Maintenance
  • Updated internal protocol integration to maintain compatibility with the latest tooling.
  • Improved handling of optional capabilities and tool routing.
  • No user-facing feature or behavior changes are included in this update.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Essentials

Run ID: f74e48f0-fdaf-437a-820c-9cee8649a771

📥 Commits

Reviewing files that changed from the base of the PR and between ff8c953 and ea81a71.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• .cargo/audit.toml
• Cargo.toml
• crates/tempyr-mcp/src/handler.rs

💤 Files with no reviewable changes (1)

• .cargo/audit.toml

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The workspace upgrades RMCP from 1.3 to 3.2. The MCP handler updates deprecated Roots API usage, simplifies capability detection, and explicitly binds the tool router.

Changes

RMCP upgrade

Layer / File(s)	Summary
Dependency and handler compatibility Cargo.toml, crates/tempyr-mcp/src/handler.rs	The workspace upgrades RMCP to version 3.2. The handler allows the deprecated Roots API, uses is_some_and for capability detection, and binds the generated tool handler to self.tool_router.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to ea81a

This updates RMCP and its handler integration while retaining Roots capability behavior and explicit tool routing. No current merge-blocking risk remains.

Poem

I’m a rabbit with ears held high
RMCP hops to version three
Roots still guide the moonlit path
Tools find their router tree
Small changes make the burrow bright

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies both primary changes: upgrading rmcp to 3.2 and removing the audit suppression.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/rmcp-upgrade

---

_{Comment @coderabbitai help to get the list of available commands.}