iap-https-rust

A multi-language Model Context Protocol (MCP) server workspace providing system utility tools. Every variant exposes the same family of tools but differs in language (Rust, Go, Python), transport (Streamable HTTP, SSE, Stdio), and security model (IAP, API key, bearer ID token, none). The comparison is the point: the same server, implemented three ways and secured five ways.

Each variant is a self-contained project with its own manifest, Makefile, and README — there is no shared library, and the duplication between variants is intentional.

Project Structure

Rust variants (rmcp)

Directory	Transport	Security	Notes
iap/	Streamable HTTP	IAP	Cloud Run; decodes x-goog-iap-jwt-assertion
manual/	Streamable HTTP	IAP + API key	Key fetched via ADC or gcloud
local/	Streamable HTTP	API key	Local dev; gcloud key fetching
stdio/	Stdio	none	Lightweight local server — on rmcp 3.x
stdiokey/	Stdio	API key	--key flag or MCP_API_KEY
bearer-rust/	Streamable HTTP	IAP / bearer ID token	Cloud Run via gcloud auth print-identity-token
proxy-rust/	Streamable HTTP	IAP header decode	Reached through gcloud run services proxy

Go variants (mcp-go)

Directory	Transport	Security
stdio-go/	Stdio	none
stdiokey-go/	Stdio	API key
manual-go/	HTTP	IAP + API key
bearer-go/	HTTP	bearer ID token
proxy-go/	HTTP	via Cloud Run proxy

Python variants (mcp / Starlette)

Directory	Transport	Security
local-python/	SSE	API key
manual-python/	SSE	API key
stdiokey-python/	Stdio	API key
bearer-python/	SSE	bearer ID token
proxy-python/	SSE	via Cloud Run proxy

local-rust, manual-rust, stdio-rust, and stdiokey-rust are symlinks to local, manual, stdio, and stdiokey. Edit the real directories.

Tools Provided

• System information — host report covering OS, CPU, memory, network interfaces and MAC addresses. Exposed as local_system_info, iap_system_info, or sysutils_<variant> depending on the variant.
• Disk usage (disk_usage) — usage for all mounted partitions.
• Process list (list_processes) — top 20 processes by memory; present in the manual, bearer-*, and proxy-* variants.

Getting Started

Prerequisites

• Rust — toolchain with edition 2024 support
• Go — 1.26+
• Python — 3.11+
• Make
• gcloud — for the API-key, IAP, and Cloud Run variants

Google Cloud setup

./init.sh # writes ~/project_id.txt, enables APIs, configures ADCsource ./set_env.sh # exports PROJECT_ID, REGION, ID_TOKEN, RUST_LOG, ...

set_env.sh must be sourced, not executed. set_key.sh and set_adc.sh help with API key and ADC credential setup. API-key variants look up a key named "MCP API Key" in the project; MCP_API_KEY overrides the lookup.

Quick start — Rust Stdio

cd stdio
make release
make run

Quick start — Rust HTTP with API key

cd manual
make build
# configure ADC, or set MCP_API_KEY
make run

Quick start — Python

cd local-python
make install
make run KEY=<YOUR_API_KEY>

Quick start — Go

cd stdio-go
make build
make run

CLI Usage (direct reports)

Most variants run a one-shot report without starting a server:

make info # system information
make disk # disk usage

Or directly: cargo run -- info, go run . disk, python3 main.py info.

Using a Stdio variant with an MCP client

The stdio variants register cleanly as local MCP servers. Build a release binary and point your client's .mcp.json at it:

cd stdio
make release
claude # approve the project-scoped server once, then check with /mcp

.mcp.json files are gitignored — each developer creates their own.

Development

Each variant directory shares the same Makefile vocabulary:

Target	Purpose
make build / make install	Build (Rust, Go) or install dependencies (Python)
make test	Run tests
make fmt	Check formatting — fails on unformatted code, does not rewrite
make clippy / make lint	Lint
make release	Optimized build
make run	Start the server
make deploy	gcloud builds submit → Cloud Run (HTTP variants)

The root Makefile fans build, test, fmt, clippy, and check out across iap manual local stdio stdiokey local-python manual-python stdiokey-python only — the Go, bearer-*, and proxy-* variants build and test from their own directories.

Environment Variables

Variable	Purpose	Default
PORT	Port for HTTP/SSE servers	8080
MCP_API_KEY	Overrides API key lookup	—
MCP_BEARER_TOKEN	Bearer ID token for the bearer-* variants (set by startbearer-*.sh)	—
MCP_TRANSPORT	Transport selector for the Python variants (sse)	per-variant
GOOGLE_CLOUD_PROJECT	Project used for API key fetching	from gcloud
RUST_LOG	Rust log level	per-variant

Repository Layout

• docs/ — long-form article drafts on MCP development with Rust, Claude Code, and Gemini CLI, including the rmcp 3.x upgrade notes.
• images/ — article artwork.
• CLAUDE.md, AGENTS.md, GEMINI.md — guides for Claude Code, Codex-style agents, and Gemini CLI respectively. Per-variant GEMINI.md files add variant-specific detail.

Security

.mcp.json (at any depth), .env, and *.key are gitignored. .mcp.json may carry an injected API key — never commit one.

License

MIT