Cargo workspace layout

Audit performed 2026-05-16 against the acceptance criteria. This page is the canonical reference for which crates exist, what they own, and where the public/private boundary runs.

Crates

Crate	Path	Role	Public?
`mcptest`	`crates/mcptest/`	The CLI binary plus a thin library wrapper so integration tests can exercise the parser without spawning a subprocess.	Published. The `mcptest` binary is the user-facing artifact.
`mcptest-core`	`crates/mcptest-core/`	Matchers, MCP protocol client, transports, runner, cache eligibility, coverage, reporters, lint, redaction, cassette, compliance. Transport-free except the upload reporter.	Published as a library. Used directly by the CLI and (later) by SDK FFI hosts.
`mcptest-config`	`crates/mcptest-config/`	YAML loader with JSON Schema validation, `.env` parser, variable resolution, `${VAR}` interpolation.	Published as a library. The runner and the CLI both depend on it; SDK hosts will too.

The OSS PRD also mentions mcptest-cassette and mcptest-report. Both shipped inside mcptest-core for now (see cassette and report modules). Splitting them into their own crates is deferred until the record/replay file format ships, tracked.

Dependency graph

mcptest (bin + lib)
  -> mcptest-core
  -> mcptest-config
       -> (no internal deps)
mcptest-core
  -> (no internal deps)

The flow is intentionally one-way: core has no knowledge of config, and config has no knowledge of core. The CLI is the only place that wires both together. This keeps the FFI surface narrow (an SDK host loads one crate, not three) and lets cargo test -p mcptest-core run without dragging in YAML parsing.

Shared workspace dependencies

[workspace.dependencies] in the top-level Cargo.toml declares the single source of truth for every shared crate version:

Runtime: tokio, tracing, tracing-subscriber
CLI: clap, clap_complete, shell-words
Errors: thiserror, anyhow
Serde stack: serde, serde_json, serde_yaml
HTTP: reqwest (rustls), url
Schema: jsonschema
Config / files: dotenvy, dirs, fs2, notify
Crypto helpers: sha2
Regex: regex
Tokens: tiktoken-rs
Streaming: bytes, futures-util
Test helpers: assert_cmd, predicates, tempfile, pretty_assertions, wiremock, proptest, insta, quick-xml

Workspace members reference these with dep = { workspace = true } so a bump happens in exactly one place.

MSRV

The minimum supported Rust version is pinned in two places that must stay in lockstep:

rust-toolchain.toml selects the stable channel for local development and CI.
[workspace.package] in Cargo.toml sets rust-version = "1.85", the floor for downstream consumers using a different toolchain.

Verification

The acceptance criteria are met as follows:

Workspace members include mcptest-core, mcptest-config, and the mcptest binary crate. Verified in the top-level Cargo.toml.
[workspace.dependencies] block covers every shared dependency. Verified above.
MSRV is declared (rust-version = "1.85") and the toolchain channel is pinned (rust-toolchain.toml).
cargo build --workspace succeeds. Verified 2026-05-16.
cargo test --workspace succeeds. Verified 2026-05-16.
Per-crate READMEs exist at crates/mcptest/README.md, crates/mcptest-core/README.md, and crates/mcptest-config/README.md.
The top-level README.md is the user-facing entry point.

Outstanding items

Splitting cassette and report modules into their own crates is and is deferred until the cassette file format is stable.
DEVOPS owns Cargo.toml edits in this batch, so any workspace-level dependency tweaks discovered after this audit are filed there rather than applied here.