cratesio-mcp

MCP server for querying crates.io, the Rust package registry. Built with tower-mcp.

Gives your AI agent crate search, documentation, dependency analysis, download stats, and security auditing to make informed decisions about Rust dependencies.

Under the hood it is also a standalone, dependency-light crates.io API client library that the MCP tools are built on and that you can use directly: ~46 endpoints with full read and write coverage, no `crates_io_api` dependency. See Built-in crates.io client.

Quick start

Hosted (no install)

A public instance is running at https://cratesio-mcp.fly.dev/. Add to your MCP client config:

{
  "mcpServers": {
    "cratesio-mcp": {
      "type": "http",
      "url": "https://cratesio-mcp.fly.dev/"
    }
  }
}

Install from crates.io

cargo install cratesio-mcp

Build from source

git clone https://github.com/joshrotenberg/cratesio-mcp
cd cratesio-mcp
cargo install --path .

Docker

docker run -p 3000:3000 ghcr.io/joshrotenberg/cratesio-mcp:latest

MCP client configuration

Claude Code (stdio)

{
  "mcpServers": {
    "cratesio-mcp": {
      "command": "cratesio-mcp"
    }
  }
}

Claude Code (HTTP, local or remote)

{
  "mcpServers": {
    "cratesio-mcp": {
      "type": "http",
      "url": "http://localhost:3000/"
    }
  }
}

Claude Desktop

Add to `claude_desktop_config.json`:

{
  "mcpServers": {
    "cratesio-mcp": {
      "command": "cratesio-mcp"
    }
  }
}

What's included

Tools (29)

Every successful tool call returns both the existing human-readable Markdown in

`content` and typed JSON in `structuredContent`. Each tool advertises the

matching JSON Schema 2020-12 contract through `outputSchema` during discovery.

Resources (3)

Prompts (6)

Transports

• stdio (default): for Claude Desktop, Claude Code, and other MCP clients
• Streamable HTTP: sessionless MCP 2026-07-28 transport,

while retaining compatibility with session-based MCP 2025-11-25 clients

# stdio (default)
cratesio-mcp

# HTTP
cratesio-mcp --transport http --port 3000

The HTTP transport includes a tower middleware stack: timeout, rate limiting, bulkhead concurrency control, optional response caching, and structured tracing.

The 2026-07-28 path supports `server/discover`, stateless requests, standardized

MCP routing headers, and cache hints. Tool discovery marks every crates.io tool

as read-only, non-destructive, and idempotent; resource reads advertise cache

lifetimes appropriate to their data source.

Built-in crates.io client

`cratesio-mcp` is built on its own typed async crates.io API client, with no `crates_io_api` dependency. You can use it directly as a library:

• ~46 endpoints across crates, versions, owners, categories, keywords, users, teams, API tokens, publishing, and trusted publishing.
• Full read and write coverage: search and metadata, plus authenticated operations (publish, yank/unyank, add/remove owners, manage API tokens, configure trusted publishing) via `.with_auth(token)`.
• Resilient by default: built-in rate limiting (respects the crates.io crawling policy) and retry with exponential backoff on transient failures (429 / 5xx).
• Documented and tested: every public method has doc comments, with a wiremock test suite covering the endpoints (including the authenticated write paths).

use std::time::Duration;
use cratesio_mcp::client::{CratesIoClient, CratesQuery, Sort};

let client = CratesIoClient::new("my-app", Duration::from_secs(1))?;

// Search for crates
let query = CratesQuery::builder()
    .search("tower")
    .sort(Sort::Downloads)
    .build();
let results = client.crates(query).await?;

// Get crate details
let info = client.get_crate("tower-mcp").await?;

The OSV.dev vulnerability client (`audit_dependencies`) and the docs.rs rustdoc-JSON client (`get_crate_docs` / `get_doc_item` / `search_docs`) ship alongside it.

License

MIT OR Apache-2.0