fix: validate static keys at compile time

Author: DaleSeo

conformance/src/bin/server.rs

@@ -52,6 +52,10 @@ fn custom_header_tool() -> Tool {
 /// Signing key for SEP-2322 `requestState` sealing. A fixed key is fine for a
 /// conformance harness; real servers must load a secret out of clients' reach.
 const REQUEST_STATE_KEY: &[u8] = b"rust-sdk-conformance-request-state-key!!";
+const _: () = assert!(
+    REQUEST_STATE_KEY.len() >= RequestStateCodec::MIN_KEY_LENGTH,
+    "REQUEST_STATE_KEY is shorter than RequestStateCodec::MIN_KEY_LENGTH",
+);
 
 #[derive(Clone)]
 struct ConformanceServer {
@@ -70,8 +74,7 @@ impl ConformanceServer {
             subscriptions: Arc::new(Mutex::new(HashMap::new())),
             next_subscription: Arc::new(AtomicU64::new(0)),
             log_level: Arc::new(Mutex::new(LoggingLevel::Debug)),
-            request_state_codec: RequestStateCodec::try_new(REQUEST_STATE_KEY)
-                .expect("conformance request-state key meets the minimum length"),
+            request_state_codec: RequestStateCodec::new(REQUEST_STATE_KEY),
             tasks: TaskManager::new(),
         }
     }

crates/rmcp/tests/test_mrtr_behavior.rs

@@ -594,14 +594,15 @@ async fn request_state_codec_seals_and_verifies_through_the_loop() -> anyhow::Re
     use rmcp::model::RequestStateCodec;
 
     // A shared per-process signing key, mirroring how a real server would derive one.
-    static KEY: &[u8] = b"integration-signing-key-32-bytes!";
+    const KEY: &[u8] = b"integration-signing-key-32-bytes!";
+    const _: () = assert!(
+        KEY.len() >= RequestStateCodec::MIN_KEY_LENGTH,
+        "KEY is shorter than RequestStateCodec::MIN_KEY_LENGTH",
+    );
 
     fn codec() -> &'static RequestStateCodec {
         static CODEC: OnceLock<RequestStateCodec> = OnceLock::new();
-        CODEC.get_or_init(|| {
-            RequestStateCodec::try_new(KEY)
-                .expect("test request-state key meets the minimum length")
-        })
+        CODEC.get_or_init(|| RequestStateCodec::new(KEY))
     }
 
     #[derive(Clone, Default)]

examples/servers/src/mrtr.rs

@@ -40,8 +40,8 @@ use rmcp::{
 };
 use serde_json::json;
 
-/// A stable, high-entropy secret. In a real deployment, load this from your
-/// secret manager and keep it out of clients' reach. It must stay constant for
+/// A fixed key for this example. Real deployments should load at least 32 bytes
+/// of random secret key material from a secret manager and keep it stable for
 /// the lifetime of any in-flight MRTR exchange.
 const REQUEST_STATE_KEY: &[u8] = b"example-request-state-signing-key-32b!";
 
@@ -51,12 +51,11 @@ struct WeatherServer {
     codec: RequestStateCodec,
 }
 
-impl Default for WeatherServer {
-    fn default() -> Self {
-        Self {
-            codec: RequestStateCodec::try_new(REQUEST_STATE_KEY)
-                .expect("example request-state key meets the minimum length"),
-        }
+impl WeatherServer {
+    fn new(key: impl Into<Vec<u8>>) -> Result<Self, RequestStateError> {
+        Ok(Self {
+            codec: RequestStateCodec::try_new(key)?,
+        })
     }
 }
 
@@ -153,18 +152,19 @@ impl ClientHandler for InteractiveClient {
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
     let (server_transport, client_transport) = tokio::io::duplex(8192);
+    let server = WeatherServer::new(REQUEST_STATE_KEY)?;
 
     // Spin up the server side.
     tokio::spawn(async move {
-        let server = WeatherServer::default()
+        let server = server
             .serve(server_transport)
             .await
             .expect("server should start");
         let _ = server.waiting().await;
     });
 
     // Connect the client (this performs the initialize handshake).
-    let client = InteractiveClient::default().serve(client_transport).await?;
+    let client = InteractiveClient.serve(client_transport).await?;
 
     // 1. High-level auto mode: the SDK fulfils the elicitation and retries for us.
     println!("== auto mode (call_tool) ==");