Secure MCP Development with Rust and Gemini CLI

--- title: Secure MCP Development with Rust and Gemini CLI published: true series: MCP-Security date: 2026-02-08 23:49:08 UTC tags: geminicli,mcps,googlecloud,apikey canonical_url: https://xbill999.medium.com/secure-mcp-development-with-rust-and-gemini-cli-7790a59cafa2 --- Leveraging Gemini CLI and the underlying Gemini LLM to build Model Context Protocol (MCP) AI applications in the Rust programming language with a local development environment.  #### Why not just use Python? Python has traditionally been the main coding language for ML and AI tools. One of the strengths of the MCP protocol is that the actual implementation details are independent of the development language. The reality is that not every project is coded in Python- and MCP allows you to use the latest AI appt roaches with other coding languages. #### What is this Tutorial Trying to Do? Building on previous tutorials, the goal is to extend a Rust MCP server with basic support for API key ennablement. The ultimate goal is allowing MCP servers to be deployed as unauthenticated Cloud Run endpoints but be protected by an API key. #### What is Rust? Rust is a high performance, memory safe, compiled language: [Rust](https://www.rust-lang.org/) Rust provides memory safe operations beyond C/C++ and also can provide exceptional performance gains as it is compiled directly to native binaries. #### Initial Environment Setup The environment is meant to be run from a Bash like shell. You can run this from a Linux VM, ChromeOS Linux VM, Firebase Studio environment, or any environment that provides a basic shell. You will also need a working Docker environment. #### Rust Setup Instructions to install Rust are available here: [Getting started](https://www.rust-lang.org/learn/get-started) For a Linux like environment the command looks like this: ``` curl — proto ‘=https’ — tlsv1.2 -sSf https://sh.rustup.rs | sh ``` Rust also depends on a working C compiler and OpenSSL setup. For a Debian 12 system — install the basic tools for development: ``` sudo apt install build-essential sudo apt install libssl-dev sudo apt install pkg-config sudo apt-get install libudev-dev sudo apt install make sudo apt install git ``` #### Gemini CLI If not pre-installed you can download the Gemini CLI to interact with the source files and provide real-time assistance: ``` sudo npm install -g @google/gemini-cli ``` Note- if you are an a non standard environment — you will need to make sure to have at least Node version 20 available in order to run Gemini CLI. #### Testing the Gemini CLI Environment Once you have all the tools and the correct Node.js version in place- you can test the startup of Gemini CLI. You will need to authenticate with a Key or your Google Account: ``` gemini ```  #### Getting Started with Rust and MCP When MCP was first released, there were several competing Rust frameworks that provided support for the protocol. Eventually, one official supported SDK was consolidated to provide a standard package for building MCP applications with Rust. This SDK is more like a toolbox that provides many options- clients/servers, different transports, and even more advanced integration options. The official MCP Rust SDK (rmcp) is available here: [GitHub - modelcontextprotocol/rust-sdk: The official Rust SDK for the Model Context Protocol](https://github.com/modelcontextprotocol/rust-sdk) #### Where do I start? The strategy for validating Rust for MCP development is a incremental step by step approach. First, the basic development environment is setup with the required system variables and a working Gemini CLI configuration. A command line version of the System Information tool is built with Gemini CLI. Then, a minimal Rust MCP Server is built with the stdio transport working directly with Gemini CLI in the local environment. This validates the connection from Gemini CLI to the local compiled Rust process via MCP. The MCP client (Gemini CLI) and the Rust MCP compiled binary Server both run in the same environment. #### Setup the Basic Environment At this point you should have a working Rust compiler and a working Gemini CLI installation. The next step is to clone the GitHub samples repository with support scripts: ``` cd ~ git clone https://github.com/xbill9/iap-https-rust ``` Then run **init.sh** from the cloned directory. The script will attempt to determine your shell environment and set the correct variables: ``` cd iap-https-rust source init.sh ``` If your session times out or you need to re-authenticate- you can run the **set\_env.sh** script to reset your environment variables: ``` cd iap-https-rust source set_env.sh ``` Variables like PROJECT\_ID need to be setup for use in the various build scripts- so the set\_env script can be used to reset the environment if you time-out. #### Minimal System Information Tool Build The first step is to build the basic tool directly with Rust. This allows the tool to be debugged and tested locally before adding the MCP layer. All of the sample code is in the stdiokey directory-which is shorthand for stdio MCP server with an API key: ``` xbill@penguin:~/iap-https-rust/stdiokey$ ``` First build the tool locally: ``` xbill@penguin:~/iap-https-rust/stdiokey$ make Building the Rust project... Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.16s xbill@penguin:~/iap-https-rust/stdiokey$ ``` then lint check the code: ``` xbill@penguin:~/iap-https-rust/stdiokey$ make lint Linting code... Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.15s xbill@penguin:~/iap-https-rust/stdiokey$ ``` and run local tests: ``` xbill@penguin:~/iap-https-rust/stdiokey$ make test Running tests... Compiling sysutils-stdiokey-rust v0.2.0 (/home/xbill/iap-https-rust/stdiokey) Finished `test` profile [unoptimized + debuginfo] target(s) in 1.56s Running unittests src/main.rs (target/debug/deps/sysutils_stdiokey_rust-e1e853f069b7cd67) running 3 tests test tests::test_schema_generation ... ok test tests::test_disk_usage ... ok test tests::test_local_system_info ... ok test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s xbill@penguin:~/iap-https-rust/stdiokey$ ``` The last step is to build the production version: ``` xbill@penguin:~/iap-https-rust/stdiokey$ make release Building Release... Finished `release` profile [optimized] target(s) in 0.15s xbill@penguin:~/iap-https-rust/stdiokey$ ``` #### Running the Tool Locally Once the release version has been built- the resulting binary can be executed directly in the local environment. The quick summary of local system info can be run right from the Makefile: ``` xbill@penguin:~/iap-https-rust/stdiokey$ make info {"timestamp":"2026-02-08T22:31:20.660215Z","level":"ERROR","fields":{"message":"Application failed","error":"Authentication Required: Please provide the API Key using --key <KEY> or MCP_API_KEY environment variable"},"target":"sysutils_stdiokey_rust"} make: *** [Makefile:26: info] Error 1 xbill@penguin:~/iap-https-rust/stdiokey$ ``` This call failed because no API key was provided on the command line or in the current environment. The tool will also fail if an invalid key is passed: ``` xbill@penguin:~/iap-https-rust/stdiokey$ export MCP_API_KEY=1234567890 xbill@penguin:~/iap-https-rust/stdiokey$ make info {"timestamp":"2026-02-08T22:34:04.966794Z","level":"INFO","fields":{"message":"Fetching MCP API Key for project: 1056842563084"},"target":"sysutils_stdiokey_rust"} {"timestamp":"2026-02-08T22:34:05.029982Z","level":"ERROR","fields":{"message":"Application failed","error":"Failed to fetch MCP API Key\n\nCaused by:\n 0: Failed to list API keys\n 1: Token retrieval failed: Connection failure: Hyper error: client error (Connect)\n "},"target":"sysutils_stdiokey_rust"} make: *** [Makefile:26: info] Error 1 xbill@penguin:~/iap-https-rust/stdiokey$ ``` #### Setting an API Key On project setup the **init.sh** script configures the Google Cloud environment and creates a sample key to secure the connection. To set this key in the current environment — use the **set\_key.sh** script: ``` xbill@penguin:~/iap-https-rust/stdiokey$ source ../set_key.sh --- Setting Google Cloud Project ID --- Using Google Cloud project: comglitn Checking for existing MCP API Key... Using existing MCP API Key: projects/1056842563084/locations/global/keys/cbd6422f-e594-4536-9ad9-6f179f43f11b Retrieving API Key string... MCP API Key retrieved and exported. To use with the 'manual' or 'local' variants, ensure this script was sourced: source ./set_key.sh cargo run --bin manual --- Environment Checks --- Not running in Google Cloud VM or Shell. Checking ADC... Running on ChromeOS. --- Initial Setup complete --- xbill@penguin:~/iap-https-rust/stdiokey$ ``` The tool can now execute: ``` xbill@penguin:~/iap-https-rust/stdiokey$ cargo run info Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.07s Running `target/debug/sysutils-stdiokey-rust info` {"timestamp":"2026-02-08T23:07:46.935357Z","level":"INFO","fields":{"message":"Fetching MCP API Key for project: 1056842563084"},"target":"sysutils_stdiokey_rust"} {"timestamp":"2026-02-08T23:07:49.712041Z","level":"INFO","fields":{"message":"Successfully fetched API key via gcloud"},"target":"sysutils_stdiokey_rust"} System Information Report ========================= MCP API Key Status ------------------ Provided Key: [FOUND] Cloud Match: [MATCHED] System Information ------------------ System Name: Debian GNU/Linux Kernel Version: 6.6.99-09121-g16665fbb817c OS Version: 12 Host Name: penguin CPU Information --------------- Number of Cores: 16 Memory Information ------------------ Total Memory: 6364 MB Used Memory: 297 MB Total Swap: 0 MB Used Swap: 0 MB Network Interfaces ------------------ lo : RX: 3897 bytes, TX: 3897 bytes (MAC: 00:00:00:00:00:00) veth7ac2607 : RX: 126 bytes, TX: 1868 bytes (MAC: 7e:ab:4b:a7:6a:bf) veth6af42f9 : RX: 126 bytes, TX: 1868 bytes (MAC: 1a:05:e1:da:02:b3) br-e70a18428e21 : RX: 168 bytes, TX: 746 bytes (MAC: 2e:76:46:de:e4:6c) eth0 : RX: 5884193 bytes, TX: 42076984 bytes (MAC: 00:16:3e:07:39:7b) docker0 : RX: 0 bytes, TX: 0 bytes (MAC: 2a:e4:d7:54:a8:de) xbill@penguin:~/iap-https-rust/stdiokey$ ``` #### System Information with MCP STDIO Transport One of the key features that the Rust rmcp SDK provides is abstracting various transport methods. The high level tool MCP implementation is the same no matter what low level transport channel/method that the MCP Client uses to connect to a MCP Server. The simplest transport that the SDK supports is the stdio (stdio/stdout) transport — which connects a locally running process. Both the MCP client and MCP Server must be running in the same environment. First- switch the directory with the Rust stdio sample code: ``` xbill@penguin:~/iap-https-rust/stdiokey$ make release Building Release... Finished `release` profile [optimized] target(s) in 0.18s xbill@penguin:~/iap-https-rust/stdiokey$ ``` You can validate the final result of the build by checking the compiled Rust binary: ``` xbill@penguin:~/iap-https-rust/stdiokey/target/release$ file sysutils-stdiokey-rust sysutils-stdiokey-rust: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a9f3e7464e5ff32b4fbe55cc7659cb1c7835eaf9, stripped xbill@penguin:~/iap-https-rust/stdiokey/target/release$ ``` #### Connecting Gemini CLI to the MCP STDIO Server To configure Gemini CLI as the MCP client- a sample **settings.json** is provided in the .gemini config directory: ``` { "mcpServers": { "sysutils-stdiokey-rust": { "command": "$HOME/iap-https-rust/stdiokey/target/release/sysutils-stdiokey-rust", "args": ["--prebuilt","--stdio"], "env": { "RUST_LOG": "trace", "MCP_API_KEY": "xxx" } } } } ``` This sample Gemini CLI config will fail- as the MCP\_API\_KEY is hard coded to xxx: ``` ✕ Error during discovery for MCP server 'sysutils-stdiokey-rust': MCP error -32000: Connection closed > /mcp list Configured MCP servers: 🔴 sysutils-stdiokey-rust - Disconnected ``` #### Pass the API Key in Gemini Settings The stdio server checks the API key if it is provided. The **set\_key.sh** scripts sets the environment variable from the Google Cloud settings. A sample Gemini setup is provided for this scenario as well: ``` { "mcpServers": { "sysutils-stdiokey-rust": { "command": "$HOME/iap-https-rust/stdiokey/target/release/sysutils-stdiokey-rust", "args": ["--prebuilt","--stdio"], "env": { "RUST_LOG": "trace", "MCP_API_KEY": "$MCP_API_KEY" } } } } ``` Next Gemini CLI is used to check the MCP connection settings: ``` > /mcp list Configured MCP servers: 🟢 sysutils-stdio-rust - Ready (2 tools) Tools: - disk_usage - local_system_info ``` The local MCP Server (sysutils-stdiokey-rust) can now be used directly using Gemini CLI as a MCP client. This is the same Rust binary that was tested locally as a standalone build: ``` > run mcp tool local_system_info ✦ I will retrieve the system information using the local_system_info tool. ╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │ ✓ local_system_info (sysutils-stdiokey-rust MCP Server) {} │ │ │ │ System Information Report │ │ ========================= │ │ │ │ Authentication: [VERIFIED] (Running as MCP Server) │ │ │ │ System Information │ │ --- │ │ System Name: Debian GNU/Linux │ │ Kernel Version: 6.6.99-09121-g16665fbb817c │ │ OS Version: 12 │ │ Host Name: penguin │ │ │ │ CPU Information │ │ --- │ │ Number of Cores: 16 │ │ │ │ Memory Information │ │ --- │ │ Total Memory: 6364 MB │ │ Used Memory: 678 MB │ │ Total Swap: 0 MB │ │ Used Swap: 0 MB │ │ │ │ Network Interfaces │ │ --- │ │ veth7ac2607 : RX: 126 bytes, TX: 1938 bytes (MAC: 7e:ab:4b:a7:6a:bf) │ │ br-e70a18428e21 : RX: 168 bytes, TX: 746 bytes (MAC: 2e:76:46:de:e4:6c) │ │ eth0 : RX: 6840392 bytes, TX: 44354526 bytes (MAC: 00:16:3e:07:39:7b) │ │ veth6af42f9 : RX: 126 bytes, TX: 1868 bytes (MAC: 1a:05:e1:da:02:b3) │ │ docker0 : RX: 0 bytes, TX: 0 bytes (MAC: 2a:e4:d7:54:a8:de) │ │ lo : RX: 3897 bytes, TX: 3897 bytes (MAC: 00:00:00:00:00:00) │ │ │ ╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ ✦ The system information has been retrieved and is displayed above. What would you like to do next? ``` #### Project Package Details The stdiokey project has been published to crates.io: [crates.io: Rust Package Registry](https://crates.io/crates/sysutils-stdiokey-rust)  #### Summary The potential for using Rust for MCP development with Gemini CLI was validated with a incremental step by step approach. A minimal stdio transport MCP Server was built from Rust source code and validated with Gemini CLI running as a MCP client in the same local environment. This approach can be extended to more complex deployments using other MCP transports and Cloud based options.