Secure MCP Development with Rust and Gemini CLI

Leveraging Gemini CLI and the underlying Gemini LLM to build Model Context Protocol (MCP) AI...

title: Secure MCP Development with Rust and Gemini CLI published: true series: MCP-Security date: 2026-02-08 23:49:08 UTC tags: geminicli,mcps,googlecloud,apikey canonical_url: https://xbill999.medium.com/secure-mcp-development-with-rust-and-gemini-cli-7790a59cafa2

Leveraging Gemini CLI and the underlying Gemini LLM to build Model Context Protocol (MCP) AI applications in the Rust programming language with a local development environment.

Why not just use Python?

Python has traditionally been the main coding language for ML and AI tools. One of the strengths of the MCP protocol is that the actual implementation details are independent of the development language. The reality is that not every project is coded in Python- and MCP allows you to use the latest AI appt roaches with other coding languages.

What is this Tutorial Trying to Do?

Building on previous tutorials, the goal is to extend a Rust MCP server with basic support for API key ennablement. The ultimate goal is allowing MCP servers to be deployed as unauthenticated Cloud Run endpoints but be protected by an API key.

What is Rust?

Rust is a high performance, memory safe, compiled language:

Rust

Rust provides memory safe operations beyond C/C++ and also can provide exceptional performance gains as it is compiled directly to native binaries.

Initial Environment Setup

The environment is meant to be run from a Bash like shell. You can run this from a Linux VM, ChromeOS Linux VM, Firebase Studio environment, or any environment that provides a basic shell. You will also need a working Docker environment.

Rust Setup

Instructions to install Rust are available here:

Getting started

For a Linux like environment the command looks like this:

curl — proto ‘=https’ — tlsv1.2 -sSf https://sh.rustup.rs | sh

Rust also depends on a working C compiler and OpenSSL setup. For a Debian 12 system — install the basic tools for development:

sudo apt install build-essential
sudo apt install libssl-dev
sudo apt install pkg-config
sudo apt-get install libudev-dev
sudo apt install make
sudo apt install git

Gemini CLI

If not pre-installed you can download the Gemini CLI to interact with the source files and provide real-time assistance:

sudo npm install -g @google/gemini-cli

Note- if you are an a non standard environment — you will need to make sure to have at least Node version 20 available in order to run Gemini CLI.

Testing the Gemini CLI Environment

Once you have all the tools and the correct Node.js version in place- you can test the startup of Gemini CLI. You will need to authenticate with a Key or your Google Account:

gemini

Getting Started with Rust and MCP

When MCP was first released, there were several competing Rust frameworks that provided support for the protocol. Eventually, one official supported SDK was consolidated to provide a standard package for building MCP applications with Rust. This SDK is more like a toolbox that provides many options- clients/servers, different transports, and even more advanced integration options.

The official MCP Rust SDK (rmcp) is available here:

GitHub - modelcontextprotocol/rust-sdk: The official Rust SDK for the Model Context Protocol

Where do I start?

The strategy for validating Rust for MCP development is a incremental step by step approach.

First, the basic development environment is setup with the required system variables and a working Gemini CLI configuration.

A command line version of the System Information tool is built with Gemini CLI.

Then, a minimal Rust MCP Server is built with the stdio transport working directly with Gemini CLI in the local environment. This validates the connection from Gemini CLI to the local compiled Rust process via MCP. The MCP client (Gemini CLI) and the Rust MCP compiled binary Server both run in the same environment.

Setup the Basic Environment

At this point you should have a working Rust compiler and a working Gemini CLI installation. The next step is to clone the GitHub samples repository with support scripts:

cd ~
git clone https://github.com/xbill9/iap-https-rust

Then run init.sh from the cloned directory.

The script will attempt to determine your shell environment and set the correct variables:

cd iap-https-rust
source init.sh

If your session times out or you need to re-authenticate- you can run the set_env.sh script to reset your environment variables:

cd iap-https-rust
source set_env.sh

Variables like PROJECT_ID need to be setup for use in the various build scripts- so the set_env script can be used to reset the environment if you time-out.

Minimal System Information Tool Build

The first step is to build the basic tool directly with Rust. This allows the tool to be debugged and tested locally before adding the MCP layer.

All of the sample code is in the stdiokey directory-which is shorthand for stdio MCP server with an API key:

xbill@penguin:~/iap-https-rust/stdiokey$

First build the tool locally:

xbill@penguin:~/iap-https-rust/stdiokey$ make
Building the Rust project...
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.16s
xbill@penguin:~/iap-https-rust/stdiokey$ 

then lint check the code:

xbill@penguin:~/iap-https-rust/stdiokey$ make lint
Linting code...
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.15s
xbill@penguin:~/iap-https-rust/stdiokey$ 

and run local tests:

xbill@penguin:~/iap-https-rust/stdiokey$ make test
Running tests...
   Compiling sysutils-stdiokey-rust v0.2.0 (/home/xbill/iap-https-rust/stdiokey)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 1.56s
     Running unittests src/main.rs (target/debug/deps/sysutils_stdiokey_rust-e1e853f069b7cd67)

running 3 tests
test tests::test_schema_generation ... ok
test tests::test_disk_usage ... ok
test tests::test_local_system_info ... ok

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s

xbill@penguin:~/iap-https-rust/stdiokey$ 

The last step is to build the production version:

xbill@penguin:~/iap-https-rust/stdiokey$ make release
Building Release...
    Finished `release` profile [optimized] target(s) in 0.15s
xbill@penguin:~/iap-https-rust/stdiokey$ 

Running the Tool Locally

Once the release version has been built- the resulting binary can be executed directly in the local environment.

The quick summary of local system info can be run right from the Makefile:

xbill@penguin:~/iap-https-rust/stdiokey$ make info
{"timestamp":"2026-02-08T22:31:20.660215Z","level":"ERROR","fields":{"message":"Application failed","error":"Authentication Required: Please provide the API Key using --key <KEY> or MCP_API_KEY environment variable"},"target":"sysutils_stdiokey_rust"}
make: *** [Makefile:26: info] Error 1
xbill@penguin:~/iap-https-rust/stdiokey$ 

This call failed because no API key was provided on the command line or in the current environment.

The tool will also fail if an invalid key is passed:

xbill@penguin:~/iap-https-rust/stdiokey$ export MCP_API_KEY=1234567890
xbill@penguin:~/iap-https-rust/stdiokey$ make info
{"timestamp":"2026-02-08T22:34:04.966794Z","level":"INFO","fields":{"message":"Fetching MCP API Key for project: 1056842563084"},"target":"sysutils_stdiokey_rust"}
{"timestamp":"2026-02-08T22:34:05.029982Z","level":"ERROR","fields":{"message":"Application failed","error":"Failed to fetch MCP API Key\n\nCaused by:\n 0: Failed to list API keys\n 1: Token retrieval failed: Connection failure: Hyper error: client error (Connect)\n "},"target":"sysutils_stdiokey_rust"}
make: *** [Makefile:26: info] Error 1
xbill@penguin:~/iap-https-rust/stdiokey$ 

Setting an API Key

On project setup the init.sh script configures the Google Cloud environment and creates a sample key to secure the connection. To set this key in the current environment — use the set_key.sh script:

xbill@penguin:~/iap-https-rust/stdiokey$ source ../set_key.sh
--- Setting Google Cloud Project ID ---
Using Google Cloud project: comglitn
Checking for existing MCP API Key...
Using existing MCP API Key: projects/1056842563084/locations/global/keys/cbd6422f-e594-4536-9ad9-6f179f43f11b
Retrieving API Key string...
MCP API Key retrieved and exported.

To use with the 'manual' or 'local' variants, ensure this script was sourced:
source ./set_key.sh
cargo run --bin manual
--- Environment Checks ---
Not running in Google Cloud VM or Shell. Checking ADC...
Running on ChromeOS.
--- Initial Setup complete ---
xbill@penguin:~/iap-https-rust/stdiokey$

The tool can now execute:

xbill@penguin:~/iap-https-rust/stdiokey$ cargo run info
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.07s
     Running `target/debug/sysutils-stdiokey-rust info`
{"timestamp":"2026-02-08T23:07:46.935357Z","level":"INFO","fields":{"message":"Fetching MCP API Key for project: 1056842563084"},"target":"sysutils_stdiokey_rust"}
{"timestamp":"2026-02-08T23:07:49.712041Z","level":"INFO","fields":{"message":"Successfully fetched API key via gcloud"},"target":"sysutils_stdiokey_rust"}
System Information Report
=========================

MCP API Key Status
------------------
Provided Key: [FOUND]
Cloud Match: [MATCHED]

System Information
------------------
System Name: Debian GNU/Linux
Kernel Version: 6.6.99-09121-g16665fbb817c
OS Version: 12
Host Name: penguin

CPU Information
---------------
Number of Cores: 16

Memory Information
------------------
Total Memory: 6364 MB
Used Memory: 297 MB
Total Swap: 0 MB
Used Swap: 0 MB

Network Interfaces
------------------
lo : RX: 3897 bytes, TX: 3897 bytes (MAC: 00:00:00:00:00:00)
veth7ac2607 : RX: 126 bytes, TX: 1868 bytes (MAC: 7e:ab:4b:a7:6a:bf)
veth6af42f9 : RX: 126 bytes, TX: 1868 bytes (MAC: 1a:05:e1:da:02:b3)
br-e70a18428e21 : RX: 168 bytes, TX: 746 bytes (MAC: 2e:76:46:de:e4:6c)
eth0 : RX: 5884193 bytes, TX: 42076984 bytes (MAC: 00:16:3e:07:39:7b)
docker0 : RX: 0 bytes, TX: 0 bytes (MAC: 2a:e4:d7:54:a8:de)

xbill@penguin:~/iap-https-rust/stdiokey$ 

System Information with MCP STDIO Transport

One of the key features that the Rust rmcp SDK provides is abstracting various transport methods.

The high level tool MCP implementation is the same no matter what low level transport channel/method that the MCP Client uses to connect to a MCP Server.

The simplest transport that the SDK supports is the stdio (stdio/stdout) transport — which connects a locally running process. Both the MCP client and MCP Server must be running in the same environment.

First- switch the directory with the Rust stdio sample code:

xbill@penguin:~/iap-https-rust/stdiokey$ make release
Building Release...
    Finished `release` profile [optimized] target(s) in 0.18s
xbill@penguin:~/iap-https-rust/stdiokey$ 

You can validate the final result of the build by checking the compiled Rust binary:

xbill@penguin:~/iap-https-rust/stdiokey/target/release$ file sysutils-stdiokey-rust
sysutils-stdiokey-rust: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a9f3e7464e5ff32b4fbe55cc7659cb1c7835eaf9, stripped
xbill@penguin:~/iap-https-rust/stdiokey/target/release$ 

Connecting Gemini CLI to the MCP STDIO Server

To configure Gemini CLI as the MCP client- a sample settings.json is provided in the .gemini config directory:

{
  "mcpServers": {
    "sysutils-stdiokey-rust": {
        "command": "$HOME/iap-https-rust/stdiokey/target/release/sysutils-stdiokey-rust",
        "args": ["--prebuilt","--stdio"],
        "env": {
          "RUST_LOG": "trace",
          "MCP_API_KEY": "xxx"
        }
      }
    }
  }

This sample Gemini CLI config will fail- as the MCP_API_KEY is hard coded to xxx:

✕ Error during discovery for MCP server 'sysutils-stdiokey-rust': MCP error -32000: Connection closed

 > /mcp list
Configured MCP servers:

🔴 sysutils-stdiokey-rust - Disconnected

Pass the API Key in Gemini Settings

The stdio server checks the API key if it is provided. The set_key.sh scripts sets the environment variable from the Google Cloud settings. A sample Gemini setup is provided for this scenario as well:

{
  "mcpServers": {
    "sysutils-stdiokey-rust": {
        "command": "$HOME/iap-https-rust/stdiokey/target/release/sysutils-stdiokey-rust",
        "args": ["--prebuilt","--stdio"],
        "env": {
          "RUST_LOG": "trace",
          "MCP_API_KEY": "$MCP_API_KEY"
        }
      }
    }
  }

Next Gemini CLI is used to check the MCP connection settings:

> /mcp list
Configured MCP servers:
🟢 sysutils-stdio-rust - Ready (2 tools)
  Tools:
  - disk_usage
  - local_system_info

The local MCP Server (sysutils-stdiokey-rust) can now be used directly using Gemini CLI as a MCP client. This is the same Rust binary that was tested locally as a standalone build:

> run mcp tool local_system_info
✦ I will retrieve the system information using the local_system_info tool.

╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ ✓ local_system_info (sysutils-stdiokey-rust MCP Server) {} │
│ │
│ System Information Report │
│ ========================= │
│ │
│ Authentication: [VERIFIED] (Running as MCP Server) │
│ │
│ System Information │
│ --- │
│ System Name: Debian GNU/Linux │
│ Kernel Version: 6.6.99-09121-g16665fbb817c │
│ OS Version: 12 │
│ Host Name: penguin │
│ │
│ CPU Information │
│ --- │
│ Number of Cores: 16 │
│ │
│ Memory Information │
│ --- │
│ Total Memory: 6364 MB │
│ Used Memory: 678 MB │
│ Total Swap: 0 MB │
│ Used Swap: 0 MB │
│ │
│ Network Interfaces │
│ --- │
│ veth7ac2607 : RX: 126 bytes, TX: 1938 bytes (MAC: 7e:ab:4b:a7:6a:bf) │
│ br-e70a18428e21 : RX: 168 bytes, TX: 746 bytes (MAC: 2e:76:46:de:e4:6c) │
│ eth0 : RX: 6840392 bytes, TX: 44354526 bytes (MAC: 00:16:3e:07:39:7b) │
│ veth6af42f9 : RX: 126 bytes, TX: 1868 bytes (MAC: 1a:05:e1:da:02:b3) │
│ docker0 : RX: 0 bytes, TX: 0 bytes (MAC: 2a:e4:d7:54:a8:de) │
│ lo : RX: 3897 bytes, TX: 3897 bytes (MAC: 00:00:00:00:00:00) │
│ │
╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
✦ The system information has been retrieved and is displayed above. What would you like to do next?

Project Package Details

The stdiokey project has been published to crates.io:

crates.io: Rust Package Registry

Summary

The potential for using Rust for MCP development with Gemini CLI was validated with a incremental step by step approach.

A minimal stdio transport MCP Server was built from Rust source code and validated with Gemini CLI running as a MCP client in the same local environment.

This approach can be extended to more complex deployments using other MCP transports and Cloud based options.