From 127f56ca9e3b14d5dca1a5f0d248c8e3d3a07d6c Mon Sep 17 00:00:00 2001
From: Rodolfo Olivieri <rodolfo.olivieri3@gmail.com>
Date: Tue, 27 Jan 2026 10:56:29 -0300
Subject: [PATCH] feat: add native-tls as an optional TLS backend

Add reqwest-native-tls feature flag to allow users to choose between
rustls (default) and native-tls for HTTP transports.

native-tls uses platform-native TLS implementations:
- OpenSSL on Linux
- Secure Transport on macOS
- SChannel on Windows

This is particularly useful for Linux distribution packagers who need
to link against system TLS libraries (e.g., OpenSSL) rather than
bundling a separate TLS implementation. Linking against system libs
ensures security updates are applied system-wide and satisfies
distribution packaging policies.

Updated documentation to explain the available TLS backend options.
---
 crates/rmcp/Cargo.toml | 2 ++
 crates/rmcp/README.md  | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/crates/rmcp/Cargo.toml b/crates/rmcp/Cargo.toml
index b9c0baa2..b93a7a9d 100644
--- a/crates/rmcp/Cargo.toml
+++ b/crates/rmcp/Cargo.toml
@@ -88,6 +88,8 @@ reqwest = ["__reqwest", "reqwest?/rustls-tls"]
 
 reqwest-tls-no-provider = ["__reqwest", "reqwest?/rustls-tls-no-provider"]
 
+reqwest-native-tls = ["__reqwest", "reqwest?/native-tls"]
+
 server-side-http = [
   "uuid",
   "dep:rand",
diff --git a/crates/rmcp/README.md b/crates/rmcp/README.md
index ed366a39..54b27b91 100644
--- a/crates/rmcp/README.md
+++ b/crates/rmcp/README.md
@@ -270,6 +270,10 @@ RMCP uses feature flags to control which components are included:
     - `transport-streamable-http-client-reqwest`: a default `reqwest` implementation of the streamable http client
 - `auth`: OAuth2 authentication support
 - `schemars`: JSON Schema generation (for tool definitions)
+- TLS backend options (for HTTP transports):
+  - `reqwest`: Uses rustls (pure Rust TLS, recommended default)
+  - `reqwest-native-tls`: Uses platform native TLS (OpenSSL on Linux, Secure Transport on macOS, SChannel on Windows)
+  - `reqwest-tls-no-provider`: Uses rustls without a default crypto provider (bring your own)
 
 
 ## Transports