neva

The server implements bearer token authentication and role-based access control (RBAC) for tools, resources, and prompts, as configured via `AuthConfig` in `http/server/auth_config.rs`. Input validation for structured data, specifically for elicitation requests, is handled explicitly. The framework's use of Rust's proc-macros for defining handlers means that developer-provided literal strings and expressions are embedded directly into generated Rust code at compile time. While this shifts potential injection risks to the compile phase (requiring developers to ensure macro inputs are safe), it mitigates runtime dynamic code execution vulnerabilities from unvetted external input. No 'eval'-like runtime execution from untrusted sources is apparent.