v0.1.5 — hotfix: pin mcp[cli]<2

Hotfix — pin `mcp[cli]<2`

Upstream `mcp` shipped v2.0.0 with a breaking restructure that removed the `mcp.server.fastmcp` import path our server relies on. Our previous dependency constraint `mcp[cli]>=1.6.0` (no upper bound) allowed pip to resolve to `2.0.0`, breaking every new install of `tridentchain-mcp==0.1.4` with:

```
ModuleNotFoundError: No module named 'mcp.server.fastmcp'
```

v0.1.5 pins the constraint to `mcp[cli]>=1.6.0,<2` so pip resolves to the last compatible major.

What changed

Single-line change in `tridentchain-mcp/pyproject.toml`:

```diff

• "mcp[cli]>=1.6.0",

• "mcp[cli]>=1.6.0,<2",
  ```

No behavioural changes in the scanner, MCP tools, or plugin. `tridentchain-security` remains at 0.1.4 (no bump needed).

Verification

• Reproduced the bug: fresh venv install of v0.1.4 → `mcp 2.0.0` → `ModuleNotFoundError`
• Verified fix: fresh venv install of v0.1.5 → `mcp 1.29.0` → import + MCP handshake both work
• All 33 unit tests still pass
• Docker image rebuilt and pushed to GHCR: `ghcr.io/devinder1/tridentchain-mcp:0.1.5` + `:latest`

Distribution

Surface	Version	Status
PyPI `tridentchain-mcp`	0.1.5	✅ https://pypi.org/project/tridentchain-mcp/0.1.5/
PyPI `tridentchain-security`	0.1.4	unchanged
GHCR image	0.1.5 + `:latest`	✅ https://github.com/DevInder1/supply-chain-scanner-public/pkgs/container/tridentchain-mcp
MCP Registry	0.1.5 pending re-publish	⏳
Glama release	0.1.5	✅ published

Upgrade

```bash
pip install -U "tridentchain-mcp>=0.1.5"

Or:

uvx tridentchain-mcp

Or:

docker run --rm -i ghcr.io/devinder1/tridentchain-mcp:latest
```

v0.1.4 — 7 skills + sharper tool descriptions

Highlights

A positioning + UX release. The plugin's skill surface expands from 2 to 7 to match the granularity of comparable supply-chain scanners. Tool descriptions are rewritten to surface TridentChain's real moats — EPSS exploit-probability ranking, CISA KEV catalog presence, and system + IDE extension coverage.

New skills

Skill	Purpose
/tridentchain-security:quick-scan	Fast cached-only scan of project dependencies (sub-second)
/tridentchain-security:scan	Full project dependency scan with live OSV/NVD/GHSA advisories
/tridentchain-security:scan-full	Comprehensive: project deps + system packages (Homebrew/apt) + IDE extensions (VS Code, JetBrains)
/tridentchain-security:why	Explain why a vulnerable package is in the tree — dep chain, CVEs, EPSS, fix
/tridentchain-security:fix-plan	EPSS/KEV-prioritised remediation plan with copy-paste upgrade commands
/tridentchain-security:validate-fixes	Re-scan and confirm fixes after dependency upgrades (kept)
/tridentchain-security:supply-chain-scan	Backward-compat alias for scan

Tool description rewrites

• scan_project — title now reads "Scan Project — EPSS/KEV-prioritised"; description leads with "real-world exploitation risk", "which CVEs to fix FIRST", and pairing with validate_after_patch.
• scan_full — title now reads "Scan Workspace (Project + System + IDE)"; description explicitly cites the three surfaces other scanners miss.
• validate_after_patch — description explicitly calls out this being unique to TridentChain (a verifiable post-patch loop).

These are pure description changes — no behaviour changes, no breaking changes.

Plugin manifest

Description rewritten:

Comprehensive local supply-chain CVE scanning — project deps, system packages (Homebrew/apt), AND IDE extensions (VS Code, JetBrains) — with EPSS exploit-probability and CISA KEV prioritisation. Includes validate-after-patch workflow to confirm fixes. Local-first; no source code leaves the user's machine. Complements project-only CI scanners by covering surfaces they miss.

Tests

• 33/33 unit tests pass (unchanged from v0.1.3)
• claude plugin validate passes

Distribution

Surface	Version	Status
PyPI tridentchain-security	0.1.4	live
PyPI tridentchain-mcp	0.1.4	live
MCP Registry	0.1.4	re-published this release

Upgrade

```bash
pip install -U "tridentchain-security>=0.1.4" "tridentchain-mcp>=0.1.4"

Or zero-Python-install:

uvx tridentchain-mcp
```

MCP clients (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Zed) pick up the new version on their next restart.

v0.1.3 — fix version-range false positives

Highlights

The matcher was treating the floor of a version range (e.g. requests >=2.31.0) as if it were a pinned installed version, producing false-positive CVE hits. Lockfile-resolved pins are the correct source of truth — that's what v0.1.3 now uses.

Changes

• scanner/core/matcher.py — new is_range_constraint() helper detects unresolved range expressions (^, ~, >=, >, <=, <, !=, ~=, *); version_matches() short-circuits and skips them so they don't get matched against advisory ranges.
• scanner/tests/test_matcher_ranges.py — 21 new regression tests covering every operator across npm and PyPI conventions. 33/33 tests pass (original 8 untouched).

Behaviour preserved

• Pinned versions (e.g. 2.31.0) still match advisory ranges exactly as before.
• Explicit version lists still match pinned versions.
• All existing CLI flags and MCP tool signatures unchanged.

Behaviour fixed

Component	Before v0.1.3	After v0.1.3
requests >=2.31.0 (range)	3 medium false positives	0 vulns
brace-expansion@5.0.5 (pinned)	1 medium (real CVE)	1 medium (still correctly flagged)

Distribution

Surface	Version	Status
PyPI tridentchain-security	0.1.3	https://pypi.org/project/tridentchain-security/0.1.3/
PyPI tridentchain-mcp	0.1.3	https://pypi.org/project/tridentchain-mcp/0.1.3/
MCP Registry	0.1.3	status active, isLatest true (io.github.DevInder1/tridentchain-security)

Upgrade

```bash
pip install -U "tridentchain-security>=0.1.3" "tridentchain-mcp>=0.1.3"

Or zero-Python-install:

uvx tridentchain-mcp
```

MCP clients (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Zed) pick up the new version automatically on their next restart.