v0.5.0

backrest-mcp v0.5.0

Security

• Nested policy messages projected through pinned key allowlists (F-04): a field a later Backrest adds to prunePolicy, checkPolicy, forgetPolicy, commandPrefix, schedule or retention is dropped until it is named.
• Restore prefix moved out of /tmp (default ~/backrest-restore/) and refused unless it is a real 0700 directory owned by the server user (#1182).
• Deploy from the lock: install/update with uv sync --frozen --extra dev, not pip install -e ., so production runs the dependency set CI audits.

Added

• list_plans, find_plan_for_path(path) (approximate restic exclude matching), get_backup_freshness(max_age_hours?) with stale_count and unscheduled_count. All read the secret-free projection only.
• scripts/run_live_conformance.py: live tests with credentials read in-process, never on argv.
• NATS credentials: NATS_CREDS_FILE, or NATS_USER + NATS_PASSWORD.

Changed

• src/ layout — an editable install must be redone before python -m backrest_mcp.server works again.
• Bounded dependency ranges and a committed uv.lock; CI installs --frozen and audits the lock.
• Repository standard: SHA-pinned actions, least-privilege workflow permissions, gitleaks, CodeQL, OSSF Scorecard, CODEOWNERS, Dependabot, ruff E F W I UP B SIM RUF + format, coverage floor 96%.

See CHANGELOG.md for detail.