Works on both mcp 1.x and 2.x (cap removed — server binds FastMCP or MCPServer automatically). Provenance block on every machine-readable result. Fixes the 0.2.3 startup break; sdist now ships the full test suite. Releases are gated on the built artifact importing and running on both SDK generations. Breaking: scan_gdpr/scan_bias now return {"findings": [...]} instead of a bare array.