AST Eval Defense, MCP Spec Alignment, and CI Hardening
Adds an AST-based expression validator as a defense-in-depth layer over the restricted eval(), aligns tool notifications with the MCP 2026-07-28 spec, hardens the release pipeline with SHA256 verification, and extends CI with a pyright typecheck job and visualization coverage.
Installation
# Local (stdio transport)
uvx math-mcp-learning-server
# Remote (streamable HTTP, no install needed)
# https://math-mcp.fastmcp.app/mcpWhat's Changed
Features
- eval: Add AST-based expression validator as defense-in-depth layer over restricted
eval()(#432)
Fixes
- tools: Migrate ctx logging notifications to stdlib logging per MCP 2026-07-28 spec (C01-C05) (#429)
- ci: Use
gh release downloadfor mcp-publisher install (#424)
Tests
- http-rate-limit: Replace ping with liveness check and measure rate-limit budget (C08, C09) (#430)
- coverage: Include visualization modules in coverage gate and update gap doc (#434)
CI
- release: Add SHA256 verification for mcp-publisher and explicit job permissions (#433)
- typecheck: Add pyright config block and typecheck job with plotting/scientific extras (#435)
Docs
- audit: MCP 2026-07-28 spec alignment audit (#428)
- audit: Mark MCP 2026-07-28 action items resolved (#431)
- adr: Add ADR-008 index, document AST eval layer, update CI job list (#437)
Chores
- deps: Update
pypa/gh-action-pypi-publishaction to v1.14.2 (#436)
Full Changelog: v0.12.2...v0.12.3