v0.2.0 — First production-ready release

First production-ready release. Aligns the repository with the Swiss Public Data
MCP portfolio, runs a full MCP best-practice audit, and remediates every finding.

Highlights

• Portfolio alignment — Dockerfile, compose, CI/CD (ci/live/publish),
  server.json for the MCP Registry, CONTRIBUTING/SECURITY/PUBLISHING (EN/DE).
• Hardening — single pooled httpx client via a FastMCP lifespan (SDK-001),
  strict Pydantic argument constraints at the tool boundary (SEC-018), a
  code-layer egress allow-list with no off-host redirects (SEC-021), structured
  JSON logging on stderr (OBS-003), Context-based progress/logging (SDK-003),
  and CORS Mcp-Session-Id exposure for SSE (SDK-004).
• Discovery UX — search_catalog returns match_type + an actionable hint
  on empty results (ARCH-003); get_dataset is the aggregated detail tool, so the
  anchor query resolves in two calls (ARCH-007).
• Supply-chain — tool-definitions.lock.json rug-pull guard verified in CI
  (SEC-022); all tool annotations set the full hint set (ARCH-009).

Audit

Production-ready ✅ — run 2026-07-24T091742-Z-i14y-mcp, catalog hash
091f446b2796…: 36 pass · 0 fail · 5 non-blocking partials · 3 todo. Report
and per-finding docs under audits/.

⚠️ Behaviour change

The SSE / streamable-http transport now defaults to HOST=127.0.0.1 (loopback).
Set HOST=0.0.0.0 for remote/PaaS deployments — the Docker image already does.

Install