Skip to content

v0.2.0 — Audit remediation (production-ready)

Choose a tag to compare

View all tags
@malkreide malkreide released this 04 Jun 03:30
v0.2.0
c159273
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Audit-remediation release. Closes all critical/high findings from the
mcp-audit-skill audit. The
re-audit reports production-ready: 36 pass · 0 fail · 2 partial · 6 todo
(catalog hash 091f446b, run-id 2026-06-03T191138-Z-swiss-electricity-mcp).

🔒 Security

  • SEC-016 — HTTP host defaults to 127.0.0.1; 0.0.0.0 only explicitly (containers).
  • SEC-007 — Multi-stage Dockerfile, non-root user (UID 10001), HEALTHCHECK.
  • SEC-018 — SPARQL-injection closed: category whitelist + canton escaping + string bounds.
  • SEC-004/005/021 — HTTPS-only, host-allow-listed egress gate (assert_url_allowed); see docs/network-egress.md.
  • SEC-022 — Tool definitions pinned in tool-definitions.lock.json with a drift test.
  • SEC-019/013/008 — Security posture documented (docs/security-posture.md): lethal-trifecta, secrets, supply chain.

🔭 Observability

  • OBS-003/004 — Structured JSON logging via structlog to stderr.
  • OBS-006 — Opt-in OpenTelemetry tracing (per-tool spans + httpx auto-instrumentation).
  • OBS-002 — Upstream errors logged server-side, masked in client responses.
  • OBS-001 — Execution- and protocol-error-path tests.

🧩 SDK & architecture

  • SDK-001 — Shared HTTP clients owned by a FastMCP lifespan.
  • SDK-003 — ctx: Context on SPARQL tools; progress reporting in compare.
  • SDK-004 — CORS middleware exposes/allows Mcp-Session-Id.
  • ARCH-004 — Configuration centralised in a Pydantic-Settings object; clients via lifespan context.
  • ARCH-009 — All 12 tools declare explicit MCP annotations (readOnlyHint/openWorldHint).
  • ARCH-007 — tariff_compare_municipalities fetches concurrently (asyncio.gather).
  • ARCH-003 — Search tools return match_type + actionable suggestion on zero hits.

⚙️ CI / infrastructure

  • ARCH-011/OPS-001 — CI (test.yml: ruff + pytest on 3.11–3.13) and publish.yml (PyPI OIDC).
  • ARCH-005 — Gitleaks secret scan on every push/PR.
  • ARCH-012 — Dependabot; mcp[cli] pinned >=1.2.0,<2.0.0; MCP protocol-version policy in README.
  • OPS-002/003 — ASCII architecture diagram; Phase-1 declaration + docs/roadmap.md.

Full changelog: CHANGELOG.md · compare v0.1.0...v0.2.0

Assets 2
Loading