mcpgawk/pyproject.toml at main · gawk-dev/mcpgawk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "mcpgawk"
version = "0.1.80"
description = "One gateway in front of every MCP server your agents can reach — every call checked against a baseline you approved. Local-first: nothing leaves your machine."
readme = "README.md"
requires-python = ">=3.10"
license = "Apache-2.0"
authors = [{ name = "Neelagiri" }]
keywords = ["mcp", "model-context-protocol", "mcp-gateway", "post-approval-drift", "rug-pull", "prompt-injection", "agentic-ai", "ai-security", "supply-chain-security", "security", "local-first", "tokens", "llm", "agents", "cli"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: Apache Software License",
    "Programming Language :: Python :: 3",
    "Topic :: Security",
    "Topic :: Software Development :: Libraries",
    "Environment :: Console",
]
dependencies = [
    "mcp>=2.2,<3",       # official protocol client (2.2: issuers_match, used by oauth_login) — v2 speaks 2026-07-28 and negotiates down to earlier revisions
    "cryptography>=42",  # AES-GCM for stored sign-ins at rest (oauth_login); arrives via mcp/pyjwt, imported directly
    "httpx2>=2",         # the fork mcp v2 transports run on; probe.py builds the no-redirect client directly
    "tiktoken>=0.7",     # named cost-index tokenizer (cl100k); honestly labelled, not Claude-exact
    "httpx>=0.27",       # well-known Server Card fetch (also a transitive mcp dep; pinned explicitly)
    "pyyaml>=6",         # Goose and Continue keep their MCP servers in YAML. Discovery is
                         # dependency-light by design and this is a DELIBERATE exception: without
                         # it those clients are listed as supported and contribute nothing on a
                         # clean install. Caught 2026-08-02 — the platform repo declares PyYAML
                         # for Finix, so every dev machine had it and every test passed while the
                         # SHIPPED scanner would have read no Goose/Continue config at all.
    "tomli>=2.0; python_version < '3.11'",  # tomllib backport: without it, Python 3.10 users
                         # silently lose every Codex server (config.toml is the only TOML client).
]

[project.optional-dependencies]
dev = ["pytest>=8", "pytest-asyncio>=0.23"]
gateway = ["starlette>=0.40", "uvicorn>=0.30"]

[project.urls]
Homepage = "https://mcp.gawk.dev"
Documentation = "https://mcp.gawk.dev/docs"
Repository = "https://github.com/gawk-dev/mcpgawk"
Issues = "https://github.com/gawk-dev/mcpgawk/issues"
Changelog = "https://github.com/gawk-dev/mcpgawk/releases"

[project.scripts]
mcpgawk = "mcpgawk.cli:main"
mcpgawk-mcp = "mcpgawk.mcp_server:main"

[tool.hatch.build.targets.wheel]
packages = ["src/mcpgawk"]
# hatchling honours .gitignore, and `dist/` is ignored repo-wide — which silently dropped
# the compiled verify engine from the 0.1.16 wheel while shipping its node_modules. The
# artifacts field exists precisely to include VCS-ignored build products in the wheel.
artifacts = ["src/mcpgawk/_bundled/**", "!**/*.d.ts", "!**/*.map"]
# TypeScript declaration and sourcemap files are development artefacts, not runtime: node
# executes .js only. Excluding them also keeps compiled-away attribution headers (tsc strips
# comments from generated .d.ts) from shipping as header-less derived members.
exclude = ["src/mcpgawk/_bundled/**/*.d.ts", "src/mcpgawk/_bundled/**/*.map"]

[tool.hatch.build.targets.wheel.force-include]
# The wheel ships a derived Apache-2.0 module (adapters/pulled/invariant_redact.py), so it
# must ship the licence rollup too — pinned by the published-wheel attribution journey test.
"THIRD_PARTY_LICENSES.md" = "mcpgawk/THIRD_PARTY_LICENSES.md"

[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["tests"]
markers = [
    "journey_live: reaches mcp.gawk.dev or pypi.org (network required)",
    # The panel verify-button E2E: needs Node + the bundled verify runtime. Deselected from the
    # fast matrix (`-m \"not verify_live\"`) and run in its own CI job (see .github/workflows/ci.yml).
    "verify_live: drives the real verify engine (Node + bundled runtime required)",
]