[project]
name = "automox-mcp"
version = "2.2.9"
description = "Official MCP server for Automox"
readme = "README.md"
authors = [
  { name = "Automox" }
]
license = "MIT"
requires-python = ">=3.11"
classifiers = [
  "Development Status :: 5 - Production/Stable",
  "Intended Audience :: System Administrators",
  "Operating System :: OS Independent",
  "Programming Language :: Python :: 3",
  "Programming Language :: Python :: 3.11",
  "Programming Language :: Python :: 3.12",
  "Programming Language :: Python :: 3.13",
  "Topic :: System :: Systems Administration"
]
dependencies = [
  "click>=8.3.3",  # PYSEC-2026-2132: click.edit() command injection; transitive via typer/fastmcp
  "cryptography>=48.0.1",  # GHSA-537c-gmf6-5ccf: bundled-OpenSSL fix in wheels
  # fastmcp-slim[server], not the fastmcp metapackage: fastmcp is a code-less
  # shell whose sole dependency is fastmcp-slim[client,server] -- depending on it
  # adds one more PyPI package to the supply chain for zero code. [server] is the
  # extra the deployed http_app/create_server path actually needs. NOTE: the
  # desktop conveniences (keyring, pyperclip, watchfiles, websockets) still ship
  # -- they are declared inside fastmcp-slim's server extra itself; pruning them
  # requires an upstream fastmcp split, not a change here.
  "fastmcp-slim[server]>=3.4.2",
  "httpx>=0.28",
  "joserfc>=1.6.7",  # CVE-2026-48990: JWS payload-size-limit bypass; transitive via fastmcp
  "pydantic>=2.12",
  "python-dotenv>=1.1"
]

[project.scripts]
automox-mcp = "automox_mcp:main"

[project.optional-dependencies]
dev = [
  "pytest>=9.0.3",
  "pytest-asyncio>=0.23",
  "pytest-cov>=6.0",
  "pytest-randomly>=3.15",
  "ruff>=0.4",
  "mypy>=1.9",
  "build>=1.2.2",
  "twine>=5.1",
  "pre-commit>=4.0",
  "bandit>=1.8"
]

[project.urls]
Homepage = "https://github.com/AutomoxCommunity/automox-mcp"
Repository = "https://github.com/AutomoxCommunity/automox-mcp"
Issues = "https://github.com/AutomoxCommunity/automox-mcp/issues"
Documentation = "https://github.com/AutomoxCommunity/automox-mcp#readme"

[build-system]
requires = ["setuptools>=65", "wheel"]
build-backend = "setuptools.build_meta"

[tool.setuptools.packages.find]
where = ["src"]

[tool.setuptools.package-data]
automox_mcp = ["py.typed"]

[tool.ruff]
line-length = 100

[tool.ruff.lint]
select = ["E", "F", "I", "UP", "B", "ASYNC"]

[tool.ruff.lint.per-file-ignores]
"src/automox_mcp/prompts/*.py" = ["E501"]

[tool.mypy]
python_version = "3.13"
warn_return_any = true
warn_unused_configs = true
exclude = ["tests/"]

[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"

[tool.bandit]
targets = ["src/"]
exclude_dirs = ["tests", ".venv"]

[tool.uv]
constraint-dependencies = [
  "authlib>=1.6.11",      # CVE-2025-68158, GHSA-jj8c-mmj3-mmgv: CSRF in cache-backed state storage
  "cryptography>=48.0.1", # CVE-2026-26007, CVE-2026-34073; GHSA-537c-gmf6-5ccf (bundled-OpenSSL fix in wheels)
  "fastmcp-slim>=3.4.2",  # >=3.2.0: CVE-2025-69196, CVE-2025-64340, CVE-2026-27124, GHSA-rcfx-77hg-w2wv; >=3.4.2: OAuth-proxy/cache/header-forwarding hardening (3.2.4/3.3.0). Floor moved from the fastmcp metapackage to fastmcp-slim (where the code lives).
  "idna>=3.15",           # CVE-2026-45409 (DoS via crafted IDN encoding; supersedes CVE-2024-3651 fix)
  "jaraco-context>=6.1.0",# CVE-2026-23949
  "mcp>=1.27.2",          # >=1.23.0: CVE-2025-66416; >=1.27.2: GHSA-jpw9-pfvf-9f58 (CVSS 7.1, transport session principal binding), GHSA-hvrp-rf83-w775 (CVSS 7.6, experimental-task isolation)
  "pydantic-settings>=2.14.2", # GHSA-4xgf-cpjx-pc3j: NestedSecretsSettingsSource symlink traversal / secrets_dir_max_size bypass
  "pygments>=2.20.0",     # CVE-2026-4539
  "pyjwt>=2.13.0",        # CVE-2026-32597; 2.13.0: PYSEC-2026-175/177/178/179
  "pytest>=9.0.3",            # CVE-2025-71176: /tmp/pytest-of-* privilege escalation
  "python-multipart>=0.0.27", # CVE-2026-24486, CVE-2026-40347, CVE-2026-42561
  "requests>=2.33.0",     # CVE-2026-25645
  "starlette>=1.3.1",     # PYSEC-2026-161: Host-header path injection in URL reconstruction; CVE-2026-54282 (path-into-authority confusion, 1.3.0), CVE-2026-54283 (urlencoded form DoS, 1.3.1)
  "urllib3>=2.7.0",        # CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, CVE-2026-44431, CVE-2026-44432
]

[tool.coverage.run]
source = ["automox_mcp"]

[tool.coverage.report]
show_missing = true
skip_empty = true