[project]
name = "moltrust-mcp-server"
version = "1.3.0"
description = "MCP server for MolTrust — Trust Infrastructure for AI Agents"
readme = "README.md"
requires-python = ">=3.10"
authors = [{ name = "CryptoKRI GmbH", email = "info@moltrust.ch" }]
keywords = ["mcp", "moltrust", "trust", "ai-agents", "did", "verifiable-credentials"]
license = { text = "MIT" }
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
]
dependencies = [
    # Security floor, not a preference. Below 1.28.1 the SDK carries three
    # advisories: GHSA-jpw9-pfvf-9f58 (HTTP transports route session requests
    # without verifying the requester), GHSA-hvrp-rf83-w775 (experimental task
    # handlers reachable across sessions) and GHSA-vj7q-gjh5-988w (WebSocket
    # transport skips Host/Origin validation). The first one hits the transport
    # this server actually runs.
    # Upper bound is load-bearing, not cosmetic: mcp 2.x renamed FastMCP to
    # MCPServer and moved mcp.server.fastmcp, so server.py:10 stops importing.
    # The floor stays at 1.28.1 for the three transport advisories. Migrating
    # to the 2.x API is its own piece of work — see docs/BACKLOG.md in
    # moltrust-api.
    "mcp>=1.28.1,<2",
    "httpx>=0.27.0",
    # Ed25519 for the one-time DID registration (autoregister.py). Already
    # installed through mcp -> pyjwt[crypto]; named here because this package
    # now imports it directly.
    "cryptography>=41",
]

[project.urls]
Homepage = "https://moltrust.ch"
Repository = "https://github.com/MoltyCel/moltrust-mcp-server"
"Security Research" = "https://moltrust.ch/blog/scanned-50-agent-endpoints.html"

[project.scripts]
moltrust-mcp-server = "moltrust_mcp_server:main"

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["src/moltrust_mcp_server"]

[dependency-groups]
# ruff and pyright are pinned to the exact versions CI runs (see ci.yml), so a
# local check and the build agree. Both gate on style/inference, so a floor
# alone lets the two drift apart and the disagreement only shows up in CI.
# pytest keeps a floor — it does not invent new failures the way linters do.
dev = ["pyright==1.1.411", "ruff==0.16.0", "pytest>=8.0.0", "pytest-asyncio>=0.24.0"]

[tool.pytest.ini_options]
asyncio_mode = "auto"