cmcp/pyproject.toml at main · agentrust-io/cmcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "cmcp-runtime"
version = "0.4.0"
description = "Hardware-attested MCP runtime, TEE-enforced policy and TRACE Claim generation"
readme = "README.md"
license = { text = "MIT" }
authors = [
    { name = "AgenTrust Contributors", email = "imransiddique@live.com" },
]
keywords = ["mcp", "tee", "attestation", "security", "ai-agents", "cedar"]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Security",
    "Topic :: Scientific/Engineering :: Artificial Intelligence",
    "Typing :: Typed",
]
requires-python = ">=3.11"
dependencies = [
    "agentrust-trace>=0.5",
    # 0.11.2 is the floor: verification binds the manifest's declared policy
    # enforcement mode to the runtime's attested enforcement mode.
    "agent-manifest>=0.11.2",
    "cryptography>=50.0,<51.0",
    "pyyaml>=6.0",
    "httpx>=0.27",
    "anyio>=4.0",
    "starlette>=0.37",
    "uvicorn>=0.29",
    "click>=8.1",
    "cedarpy>=4.0",
]

[project.optional-dependencies]
# AARM R8 telemetry export. Optional so the base install stays lean and a
# deployment opts in explicitly; without it the exporter degrades to a no-op.
otel = [
    "opentelemetry-api>=1.25",
    "opentelemetry-sdk>=1.25",
    "opentelemetry-exporter-otlp-proto-http>=1.25",
]
dev = [
    "mcp>=1.28.1,<3.0",
    "pytest>=8.0",
    "pytest-asyncio>=0.23",
    "pytest-cov>=5.0",
    "ruff>=0.4",
    "mypy>=1.10",
    "types-pyyaml",
    "bandit[toml]>=1.7",
    "pip-audit>=2.6",
]

[project.scripts]
cmcp = "cmcp_runtime.cli:main"

[project.urls]
Homepage = "https://github.com/agentrust-io/cmcp"
Repository = "https://github.com/agentrust-io/cmcp"
Documentation = "https://github.com/agentrust-io/cmcp/tree/main/docs"
"Bug Tracker" = "https://github.com/agentrust-io/cmcp/issues"

[tool.hatch.build.targets.wheel]
packages = ["src/cmcp_runtime", "src/cmcp_verify"]

[tool.hatch.build.targets.wheel.force-include]
"schemas/catalog-entry.schema.json" = "cmcp_runtime/schemas/catalog-entry.schema.json"
"schemas/catalog-approval.schema.json" = "cmcp_runtime/schemas/catalog-approval.schema.json"


[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"
addopts = "-v --tb=short"
pythonpath = ["src"]

[tool.ruff]
src = ["src"]
line-length = 100
target-version = "py311"

[tool.ruff.lint]
select = ["E", "F", "W", "I", "UP", "B", "C4", "PIE", "T20", "RET", "SIM"]
ignore = ["E501"]

[tool.ruff.lint.per-file-ignores]
"src/cmcp_runtime/benchmarks.py" = ["T201"]
"tests/soak/run_soak.py" = ["T201", "B007"]

[tool.bandit]
skips = ["B101"]

[tool.coverage.run]
source = ["src"]
omit = ["*/cli.py"]

[tool.coverage.report]
fail_under = 70

[tool.mypy]
python_version = "3.11"
strict = true
ignore_missing_imports = true
warn_return_any = false
files = ["src/cmcp_runtime", "src/cmcp_verify"]

[[tool.mypy.overrides]]
module = ["cmcp_runtime.tee.sev_snp", "cmcp_runtime.tee.tdx", "cmcp_runtime.tee.spiffe"]
warn_unused_ignores = false