agentconnect-cli 0.1.0a1__py3-none-any.whl

agentconnect/limits.py

@@ -0,0 +1,457 @@
+"""SPEC §10.2 endpoint limits and the §7.2 kind and part checks.
+
+The SPEC defaults (:data:`SPEC_LIMITS`):
+
+* Messages are at most 256 KiB (the canonical JSON of the inner message).
+* Each sender instance may send 30 messages per minute, all instances of one
+  identity together 3 times that, and a group 120.
+* Updates for a task this instance asked for (``a2a.task_status``,
+  ``a2a.task_artifact`` with a ``taskId``, answering a message it sent)
+  have their own budget: 300 per minute per task and sender
+  instance, 3 times that for all of one identity's tasks, and 1200 for the
+  group's. The first update of a task in the window counts as an ordinary
+  message, so opening tasks is held to the message rates. Other task
+  updates get the message rates, in windows of their own.
+* A2A parts may be ``text`` or ``data``; ``file`` parts are disabled.
+* Only the kinds of §7.2/§7.3 are delivered; unknown kinds are ignored.
+
+A group, or one sender in it, can have lower values (:class:`Limits`), never
+higher ones (SPEC 10.2); the safety policy (:mod:`agentconnect.policy`) picks
+them. Rates are counted on the daemon clock over a sliding 60-second
+window, separately for what is received (inbound) and what is queued
+(outbound).
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from collections import OrderedDict, deque
+from dataclasses import dataclass
+from itertools import accumulate
+from typing import Any
+
+from agentconnect.clock import Clock
+from agentconnect.schemas import schema_ok
+
+MAX_MESSAGE_BYTES = 256 * 1024
+SENDER_PER_MINUTE = 30
+GROUP_PER_MINUTE = 120
+IDENTITY_RATE_MULTIPLE = 3  # all instances of an identity: 3 x SENDER_PER_MINUTE
+TASK_PER_MINUTE = 300
+GROUP_TASK_PER_MINUTE = 1200  # task updates from the whole group: 4 x TASK_PER_MINUTE
+MAX_KEYS = 50_000  # rate windows tracked at most (least recently used go first)
+SWEEP_FLOOR = 256  # sweep emptied windows once more than this many are tracked
+MAX_TASK_ID = 256  # longer taskIds get no task budget
+U32_MAX = 2**32 - 1  # SPEC 7.2: `hop` is a u32
+MAX_DEPTH = 64  # SPEC 7.2: nesting of the inner message, itself the first level
+# What wraps an inner message (a relay frame, an adapter payload, an API
+# reply) nests a few levels more: JSON read from them is bounded at this.
+MAX_PAYLOAD_DEPTH = 2 * MAX_DEPTH
+MAX_RECIPIENTS = 50  # SPEC 7.2: entries in `to` and `addressee` (the group size)
+MAX_RECIPIENT_LEN = 128  # characters in one entry (an identity has 49)
+DEFAULT_MAX_FILE_BYTES = 64 * 1024
+TASK_UPDATE_KINDS = frozenset({"a2a.task_status", "a2a.task_artifact"})
+WINDOW_SECS = 60.0
+ALLOWED_PARTS = frozenset({"text", "data"})
+KNOWN_KINDS = frozenset(
+    {
+        "a2a.message",
+        "a2a.task_status",
+        "a2a.task_artifact",
+        "a2a.agent_card",
+        "a2a.task_cancel",
+        "control.leave",
+        "control.close",
+        "control.floor",
+        "control.pause",
+        "control.resume",
+        "control.capabilities",
+    }
+)
+_PART_FIELDS = ("text", "data", "file", "raw", "url")
+PART_EXTRAS = frozenset({"kind", "metadata", "filename", "mediaType"})
+
+
+@dataclass(frozen=True)
+class Limits:
+    """The §10.2 limits one message is held to."""
+
+    max_message_bytes: int = MAX_MESSAGE_BYTES
+    sender_per_minute: int = SENDER_PER_MINUTE
+    group_per_minute: int = GROUP_PER_MINUTE
+    identity_rate_multiple: int = IDENTITY_RATE_MULTIPLE
+    task_per_minute: int = TASK_PER_MINUTE
+    group_task_per_minute: int = GROUP_TASK_PER_MINUTE
+    allow_files: bool = False
+    max_file_bytes: int = DEFAULT_MAX_FILE_BYTES
+
+
+SPEC_LIMITS = Limits()
+
+
+def part_kind(part: Any) -> str:
+    """The kind of one A2A part, ``text``, ``data`` or ``file``, or ``invalid``.
+
+    A part has exactly one content member (A2A 1.0: ``text``, ``data``,
+    ``raw`` or ``url``; A2A 0.x: ``file``), an optional ``kind`` (A2A 0.x)
+    that must name it, and otherwise only ``metadata``, ``filename`` and
+    ``mediaType``. Anything else is invalid: a member could otherwise ride
+    along under a kind that is checked and shown as something else
+    (testdata/a2a-parts.json)."""
+    if not isinstance(part, dict):
+        return "invalid"
+    present = [f for f in _PART_FIELDS if f in part]
+    if len(present) != 1 or not part.keys() <= {*present, *PART_EXTRAS}:
+        return "invalid"
+    found = "file" if present[0] in ("file", "raw", "url") else present[0]
+    if found == "text" and not isinstance(part["text"], str):
+        return "invalid"
+    kind = part.get("kind", found)
+    return found if kind == found else "invalid"
+
+
+def _parts_of(kind: str, body: dict[str, Any]) -> list[Any]:
+    """Every part list a body of ``kind`` carries."""
+    if kind == "a2a.message":
+        parts = body.get("parts", [])
+        return parts if isinstance(parts, list) else [None]
+    if kind == "a2a.task_artifact":
+        artifact = body.get("artifact")
+        parts = artifact.get("parts", []) if isinstance(artifact, dict) else []
+        return parts if isinstance(parts, list) else [None]
+    if kind == "a2a.task_status":
+        status = body.get("status")
+        message = status.get("message") if isinstance(status, dict) else None
+        parts = message.get("parts", []) if isinstance(message, dict) else []
+        return parts if isinstance(parts, list) else [None]
+    return []
+
+
+def too_deep(value: Any, limit: int = MAX_DEPTH) -> bool:
+    """Whether ``value`` nests objects and arrays more than ``limit`` levels
+    (``value`` itself, if it is one, is the first). Iterative, so it can't
+    run out of stack on what it measures."""
+    stack: list[tuple[Any, int]] = [(value, 1)]
+    while stack:
+        node, depth = stack.pop()
+        if isinstance(node, dict):
+            children: Any = node.values()
+        elif isinstance(node, list):
+            children = node
+        else:
+            continue
+        if depth > limit:
+            return True
+        stack.extend((child, depth + 1) for child in children)
+    return False
+
+
+_SURROGATE = re.compile("[\ud800-\udfff]")
+
+
+def unsound(value: Any, limit: int = MAX_DEPTH) -> bool:
+    """Whether ``value`` nests past ``limit`` levels (:func:`too_deep`) or
+    holds a string, or an object key, with a lone surrogate (SPEC 7.2).
+    JSON's ``\\ud800`` escape decodes to one; no UTF-8 encoder takes it, so
+    one would fail the first store, log or adapter that writes it out.
+    Iterative, like :func:`too_deep`."""
+    stack: list[tuple[Any, int]] = [(value, 1)]
+    while stack:
+        node, depth = stack.pop()
+        if isinstance(node, str):
+            if _SURROGATE.search(node):
+                return True
+            continue
+        if isinstance(node, dict):
+            if depth > limit:
+                return True
+            stack.extend((key, depth) for key in node)
+            stack.extend((child, depth + 1) for child in node.values())
+        elif isinstance(node, list):
+            if depth > limit:
+                return True
+            stack.extend((child, depth + 1) for child in node)
+    return False
+
+
+# Three linear passes: escapes go first (each backslash with the character
+# after it), so a string is then a quote, no quotes, a quote; then strings;
+# then everything but brackets. None of them backtracks: an unterminated
+# string is scanned to the end once.
+_ESCAPE = re.compile(r"\\.", re.DOTALL)
+_JSON_STRING = re.compile(r'"[^"]*+"')
+_NOT_BRACKET = re.compile(r"[^\[\]{}]++")
+_STEP = {"[": 1, "{": 1, "]": -1, "}": -1}
+
+
+def json_too_deep(text: str, limit: int = MAX_DEPTH) -> bool:
+    """Whether the JSON ``text`` nests arrays and objects past ``limit``
+    levels, read without parsing it: brackets are counted outside strings,
+    in time linear in the text. Python's JSON parser recurses once per
+    level, and on a small thread stack (macOS, musl) Python 3.12 and 3.13
+    crash on a few thousand levels instead of raising ``RecursionError``.
+    On valid JSON the depth is exact. On anything else it can differ only
+    after the first place the parser refuses (a backslash outside a string,
+    an unterminated string), which the parser never gets past."""
+    brackets = _NOT_BRACKET.sub("", _JSON_STRING.sub("", _ESCAPE.sub("", text)))
+    if brackets.count("[") + brackets.count("{") <= limit:
+        return False
+    return max(accumulate(map(_STEP.__getitem__, brackets))) > limit
+
+
+def loads(text: str | bytes, limit: int = MAX_DEPTH) -> Any:
+    """``json.loads`` for text a peer or the relay controls: UTF-8 only, and
+    nested at most ``limit`` levels, checked before the parser runs
+    (:func:`json_too_deep`). Raises ``ValueError``."""
+    if isinstance(text, bytes | bytearray):
+        text = bytes(text).decode("utf-8")
+    if json_too_deep(text, limit):
+        msg = "JSON nested too deep"
+        raise ValueError(msg)
+    return json.loads(text)
+
+
+def parse_inner(plaintext: bytes | str) -> dict[str, Any] | None:
+    """A received inner message (SPEC 7.2): a UTF-8 JSON object nested at
+    most :data:`MAX_DEPTH` levels, with no lone surrogate in any string or
+    key, else ``None``. JSON deeper than that is refused before it is
+    parsed (:func:`loads`), never an error."""
+    try:
+        inner = loads(plaintext)
+    except (ValueError, RecursionError):
+        return None
+    if not isinstance(inner, dict) or unsound(inner):
+        return None
+    return inner
+
+
+def valid_hop(value: Any) -> bool:
+    """Whether ``value`` is a SPEC 7.2 ``hop``: an integer from 0 to 2^32 - 1."""
+    return isinstance(value, int) and not isinstance(value, bool) and 0 <= value <= U32_MAX
+
+
+def _recipients_ok(value: Any) -> bool:
+    return isinstance(value, list) and len(value) <= MAX_RECIPIENTS
+
+
+def inner_problem(inner: dict[str, Any]) -> str | None:
+    """``malformed`` if ``inner`` breaks the SPEC 7.2 bounds that keep one
+    message from costing the receiver more than its size: nesting past
+    :data:`MAX_DEPTH`, a ``hop`` outside a u32, a ``to`` that isn't a list of
+    at most :data:`MAX_RECIPIENTS` strings of at most
+    :data:`MAX_RECIPIENT_LEN` characters, or an ``addressee`` list longer than
+    that or with a longer string, or a lone surrogate in any string or key
+    (:func:`unsound`). (Any other ``addressee`` shape triggers nobody, SPEC
+    9.3.)"""
+    if not valid_hop(inner.get("hop", 0)):
+        return "malformed"
+    to = inner.get("to", ["*"])
+    if not _recipients_ok(to) or not all(
+        isinstance(r, str) and len(r) <= MAX_RECIPIENT_LEN for r in to
+    ):
+        return "malformed"
+    addressee = inner.get("addressee")
+    if isinstance(addressee, list) and (
+        not _recipients_ok(addressee)
+        or any(isinstance(r, str) and len(r) > MAX_RECIPIENT_LEN for r in addressee)
+    ):
+        return "malformed"
+    if unsound(inner):
+        return "malformed"
+    return None
+
+
+def _part_size(part: Any) -> int:
+    return len(json.dumps(part, sort_keys=True, separators=(",", ":")).encode())
+
+
+def content_problem(  # noqa: PLR0911
+    inner: dict[str, Any], size: int, limits: Limits = SPEC_LIMITS
+) -> str | None:
+    """Why ``inner`` (``size`` bytes of canonical JSON) breaks §10.2/§7.2
+    under ``limits``: ``unknown_kind``, ``too_large``, ``malformed`` (not
+    an object, past the bounds of :func:`inner_problem`, or a control, card
+    or cancel outside its strict schema, :mod:`agentconnect.schemas`),
+    ``part_kind`` or ``file_too_large``."""
+    kind = inner.get("kind")
+    if kind not in KNOWN_KINDS:
+        return "unknown_kind"
+    if size > limits.max_message_bytes:
+        return "too_large"
+    if inner_problem(inner) is not None:
+        return "malformed"
+    body = inner.get("body")
+    if not isinstance(body, dict) or not schema_ok(str(kind), body):
+        return "malformed"
+    allowed = ALLOWED_PARTS | {"file"} if limits.allow_files else ALLOWED_PARTS
+    for part in _parts_of(str(kind), body):
+        found = part_kind(part)
+        if found == "invalid":
+            return "malformed"
+        if found not in allowed:
+            return "part_kind"
+        if found == "file" and _part_size(part) > limits.max_file_bytes:
+            return "file_too_large"
+    return None
+
+
+MAX_DRAIN_EXEMPT = 1000  # rate-exempt messages per reconnect drain, all senders
+DRAIN_RATE_MULTIPLE = 2  # ...and per identity: 2 x its sender_per_minute
+
+
+class DrainBudget:
+    """How many messages of a reconnect drain (SPEC 8.2/10.2) skip the rates:
+    at most ``total`` per connection, and per sender at most what
+    :meth:`take` is given, so one peer's queued messages can't use up the
+    exemption."""
+
+    def __init__(self, total: int = MAX_DRAIN_EXEMPT) -> None:
+        self._total = total
+        self._used: dict[str, int] = {}
+
+    def reset(self) -> None:
+        """A new connection: a new drain."""
+        self._used.clear()
+
+    def take(self, sender: str, cap: int) -> bool:
+        """Count one exempt message from ``sender``; False when it is over
+        ``cap`` for that sender or the connection's total is spent."""
+        if sum(self._used.values()) >= self._total or self._used.get(sender, 0) >= cap:
+            return False
+        self._used[sender] = self._used.get(sender, 0) + 1
+        return True
+
+
+class RateLimiter:
+    """Sliding-window counts per sender instance, identity, group and task.
+
+    Each direction has its own windows (``direction`` is ``in`` for what
+    peers send to this member, ``out`` for what it sends), so a member's own
+    sends never use up the budget it grants its peers, and peer traffic
+    never stops its own sends.
+
+    The state is bounded: windows that emptied are swept away once the map
+    grows, and past :data:`MAX_KEYS` the least recently used are evicted.
+    """
+
+    def __init__(self, clock: Clock, max_keys: int = MAX_KEYS) -> None:
+        self._clock = clock
+        self._max_keys = max_keys
+        self._seen: OrderedDict[tuple[str, str], deque[float]] = OrderedDict()
+        self._sweep_at = SWEEP_FLOOR
+
+    def _now(self) -> float:
+        return self._clock.unix_millis() / 1000
+
+    def size(self) -> int:
+        """How many windows are tracked."""
+        return len(self._seen)
+
+    def _count(self, key: tuple[str, str], now: float) -> deque[float]:
+        times = self._seen.get(key)
+        if times is None:
+            times = self._seen[key] = deque[float]()
+        self._seen.move_to_end(key)
+        while times and times[0] <= now - WINDOW_SECS:
+            times.popleft()
+        return times
+
+    def _sweep(self, now: float) -> None:
+        if len(self._seen) <= self._sweep_at:
+            return
+        for key in [k for k, t in self._seen.items() if not t or t[-1] <= now - WINDOW_SECS]:
+            del self._seen[key]
+        while len(self._seen) > self._max_keys:
+            self._seen.popitem(last=False)
+        self._sweep_at = max(SWEEP_FLOOR, 2 * len(self._seen))
+
+    def forget_group(self, group_id: str) -> None:
+        for key in [k for k in self._seen if k[0] == group_id]:
+            del self._seen[key]
+
+    def _windows(
+        self, group_id: str, sender: str, identity: str | None, limits: Limits, direction: str
+    ) -> list[tuple[deque[float], int]]:
+        now = self._now()
+        windows = [
+            (self._count((group_id, f"{direction}\0{sender}"), now), limits.sender_per_minute),
+            (self._count((group_id, f"{direction}\0group"), now), limits.group_per_minute),
+        ]
+        if identity is not None:
+            cap = limits.sender_per_minute * limits.identity_rate_multiple
+            windows.append((self._count((group_id, f"{direction}\0id\0{identity}"), now), cap))
+        return windows
+
+    @staticmethod
+    def _take(windows: list[tuple[deque[float], int]], now: float) -> bool:
+        if any(len(times) >= limit for times, limit in windows):
+            return False
+        for times, _limit in windows:
+            times.append(now)
+        return True
+
+    def allow(
+        self,
+        group_id: str,
+        sender: str,
+        limits: Limits = SPEC_LIMITS,
+        *,
+        identity: str | None = None,
+        direction: str = "in",
+    ) -> bool:
+        """Count one message from ``sender`` (an instance); False if it is
+        over a limit (and then it doesn't count). With ``identity``, all
+        instances of that identity together are also held to
+        ``identity_rate_multiple`` times the per-sender rate."""
+        now = self._now()
+        ok = self._take(self._windows(group_id, sender, identity, limits, direction), now)
+        self._sweep(now)
+        return ok
+
+    def allow_inner(  # noqa: PLR0913
+        self,
+        group_id: str,
+        sender: str,
+        kind: Any,
+        body: Any,
+        limits: Limits = SPEC_LIMITS,
+        *,
+        identity: str | None = None,
+        direction: str = "in",
+        requested: bool = True,
+    ) -> bool:
+        """Count one inner message against its budget (SPEC 10.2).
+
+        A task update that isn't ``requested`` (it answers no message this
+        instance sent, SPEC 9.3) counts against the message rates, in windows
+        of its own: it never triggers the agent, and an honest task for
+        another member mustn't use up its sender's messages. Any other
+        task update counts against its task's budget (per sender instance),
+        against all of the identity's task updates (``identity_rate_multiple``
+        times the task budget) and against the group's
+        (``group_task_per_minute``). The first update of a task in the window
+        also counts as an ordinary message. Anything else counts against the
+        message rates."""
+        if kind in TASK_UPDATE_KINDS and not requested:
+            return self.allow(
+                group_id, sender, limits, identity=identity, direction=f"{direction}\0context"
+            )
+        task = body.get("taskId") if kind in TASK_UPDATE_KINDS and isinstance(body, dict) else None
+        if not isinstance(task, str) or not 0 < len(task) <= MAX_TASK_ID:
+            return self.allow(group_id, sender, limits, identity=identity, direction=direction)
+        now = self._now()
+        prefix = f"{direction}\0task"
+        windows = [
+            (self._count((group_id, f"{prefix}\0{sender}\0{task}"), now), limits.task_per_minute),
+            (self._count((group_id, f"{prefix}\0group"), now), limits.group_task_per_minute),
+        ]
+        if identity is not None:
+            cap = limits.task_per_minute * limits.identity_rate_multiple
+            windows.append((self._count((group_id, f"{prefix}\0id\0{identity}"), now), cap))
+        if not windows[0][0]:
+            # A task new in this window opens with an ordinary message.
+            windows += self._windows(group_id, sender, identity, limits, direction)
+        ok = self._take(windows, now)
+        self._sweep(now)
+        return ok

agentconnect/log.py

@@ -0,0 +1,143 @@
+"""Structured JSON logging that can't leak message content.
+
+Rules (AGENTS.md): never log message bodies, keys, secrets or invite URLs.
+Identifiers (group ids, mailbox ids, identities, msg_ids) are logged only as
+:func:`hid` tags.
+
+Every logger from :func:`get` runs one fixed processor chain, whatever the
+embedding application did to structlog's global configuration (the default
+console renderer prints each frame's local variables with a traceback, and
+those locals are envelopes, plaintext and secrets). The chain:
+
+* drops events below the level set by :func:`configure` (INFO by default);
+* replaces the value of any field whose name suggests content
+  (:data:`REDACTED_FIELDS`) with ``"[redacted]"``;
+* renders exceptions as a plain traceback: file, line and source text, never
+  local variables;
+* writes one JSON object per line to ``sys.stderr`` (looked up per event).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+import sys
+import traceback
+from collections.abc import MutableMapping
+from typing import Any
+
+import structlog
+
+EventDict = MutableMapping[str, Any]
+
+REDACTED_FIELDS = frozenset(
+    {
+        "body",
+        "card",
+        "ct",
+        "delivery",
+        "env",
+        "frame",
+        "inner",
+        "key",
+        "payload",
+        "plaintext",
+        "raw",
+        "request",
+        "secret",
+        "sig",
+        "text",
+        "token",
+        "url",
+    }
+)
+
+_LEVELS = {
+    "debug": logging.DEBUG,
+    "info": logging.INFO,
+    "warning": logging.WARNING,
+    "warn": logging.WARNING,
+    "error": logging.ERROR,
+    "exception": logging.ERROR,
+    "critical": logging.CRITICAL,
+    "fatal": logging.CRITICAL,
+}
+_state = {"level": logging.INFO}
+
+
+def hid(value: str | bytes | None) -> str:
+    """A short, stable tag for an identifier: the first 8 hex of SHA-256."""
+    if value is None:
+        return "-"
+    raw = value.encode() if isinstance(value, str) else value
+    return hashlib.sha256(raw).hexdigest()[:8]
+
+
+def _filter(_logger: Any, method: str, event: EventDict) -> EventDict:
+    if _LEVELS.get(method, logging.INFO) < _state["level"]:
+        raise structlog.DropEvent
+    return event
+
+
+def _redact(_logger: Any, _method: str, event: EventDict) -> EventDict:
+    for k in event:
+        if k in REDACTED_FIELDS:
+            event[k] = "[redacted]"
+    return event
+
+
+def _exc_info(_logger: Any, method: str, event: EventDict) -> EventDict:
+    """Plain tracebacks only (no locals, no rich rendering)."""
+    exc = event.pop("exc_info", None)
+    if method == "exception" and exc is None:
+        exc = True
+    if exc:
+        info = sys.exc_info() if exc is True else exc
+        if isinstance(info, BaseException):
+            info = (type(info), info, info.__traceback__)
+        if isinstance(info, tuple) and info[0] is not None:
+            event["exception"] = "".join(traceback.format_exception(*info))
+    return event
+
+
+def _render(_logger: Any, _method: str, event: EventDict) -> str:
+    return json.dumps(dict(event), default=str, sort_keys=True)
+
+
+PROCESSORS = [
+    _filter,
+    structlog.contextvars.merge_contextvars,
+    structlog.processors.add_log_level,
+    structlog.processors.TimeStamper(fmt="iso", utc=True),
+    _redact,
+    _exc_info,
+    _render,
+]
+
+
+class _Stderr:
+    """Writes each rendered line to the current ``sys.stderr``."""
+
+    def msg(self, message: str) -> None:
+        print(message, file=sys.stderr, flush=True)
+
+    debug = info = warning = warn = error = exception = critical = fatal = log = msg
+
+
+def configure(level: int = logging.INFO) -> None:
+    """Set the level (``agentconnect daemon run`` calls this at start), and
+    give stdlib logging (asyncio, httpx, websockets) a plain formatter, which
+    never prints local variables."""
+    _state["level"] = level
+    logging.basicConfig(
+        level=max(level, logging.WARNING),
+        stream=sys.stderr,
+        format="%(asctime)s %(levelname)s %(name)s %(message)s",
+    )
+
+
+def get(name: str) -> Any:
+    return structlog.wrap_logger(
+        _Stderr(), processors=PROCESSORS, wrapper_class=structlog.BoundLogger
+    ).bind(logger=name)

agentconnect/mcp/__init__.py

@@ -0,0 +1,30 @@
+"""The MCP host of the runtime (ADR-005): ``agentconnect mcp``.
+
+A stdio MCP server that an agent tool (Gemini CLI, Cursor and other MCP
+clients) starts per session. It runs the AgentConnect runtime in
+its own process when the data directory is free, or attaches to the runtime
+that holds it, so the user has nothing separate to run. Its tools are the
+agent-scope operations only; human decisions stay CLI commands with the
+human token. No tool exposes it, and an attached session reads ``api-token``
+only (docs/adapters/mcp.md).
+"""
+
+from agentconnect.mcp.backend import ToolError
+from agentconnect.mcp.server import (
+    McpServer,
+    StdioFds,
+    claim_stdio,
+    configure,
+    default_data_dir,
+    serve,
+)
+
+__all__ = [
+    "McpServer",
+    "StdioFds",
+    "ToolError",
+    "claim_stdio",
+    "configure",
+    "default_data_dir",
+    "serve",
+]