casper-network-mcp 0.1.0__tar.gz

casper_network_mcp-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,72 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Tests (${{ matrix.os }}, Python ${{ matrix.python }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        python: ["3.11", "3.13"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install
+        run: uv sync --locked
+      - name: Lint
+        run: uv run ruff check .
+      - name: Types
+        run: uv run mypy src/casper_network_mcp/core src/casper_network_mcp/access.py src/casper_network_mcp/router
+      - name: Generated files are current
+        run: |
+          uv run python scripts/build_manifests.py --check
+          uv run python scripts/build_index.py --check
+      - name: Tests (boundary, spec check, labels, find_tool bench, wheel)
+        run: uv run pytest -q
+      - name: Build
+        run: uv build
+
+  scrub:
+    name: Nothing personal, no RAG, no env files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Generic scrub greps
+        shell: bash
+        run: |
+          # Vendor documents (and the manifests built from them) are upstream bytes pinned by hash,
+          # so they are left out of the address and word checks. The boundary and wheel tests hold deny lists.
+          files() {
+            git ls-files -z -- . \
+              ':!:src/casper_network_mcp/specs/*.json' \
+              ':!:src/casper_network_mcp/openapi_gen/manifests/*.json' \
+              ':!:.github/**' ':!:uv.lock' ':!:tests/test_boundary.py' ':!:tests/test_specs_bundle.py' \
+              ':!:tests/test_wheel.py'
+          }
+          fail=0
+          check() {
+            if files | xargs -0 grep -nE $3 "$2"; then echo "::error::$1"; fail=1; fi
+          }
+          check "private (RFC 1918) address; use 192.0.2.x, 198.51.100.x or 203.0.113.x" \
+            '\b(10\.[0-9]+\.[0-9]+\.[0-9]+|172\.(1[6-9]|2[0-9]|3[01])\.[0-9]+\.[0-9]+|192\.168\.[0-9]+\.[0-9]+)\b'
+          check "home path" '/Users/|~/\.mist-lab'
+          check "env file loading" 'dotenv|load_dotenv'
+          check "RAG or scraper word" 'ingestion|scrape|playwright|lancedb|fastembed|ollama|milvus|\bredis\b' -i
+          check "browser identity" 'User-Agent.*(Safari|Mozilla)' -i
+          check "personal address" '@gmail|\.local\b'
+          exit $fail

casper_network_mcp-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,104 @@
+name: Release
+
+# A v* tag builds the wheel, writes the hash-locked install file, checks that file installs with
+# Casper's exact command on every supported system, then publishes those same files.
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.11"
+      - name: Tag matches the package version
+        shell: bash
+        run: |
+          version="$(uv run --frozen python -c 'import casper_network_mcp as m; print(m.__version__)')"
+          test "v${version}" = "${GITHUB_REF_NAME}"
+          echo "VERSION=${version}" >> "$GITHUB_ENV"
+      - name: Build
+        run: uv build
+      - name: Lock file from the built wheel
+        run: uv run --frozen python scripts/make_lock.py "$VERSION" --dist dist --out casper-network-mcp.lock.txt
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: actions/upload-artifact@v4
+        with:
+          name: lock
+          path: casper-network-mcp.lock.txt
+
+  check-lock:
+    needs: build
+    strategy:
+      fail-fast: true
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        python: ["3.11", "3.13"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: ${{ matrix.python }}
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - uses: actions/download-artifact@v4
+        with:
+          name: lock
+      - name: Install with Casper's command into an empty environment
+        shell: bash
+        run: |
+          uv venv --python "${{ matrix.python }}" "$RUNNER_TEMP/venv"
+          uv pip install --require-hashes --no-deps --only-binary :all: --find-links dist \
+            --python "$RUNNER_TEMP/venv/bin/python" -r casper-network-mcp.lock.txt
+      - name: Runs with no logins
+        shell: bash
+        working-directory: ${{ runner.temp }}
+        run: env -i PATH=/usr/bin:/bin HOME="$RUNNER_TEMP" "$RUNNER_TEMP/venv/bin/casper-network-mcp" --help
+
+  publish:
+    needs: [build, check-lock]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - name: Publish to PyPI (trusted publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  attach-lock:
+    needs: [publish]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: lock
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - name: Attach the lock file and wheel to the GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --title "$GITHUB_REF_NAME" \
+            --notes "Install with Casper, or: uv pip install --require-hashes --no-deps --only-binary :all: -r casper-network-mcp.lock.txt" \
+            casper-network-mcp.lock.txt dist/*

casper_network_mcp-0.1.0/.gitignore

@@ -0,0 +1,10 @@
+__pycache__/
+*.py[cod]
+.venv/
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.DS_Store

casper_network_mcp-0.1.0/.mcp.json.example

@@ -0,0 +1,9 @@
+{
+  "mcpServers": {
+    "casper-network-mcp-read-only": {
+      "type": "stdio",
+      "command": "uv",
+      "args": ["run", "--directory", "${workspaceFolder}", "casper-network-mcp", "--read-only"]
+    }
+  }
+}

casper_network_mcp-0.1.0/.python-version

@@ -0,0 +1 @@
+3.11

casper_network_mcp-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Choaterboater
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

casper_network_mcp-0.1.0/NOTICE.md

@@ -0,0 +1,202 @@
+# Notices
+
+casper-network-mcp's own code is under the MIT licence in `LICENSE`. The package also ships material that is not
+covered by that licence:
+
+- **HPE Aruba Networking's API documents** (30 New Central and 16 ClearPass OpenAPI documents in
+  `src/casper_network_mcp/specs/`). They are proprietary HPE material, not open source. Section A and C below say
+  on what basis they are redistributed.
+- **Juniper Mist's OpenAPI document** (`mist.openapi.json`), under the MIT licence reproduced in section B below.
+- **Files built from those documents**: the generated tool lists in
+  `src/casper_network_mcp/openapi_gen/manifests/` and find_tool's word index in
+  `src/casper_network_mcp/router/index.json` hold operation ids, paths, parameter names, and the operation and
+  parameter summaries and full descriptions, taken word for word from the documents. What came from HPE's
+  documents stays under the terms in sections A and C; what came from Mist's document stays under section B's MIT
+  licence. Removing a document (sections A and C) therefore also means removing its entries from those files: after
+  deleting the document and its `specs/MANIFEST.json` entry from `specs/`, and its pins from `scripts/spec_pins.json`, run
+  `scripts/build_manifests.py` and `scripts/build_index.py` and commit what they write. The tests that compare
+  the generated tools with the bundled documents, and `lookup_api`, then cover only the documents that are left.
+- **Code adapted from other MIT projects**: see `THIRD_PARTY_NOTICES.md`.
+
+The rest of this file is `src/casper_network_mcp/specs/NOTICE.md`, word for word (a test keeps the two the same).
+
+---
+
+# Third-party notice — bundled OpenAPI documents
+
+`casper_network_mcp/specs/` holds **47 OpenAPI documents from two upstreams under
+two different licensing regimes.** They are not interchangeable, and the
+difference matters if you redistribute this package.
+
+| Files | Upstream | Licence | Section |
+| --- | --- | --- | --- |
+| 30 New Central documents (everything except `mist.openapi.json` and `clearpass-*.json`) | HPE Aruba Networking developer portal | **Proprietary HPE material. Not open source.** | [A](#a--the-30-new-central-documents) |
+| `mist.openapi.json` | `mistsys/mist_openapi` on GitHub | **MIT** — full text reproduced below | [B](#b--mistopenapijson) |
+| 16 ClearPass documents (`clearpass-*.json`) | HPE Aruba Networking developer portal | **Proprietary HPE material. Not open source.** | [C](#c--the-16-clearpass-documents) |
+
+Every file is stored as the exact bytes the upstream served. `MANIFEST.json`
+beside this file records, for each one, the URL actually fetched, the date,
+the SHA-256 of those bytes and the number of API paths.
+`scripts/refresh_specs.py` fetches them again; `--check` re-fetches and
+confirms every hash without writing anything.
+
+---
+
+## A — the 30 New Central documents
+
+### What they are
+
+30 OpenAPI 3.x documents describing the HPE Aruba Networking **New Central**
+REST API — 779 API paths in total. They are the API descriptions the
+developer portal itself serves to render its reference pages. They are **not**
+documentation we wrote, and they are not derived, summarised or regenerated:
+each file is the upstream document byte for byte.
+
+### Who publishes them, and where they came from
+
+Hewlett Packard Enterprise / Aruba Networking, at
+<https://developer.arubanetworks.com/>. The portal runs on ReadMe, and each
+reference page points at an API-registry document.
+
+They were fetched from HPE's public developer-portal API registry by
+`scripts/refresh_specs.py`, straight from
+`https://dash.readme.com/api/v1/api-registry/<registry_id>`, which needs no
+login. The script names this project in its User-Agent and sends no browser
+headers and no cookies. Each file's URL, date and sha256 are in
+MANIFEST.json; `reference_page` there is the developer-portal page the
+document backs. The registry ids are pinned in `scripts/spec_pins.json`.
+
+### Licence and redistribution basis
+
+**These 30 documents are proprietary HPE Aruba Networking material. They are
+not open source, and this repository's MIT licence does not extend to them.**
+
+HPE publishes them without an accompanying licence grant and without an
+authentication barrier, as the machine-readable form of public API reference
+documentation whose entire purpose is to be consumed by API clients. They are
+redistributed here verbatim, with attribution and provenance, so that
+`lookup_api` answers exact API questions from a clean clone with no network
+access — the same use the publisher intends, moved offline.
+
+This is a good-faith reliance on published-for-integration intent, not a
+licence. Specifically:
+
+- No warranty and no endorsement by HPE is claimed or implied.
+- "HPE", "Aruba", "Aruba Networking" and "New Central" are marks of Hewlett
+  Packard Enterprise, used here only to identify the API being described.
+- If HPE asks for these documents to be removed, remove them. Nothing outside
+  this directory depends on the files being *committed* —
+  `scripts/refresh_specs.py` reproduces them from the upstream portal, and
+  `scripts/spec_pins.json` keeps the pointers.
+
+Downstream users redistributing this repository inherit that position and
+should make their own assessment.
+
+---
+
+## B — `mist.openapi.json`
+
+### What it is
+
+One OpenAPI 3.1.0 document describing the entire **Juniper Mist** REST API —
+762 API paths, `info.version` `2610.1.0`. It is the upstream
+file byte for byte.
+
+### Who publishes it, and where it came from
+
+Mist Systems / Juniper Networks, at <https://github.com/mistsys/mist_openapi>.
+
+Pinned to commit
+[`79274e6cd85327ef51a9ab99a9c40a999d4b669a`](https://github.com/mistsys/mist_openapi/commit/79274e6cd85327ef51a9ab99a9c40a999d4b669a)
+and fetched by `scripts/refresh_specs.py` from the immutable raw URL
+
+```
+https://raw.githubusercontent.com/mistsys/mist_openapi/79274e6cd85327ef51a9ab99a9c40a999d4b669a/mist.openapi.json
+```
+
+A branch URL is deliberately not used: it changes under you, so it could not
+pin anything.
+
+### Licence
+
+MIT, per the `LICENSE` file at the pinned commit. Reproduced in full as MIT
+requires:
+
+```
+MIT License
+
+Copyright (c) 2020 Thomas Munzer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+Source: <https://raw.githubusercontent.com/mistsys/mist_openapi/79274e6cd85327ef51a9ab99a9c40a999d4b669a/LICENSE>.
+"Juniper", "Mist" and "Marvis" are marks of Juniper Networks, used here only to
+identify the API being described. No endorsement by Juniper is claimed.
+
+---
+
+## C — the 16 ClearPass documents
+
+### What they are
+
+16 OpenAPI 3.0 documents describing the HPE Aruba Networking **ClearPass
+Policy Manager** REST API (`info.version` 6.12.7) — 335 API paths in total.
+They are the API descriptions the developer portal itself serves to render
+its ClearPass reference pages. Like section A's files, each one is the
+upstream document byte for byte, not documentation we wrote. Their paths are
+relative to the ClearPass server's `/api` base.
+
+### Who publishes them, and where they came from
+
+Hewlett Packard Enterprise / Aruba Networking, at
+<https://developer.arubanetworks.com/cppm/reference>.
+
+They were fetched the same way as section A's files: by
+`scripts/refresh_specs.py`, straight from
+`https://dash.readme.com/api/v1/api-registry/<registry_id>`, which needs no
+login, with a User-Agent naming this project and no browser headers or
+cookies. Each file's URL, date and sha256 are in MANIFEST.json; the registry
+ids are pinned in `scripts/spec_pins.json` under `clearpass`.
+
+### Licence and redistribution basis
+
+**These 16 documents are proprietary HPE Aruba Networking material. They are
+not open source, and this repository's MIT licence does not extend to them.**
+
+HPE publishes them without an accompanying licence grant and without an
+authentication barrier, as the machine-readable form of public API reference
+documentation whose entire purpose is to be consumed by API clients. They are
+redistributed here verbatim, with attribution and provenance, so that
+`lookup_api` answers exact API questions from a clean clone with no network
+access — the same use the publisher intends, moved offline.
+
+This is a good-faith reliance on published-for-integration intent, not a
+licence. Specifically:
+
+- No warranty and no endorsement by HPE is claimed or implied.
+- "HPE", "Aruba", "Aruba Networking" and "ClearPass" are marks of Hewlett
+  Packard Enterprise, used here only to identify the API being described.
+- If HPE asks for these documents to be removed, remove them. Nothing outside
+  this directory depends on the files being *committed* —
+  `scripts/refresh_specs.py` reproduces them from the upstream portal, and
+  `scripts/spec_pins.json` keeps the pointers.
+
+Downstream users redistributing this repository inherit that position and
+should make their own assessment.

casper_network_mcp-0.1.0/PKG-INFO

@@ -0,0 +1,145 @@
+Metadata-Version: 2.5
+Name: casper-network-mcp
+Version: 0.1.0
+Summary: One small MCP router for HPE Aruba Networking Central, Juniper Mist and ClearPass, built for Casper.
+License-Expression: MIT AND LicenseRef-HPE-API-Documentation
+License-File: LICENSE
+License-File: NOTICE.md
+License-File: THIRD_PARTY_NOTICES.md
+License-File: src/casper_network_mcp/specs/NOTICE.md
+Requires-Python: >=3.11
+Requires-Dist: httpx<1,>=0.27
+Requires-Dist: mcp[cli]<3,>=2.0
+Requires-Dist: pyyaml<7,>=6
+Description-Content-Type: text/markdown
+
+# casper-network-mcp
+
+One small MCP server for HPE Aruba Networking Central, Juniper Mist and HPE Aruba Networking ClearPass, built for
+[Casper](https://github.com/Choaterboater/casper). Your AI sees four tools; behind them are about 3,900 tools for the
+three products, each one labelled with the kind of change it makes.
+
+You normally never install this yourself: Casper sets it up, pins the exact version and starts it for you.
+
+## What it does
+
+| Tool | What it is for |
+| --- | --- |
+| `find_tool` | Finds the right tool for what you asked ("bounce port 7 on the closet switch") and says what kind of change it makes: read, troubleshoot, config, disruptive, firmware, delete or admin. |
+| `invoke_read_tool` | Runs a tool that only reads, or a check that changes nothing. Anything else is refused. |
+| `invoke_tool` | Runs any tool, including ones that change your network. Casper asks you first. |
+| `access_check` | Says, for each product, whether a login is set and where that login can change things. |
+
+Behind them:
+
+- hand-written tools for everyday work (sites, clients, alarms, switch ports, guests, sessions, SSIDs, VLANs and
+  more), each one checked against the vendor's own API description;
+- one generated tool for every operation in the bundled API descriptions;
+- overview tools for broad questions: `central_site_overview`, `mist_site_overview` and `clearpass_overview` give
+  health, device counts and the top alarms in one read;
+- `lookup_api`, which answers exact questions about the vendors' APIs (endpoints, fields, allowed values) from the
+  bundled documents, with no network.
+
+## Running it
+
+```
+uvx --from casper-network-mcp==0.1.0 casper-network-mcp --read-only
+```
+
+| Option | Meaning |
+| --- | --- |
+| `--read-only` | Only read and run checks; never send a change. Read once at start: nothing turns writes on while it runs. Casper passes this until you allow changes. |
+| `--transport stdio` | The default: talk over standard input and output. |
+| `--transport http --port 8010` | Listen on this machine only (`127.0.0.1`). |
+
+From a checkout, `.mcp.json.example` starts it read-only with `uv run`; logins come from your shell.
+
+## Logins
+
+The server reads only these variables from the environment Casper starts it with. It reads no settings files.
+Leave out a product you do not use: the server still starts, `access_check` says that login is missing, and a call
+to one of its tools answers `{"error": "login_missing", "product": "..."}`.
+
+| Product | Variables |
+| --- | --- |
+| Juniper Mist | `MIST_API_TOKEN`, and `MIST_HOST` if your cloud is not `api.mist.com` |
+| HPE Aruba Networking Central | `CENTRAL_BASE_URL`, `CENTRAL_CLIENT_ID`, `CENTRAL_CLIENT_SECRET` |
+| HPE Aruba Networking ClearPass | `CLEARPASS_BASE_URL`, `CLEARPASS_API_TOKEN` |
+
+## Changes to your network
+
+There are no write switches. What a login may do is set by its role in the product, and Casper asks you before
+every change, showing the tool and what it changes. On top of that:
+
+- `--read-only` refuses every change before anything is sent;
+- a path piece that could reach somewhere else (`/`, `?`, `#`, `..`) is refused before anything is sent;
+- when the server knows a Mist login can only read a site, a change to that site is refused before anything is
+  sent;
+- tools that disrupt the network (reboots, port and PoE bounces, disconnects) are labelled disruptive, so Casper
+  asks every time;
+- tokens, passwords and pre-shared keys are hidden in replies and errors.
+
+The server never asks you to type anything and never treats an argument the AI sets as your approval. Approval is
+Casper's box only.
+
+## How well find_tool finds tools
+
+`find_tool` was measured on a fixed set of 60 plain questions (20 each for Central, Mist and ClearPass, in
+`tests/bench/find_tool_questions.yaml`), then tuned one change at a time. A change stayed only if it found more
+right tools in the top 3, or answered faster without finding fewer. Run `uv run python scripts/bench_find_tool.py`
+to measure it yourself.
+
+| | Right tool first | Right tool in top 3 | Top 3, no product given | Time per question (p50 / p95) | First question in a new process |
+| --- | --- | --- | --- | --- | --- |
+| Before | 67% | 77% | 68% | 0.6 / 1.6 ms | 3.4 s |
+| After | 85% | 100% | 90% | 0.6 / 2.0 ms | 0.4 s |
+
+What changed, in order:
+
+1. Synonyms (`router/synonyms.yaml`) and plural folding: "access point" finds `ap`, "kick" finds disconnect, "who is
+   on" finds clients. Top 3: 77% to 97%.
+2. Ranking by what the question asks: "what" and "show" prefer tools that read, "create", "delete" and "change"
+   prefer those changes; the product name in a tool's name no longer counts against it. Top 3: 97% to 98%, first
+   pick 75% to 87%. (Weighting name words over description words was tried and dropped: top 3 fell to 90-95%.)
+3. A prebuilt word index shipped in the package (`router/index.json`): the first question no longer loads every
+   tool. First question: 3.4 s to 0.4 s.
+4. Overview tools for broad questions (`central_site_overview`, `mist_site_overview`, `clearpass_overview`: health,
+   device counts and top alarms in one read) and `mist_list_site_clients` for "who is on the wifi". A synonym that
+   spreads into several words ("wifi" to wlan, ssid, wireless) now counts once. Top 3: 98% to 100%.
+
+Times are on a laptop with the router already loaded, except the last column.
+
+## What is in the package
+
+The package includes HPE's proprietary API documents (not MIT; see specs/NOTICE.md) and Juniper Mist's MIT
+OpenAPI file. They are stored exactly as the vendors serve them; `scripts/refresh_specs.py --check` fetches them
+again and confirms every hash. See `NOTICE.md` and `THIRD_PARTY_NOTICES.md`.
+
+The package has no install step, downloads nothing when it starts and never updates itself.
+
+## Working on it
+
+```
+uv sync
+uv run pytest -q
+uv run ruff check .
+uv run python scripts/bench_find_tool.py     # find_tool accuracy and speed
+uv run python scripts/build_manifests.py     # after the bundled specs change
+uv run python scripts/build_index.py         # after any tool changes
+```
+
+A release is built from a `v*` tag: the wheel, then `casper-network-mcp.lock.txt` (every dependency pinned by hash,
+plus this package pinned to the wheel's own hash, made by `scripts/make_lock.py`). The release checks that lock
+installs with Casper's exact command before publishing:
+
+```
+uv pip install --require-hashes --no-deps --only-binary :all: -r casper-network-mcp.lock.txt
+```
+
+## Security
+
+Report problems privately; see `SECURITY.md`.
+
+## Licence
+
+MIT for this project's code (`LICENSE`). The bundled vendor documents keep their own terms (`NOTICE.md`).