docker-mcp-server 2.2.0__tar.gz → 2.2.1__tar.gz

{docker_mcp_server-2.2.0 → docker_mcp_server-2.2.1}/.github/copilot-instructions.md

@@ -271,3 +271,5 @@ Changing this line to a later version of cryptography can break installs on Inte
 From version 49, cryptography no longer ships a universal2 macOS wheel; on Intel macOS the resolver typically falls back to a source build that requires a newer Rust toolchain and may fail.
 Changing to a later version of cryptography for other platforms is fine, but this pin should remain for macOS x86_64.
 Do not change this line. If a PR touches this line, please add a strong comment and do not allow the change to be merged without a strong justification and approval from the repo owner.
+
+There is also a major-version cap: `"mcp>=1.27.1,<2"`. mcp 2.0.0 (2026-07-28) removed `mcp.server.fastmcp`, which `server.py` imports `FastMCP` from — that surface moved to `mcp.server.mcpserver`, so 2.x is an API migration, not a bump. Premerge CI cannot see this: it installs `--locked`, so the lockfile's 1.x keeps every test green while a *fresh* resolve breaks at import. That is not hypothetical — the published 2.2.0 shipped uncapped and `uvx docker-mcp-server` failed at import on a clean machine, which 2.2.1 superseded. `tests/test_pyproject_pins.py` enforces the cap and also asserts that the module `server.py` imports `FastMCP` from is one the installed mcp actually provides. Treat a PR lifting this cap the same way as the cryptography pin: it needs the `mcp.server.mcpserver` port, not just a version bump.

{docker_mcp_server-2.2.0 → docker_mcp_server-2.2.1}/CLAUDE.md

@@ -55,6 +55,15 @@ non-required `Check docs mirror` job flags a PR that edits `CLAUDE.md` or
 `.github/copilot-instructions.md` without the other (see the MIRROR RULE above) — it's a prompt to
 double-check, not a merge blocker.
 
+**Two dependency caps exist because a fresh resolve can break what `--locked` CI cannot see**, both
+enforced by `tests/test_pyproject_pins.py`: `cryptography<49` on Intel macOS (49 dropped the
+universal2 wheel), and **`mcp<2`** — mcp 2.0.0 removed `mcp.server.fastmcp`, which `server.py` imports
+`FastMCP` from (it moved to `mcp.server.mcpserver`), so 2.x needs a port rather than a bump. The
+published 2.2.0 shipped uncapped and `uvx docker-mcp-server` was dead on arrival at import while every
+CI job stayed green, because CI installs `--locked` against a lockfile pinning mcp 1.x; 2.2.1
+superseded it. When adding a direct dependency whose *import surface* we touch, consider whether a
+major-version cap plus a pin guard belongs with it.
+
 A **weekly canary** (`.github/workflows/canary.yaml`, Mondays + dispatch) hunts platform/ecosystem
 drift premerge CI can't see: wheels-only (`--only-binary :all:`) dependency resolution for Intel
 macOS / ARM macOS / Windows against both the repo `pyproject.toml` and the latest published PyPI

{docker_mcp_server-2.2.0 → docker_mcp_server-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: docker-mcp-server
-Version: 2.2.0
+Version: 2.2.1
 Summary: MCP server for managing Docker resources via the Docker SDK for Python
 Project-URL: Homepage, https://github.com/L337-org/docker-mcp
 Project-URL: Repository, https://github.com/L337-org/docker-mcp
@@ -22,7 +22,7 @@ Requires-Python: >=3.14
 Requires-Dist: cryptography<49; platform_system == 'Darwin' and platform_machine == 'x86_64'
 Requires-Dist: docker[ssh]>=7.1.0
 Requires-Dist: httpx>=0.28.1
-Requires-Dist: mcp>=1.27.1
+Requires-Dist: mcp<2,>=1.27.1
 Requires-Dist: requests>=2.26.0
 Description-Content-Type: text/markdown
 

{docker_mcp_server-2.2.0 → docker_mcp_server-2.2.1}/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.4",
   "name": "docker-mcp-server",
   "display_name": "Docker MCP Server",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "Manage Docker through the Docker SDK for Python and the docker CLI: containers, images, networks, volumes, Compose, Swarm, Buildx, Scout, and OCI registries, exposed as MCP tools.",
   "long_description": "Manage one or more Docker daemons through your AI agent — containers, images, networks, volumes, Compose, Swarm, Buildx, Scout, and OCI registries, exposed as MCP tools.\n\nDiscovery is automatic for your local socket with no configuration required. Or point it at additional remote daemons over TCP, TLS, or SSH (and mark any of them read-only to monitor without the risk of accidental changes). It also surfaces logs and stats as resources for triage. Read-only / no-destructive / disabled-domain switches let you register a restricted tool surface.\n\nAnswer questions like: ‘why did my local container crash?’, ‘is my production system under memory pressure?’, ‘what differences are there between my staging and production systems?’\n\nRuns entirely on your machine and sends no telemetry — see the Privacy Policy.",
   "author": {

{docker_mcp_server-2.2.0 → docker_mcp_server-2.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "docker-mcp-server"
-version = "2.2.0"
+version = "2.2.1"
 description = "MCP server for managing Docker resources via the Docker SDK for Python"
 readme = "README.md"
 license = "MIT"
@@ -24,7 +24,13 @@ dependencies = [
     # system `ssh` binary, so it works identically on the host and inside the container images.
     "docker[ssh]>=7.1.0",
     "httpx>=0.28.1",
-    "mcp>=1.27.1",
+    # Capped below 2: mcp 2.0.0 (2026-07-28) removed `mcp.server.fastmcp`, which `server.py`
+    # imports FastMCP from — that surface moved to `mcp.server.mcpserver`, so 2.x is an API
+    # migration rather than a bump. Without the cap a fresh resolve picks 2.x and `import
+    # docker_mcp` dies, which is exactly what happened to the published 2.2.0 (CI installs
+    # `--locked`, so the lockfile's 1.x kept every test green while `uvx docker-mcp-server`
+    # was dead on arrival). `tests/test_pyproject_pins.py` fails if this cap is lifted.
+    "mcp>=1.27.1,<2",
     # Pulled in transitively by docker, but we import requests.exceptions directly
     # (container_wait catches ReadTimeout), so declare it explicitly.
     "requests>=2.26.0",
@@ -89,6 +95,9 @@ addopts = "-m 'not integration'"
 
 [dependency-groups]
 dev = [
+    # Pulled in transitively by pytest, but tests/test_pyproject_pins.py parses PEP 508 requirement
+    # strings with it directly, so declare it — the same reasoning as `requests` above.
+    "packaging>=24.0",
     "pytest>=9.0.3",
     "pyright>=1.1.409",
     "ruff>=0.15.12",

docker_mcp_server-2.2.1/tests/test_pyproject_pins.py

@@ -0,0 +1,178 @@
+import json
+import re
+import tomllib
+from pathlib import Path
+
+import pytest
+from packaging.requirements import Requirement
+
+_ROOT = Path(__file__).resolve().parent.parent
+PYPROJECT = _ROOT / "pyproject.toml"
+MANIFEST = _ROOT / "manifest.json"
+UV_LOCK = _ROOT / "uv.lock"
+
+
+def _version_tuple(version: str, length: int = 4) -> tuple[int, ...]:
+    parts = [int(p) for p in version.split(".")]
+    parts += [0] * (length - len(parts))
+    return tuple(parts[:length])
+
+
+def _dependency_name(requirement: str) -> str:
+    match = re.match(r"[A-Za-z0-9][A-Za-z0-9._-]*", requirement)
+    assert match, f"could not parse a dependency name from {requirement!r}"
+    return match.group(0)
+
+
+def _admits(requirement: str, version: str) -> bool:
+    """
+    Whether a requirement's specifiers allow `version` to be installed.
+
+    This is the question the caps actually pose, and asking it directly avoids two mistakes a bound
+    comparison makes. Ordering: PEP 508 does not fix specifier order, so `mcp<2,>=1.27.1` must read the
+    same as `mcp>=1.27.1,<2`. Strictness: `<=2` *admits* 2.0.0 — the very release that cannot import —
+    yet compares equal to a `<2` bound, so a guard built on bounds passes it. `packaging` answers the
+    real question and handles markers, extras, `!=` and `~=` for free.
+
+    args:
+        requirement - a PEP 508 requirement string from pyproject's dependency list
+        version - the version to test, normally the first known-bad one
+    returns: bool - True if that version satisfies the requirement
+    """
+    return Requirement(requirement).specifier.contains(version)
+
+
+def test_intel_macos_cryptography_pin_not_relaxed():
+    """
+    Dependabot doesn't get an automatic Copilot review (bots aren't billable for
+    premium requests), so a bump here must be caught by a hard, deterministic
+    CI failure instead of relying on review. See the pyproject.toml comment:
+    cryptography>=49 dropped the macosx_10_9_universal2 wheel, breaking `uvx`
+    installs on Intel macOS.
+    """
+    data = tomllib.loads(PYPROJECT.read_text())
+    deps = data["project"]["dependencies"]
+
+    cryptography_deps = [d for d in deps if _dependency_name(d) == "cryptography"]
+    assert cryptography_deps, "no direct 'cryptography' dependency found in pyproject.toml"
+
+    intel_macos_deps = [
+        d for d in cryptography_deps if "platform_system == 'Darwin'" in d and "platform_machine == 'x86_64'" in d
+    ]
+    assert intel_macos_deps, (
+        "the Intel-macOS cryptography pin is missing: no 'cryptography' dependency is scoped to "
+        f"platform_system == 'Darwin' and platform_machine == 'x86_64'; found: {cryptography_deps!r}"
+    )
+    assert len(intel_macos_deps) == 1, f"expected exactly one Intel-macOS cryptography pin, found: {intel_macos_deps!r}"
+
+    dep = intel_macos_deps[0]
+    assert not _admits(dep, "49.0"), (
+        f"the Intel-macOS cryptography pin {dep!r} allows 49.0, which has no x86_64 macOS wheel — the "
+        "resolver then falls back to a source build needing a newer Rust toolchain than many users have. "
+        "See the pyproject.toml comment before lifting this cap."
+    )
+
+
+def test_mcp_major_cap_not_relaxed():
+    """
+    mcp 2.0.0 removed `mcp.server.fastmcp`, which `server.py` imports FastMCP from, so an
+    uncapped `mcp` resolves to a release that cannot import this package. That is not
+    hypothetical: the published 2.2.0 shipped uncapped and `uvx docker-mcp-server` failed at
+    import on a clean machine, while CI stayed green because it installs `--locked` against a
+    lockfile pinning 1.x. Lifting this cap needs the `mcp.server.mcpserver` migration first.
+    """
+    data = tomllib.loads(PYPROJECT.read_text())
+    deps = data["project"]["dependencies"]
+
+    mcp_deps = [d for d in deps if _dependency_name(d) == "mcp"]
+    assert mcp_deps, "no direct 'mcp' dependency found in pyproject.toml"
+    assert len(mcp_deps) == 1, f"expected exactly one 'mcp' dependency, found: {mcp_deps!r}"
+
+    dep = mcp_deps[0]
+    assert not _admits(dep, "2.0.0"), (
+        f"the mcp dependency {dep!r} allows 2.0.0, which removed `mcp.server.fastmcp` — `import "
+        "docker_mcp` then fails outright. Port `server.py` to `mcp.server.mcpserver` before lifting "
+        "this cap; note `<=2` allows 2.0.0 and so is not a cap."
+    )
+
+
+def test_the_declared_mcp_bound_matches_what_the_code_imports():
+    """
+    The cap and the import have to agree, and only one of them is in pyproject: assert the
+    module we import FastMCP from is the one the *locked* mcp actually provides. Catches a
+    lockfile that drifts past the cap as well as a cap raised without porting the import.
+    """
+    import importlib.util
+
+    from docker_mcp import server as server_module
+
+    source = Path(server_module.__file__).read_text(encoding="utf-8")
+    match = re.search(r"from (mcp[\w.]*) import FastMCP", source)
+    assert match, "server.py no longer imports FastMCP from an `mcp.*` module — update this guard"
+    assert importlib.util.find_spec(match.group(1)) is not None, (
+        f"server.py imports FastMCP from {match.group(1)!r}, which the installed mcp does not "
+        "provide — the pyproject cap and the code disagree"
+    )
+
+
+# The release pipeline's preflight job re-asserts these against the release tag; the tests
+# below catch the drift earlier, at PR time. server.json is intentionally NOT checked — its
+# committed version is stale by design and stamped from the tag at release time.
+
+
+def test_manifest_version_matches_pyproject():
+    """
+    manifest.json (the MCPB bundle manifest) is documented as kept in step with
+    pyproject.toml; the publish workflow restamps it from the tag, but drift in the repo
+    still confuses local bundle builds (scripts/build-mcpb.sh only warns).
+    """
+    pyproject_version = tomllib.loads(PYPROJECT.read_text())["project"]["version"]
+    manifest_version = json.loads(MANIFEST.read_text())["version"]
+    assert manifest_version == pyproject_version, (
+        f"manifest.json version {manifest_version!r} != pyproject.toml version {pyproject_version!r} — "
+        "bump them together"
+    )
+
+
+def test_uv_lock_self_version_matches_pyproject():
+    """
+    Catches "bumped pyproject.toml, forgot `uv lock`": the lockfile embeds this package's
+    own version, and a stale entry ships a lockfile that disagrees with the metadata.
+    """
+    pyproject_version = tomllib.loads(PYPROJECT.read_text())["project"]["version"]
+    packages = tomllib.loads(UV_LOCK.read_text())["package"]
+    self_entries = [
+        p for p in packages if p["name"] == "docker-mcp-server" and p.get("source", {}).get("editable") == "."
+    ]
+    assert len(self_entries) == 1, f"expected exactly one editable self-entry in uv.lock, found {len(self_entries)}"
+    lock_version = self_entries[0]["version"]
+    assert lock_version == pyproject_version, (
+        f"uv.lock self-entry version {lock_version!r} != pyproject.toml version {pyproject_version!r} — "
+        "run `uv lock` after bumping the version"
+    )
+
+
+@pytest.mark.parametrize(
+    ("requirement", "admits_two"),
+    [
+        # Specifier order is not guaranteed; these three declare the same real cap.
+        ("mcp>=1.27.1,<2", False),
+        ("mcp<2,>=1.27.1", False),
+        ("mcp<2", False),
+        # `<=2` reads like a cap and is not one: it admits 2.0.0, the release that cannot import.
+        ("mcp<=2", True),
+        ("mcp<=2.0.0", True),
+        # Uncapped, and a cap above the bad version — both states the guard must reject.
+        ("mcp>=1.27.1", True),
+        ("mcp>=1.27.1,<3", True),
+        # Markers and extras are the parser's problem, not the guard's.
+        ("mcp<2; python_version >= '3.14'", False),
+        ("mcp[ws]<2", False),
+    ],
+)
+def test_admits_answers_the_question_the_caps_actually_pose(requirement, admits_two):
+    """
+    A guard is only as good as its predicate. `<=2` is the case a bound comparison gets wrong, and a
+    guard that cries wolf on a reordered specifier gets disabled — so both are pinned here.
+    """
+    assert _admits(requirement, "2.0.0") is admits_two

{docker_mcp_server-2.2.0 → docker_mcp_server-2.2.1}/uv.lock

@@ -282,7 +282,7 @@ ssh = [
 
 [[package]]
 name = "docker-mcp-server"
-version = "2.2.0"
+version = "2.2.1"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography", marker = "platform_machine == 'x86_64' and sys_platform == 'darwin'" },
@@ -294,6 +294,7 @@ dependencies = [
 
 [package.dev-dependencies]
 dev = [
+    { name = "packaging" },
     { name = "pre-commit" },
     { name = "pyright" },
     { name = "pytest" },
@@ -305,12 +306,13 @@ requires-dist = [
     { name = "cryptography", marker = "platform_machine == 'x86_64' and sys_platform == 'darwin'", specifier = "<49" },
     { name = "docker", extras = ["ssh"], specifier = ">=7.1.0" },
     { name = "httpx", specifier = ">=0.28.1" },
-    { name = "mcp", specifier = ">=1.27.1" },
+    { name = "mcp", specifier = ">=1.27.1,<2" },
     { name = "requests", specifier = ">=2.26.0" },
 ]
 
 [package.metadata.requires-dev]
 dev = [
+    { name = "packaging", specifier = ">=24.0" },
     { name = "pre-commit", specifier = ">=4.6.0" },
     { name = "pyright", specifier = ">=1.1.409" },
     { name = "pytest", specifier = ">=9.0.3" },

docker_mcp_server-2.2.0/tests/test_pyproject_pins.py

@@ -1,93 +0,0 @@
-import json
-import re
-import tomllib
-from pathlib import Path
-
-_ROOT = Path(__file__).resolve().parent.parent
-PYPROJECT = _ROOT / "pyproject.toml"
-MANIFEST = _ROOT / "manifest.json"
-UV_LOCK = _ROOT / "uv.lock"
-
-
-def _version_tuple(version: str, length: int = 4) -> tuple[int, ...]:
-    parts = [int(p) for p in version.split(".")]
-    parts += [0] * (length - len(parts))
-    return tuple(parts[:length])
-
-
-def _dependency_name(requirement: str) -> str:
-    match = re.match(r"[A-Za-z0-9][A-Za-z0-9._-]*", requirement)
-    assert match, f"could not parse a dependency name from {requirement!r}"
-    return match.group(0)
-
-
-def test_intel_macos_cryptography_pin_not_relaxed():
-    """
-    Dependabot doesn't get an automatic Copilot review (bots aren't billable for
-    premium requests), so a bump here must be caught by a hard, deterministic
-    CI failure instead of relying on review. See the pyproject.toml comment:
-    cryptography>=49 dropped the macosx_10_9_universal2 wheel, breaking `uvx`
-    installs on Intel macOS.
-    """
-    data = tomllib.loads(PYPROJECT.read_text())
-    deps = data["project"]["dependencies"]
-
-    cryptography_deps = [d for d in deps if _dependency_name(d) == "cryptography"]
-    assert cryptography_deps, "no direct 'cryptography' dependency found in pyproject.toml"
-
-    intel_macos_deps = [
-        d for d in cryptography_deps if "platform_system == 'Darwin'" in d and "platform_machine == 'x86_64'" in d
-    ]
-    assert intel_macos_deps, (
-        "the Intel-macOS cryptography pin is missing: no 'cryptography' dependency is scoped to "
-        f"platform_system == 'Darwin' and platform_machine == 'x86_64'; found: {cryptography_deps!r}"
-    )
-    assert len(intel_macos_deps) == 1, f"expected exactly one Intel-macOS cryptography pin, found: {intel_macos_deps!r}"
-
-    dep = intel_macos_deps[0]
-    m = re.search(r"cryptography\s*<\s*([0-9]+(?:\.[0-9]+)*)", dep)
-    assert m, f"cryptography pin must use a '<N[.N...]' upper bound, got: {dep!r}"
-
-    bound = _version_tuple(m.group(1))
-    max_allowed = _version_tuple("49")
-    assert bound <= max_allowed, (
-        f"cryptography upper bound raised to {m.group(1)} — 49.x has no x86_64 macOS wheel; "
-        "see the pyproject.toml comment before lifting this cap"
-    )
-
-
-# The release pipeline's preflight job re-asserts these against the release tag; the tests
-# below catch the drift earlier, at PR time. server.json is intentionally NOT checked — its
-# committed version is stale by design and stamped from the tag at release time.
-
-
-def test_manifest_version_matches_pyproject():
-    """
-    manifest.json (the MCPB bundle manifest) is documented as kept in step with
-    pyproject.toml; the publish workflow restamps it from the tag, but drift in the repo
-    still confuses local bundle builds (scripts/build-mcpb.sh only warns).
-    """
-    pyproject_version = tomllib.loads(PYPROJECT.read_text())["project"]["version"]
-    manifest_version = json.loads(MANIFEST.read_text())["version"]
-    assert manifest_version == pyproject_version, (
-        f"manifest.json version {manifest_version!r} != pyproject.toml version {pyproject_version!r} — "
-        "bump them together"
-    )
-
-
-def test_uv_lock_self_version_matches_pyproject():
-    """
-    Catches "bumped pyproject.toml, forgot `uv lock`": the lockfile embeds this package's
-    own version, and a stale entry ships a lockfile that disagrees with the metadata.
-    """
-    pyproject_version = tomllib.loads(PYPROJECT.read_text())["project"]["version"]
-    packages = tomllib.loads(UV_LOCK.read_text())["package"]
-    self_entries = [
-        p for p in packages if p["name"] == "docker-mcp-server" and p.get("source", {}).get("editable") == "."
-    ]
-    assert len(self_entries) == 1, f"expected exactly one editable self-entry in uv.lock, found {len(self_entries)}"
-    lock_version = self_entries[0]["version"]
-    assert lock_version == pyproject_version, (
-        f"uv.lock self-entry version {lock_version!r} != pyproject.toml version {pyproject_version!r} — "
-        "run `uv lock` after bumping the version"
-    )