foodguidecanada 3.0.0__tar.gz

foodguidecanada-3.0.0/.dockerignore

@@ -0,0 +1,12 @@
+.git
+.github
+.venv
+.pytest_cache
+.ruff_cache
+__pycache__
+cache
+tests
+docs
+dist
+uv.lock
+*.sqlite

foodguidecanada-3.0.0/.github/workflows/ci.yml

@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Install dependencies
+        run: uv sync
+      - name: Lint
+        run: uv run ruff check .
+      - name: Test
+        run: uv run pytest -q -m "not live"
+      - name: Build
+        run: uv build
+      - name: Smoke test entry point
+        run: uv run foodguide --help
+
+  docker:
+    # Builds the image (it downloads the data-latest release) and runs it the way docker-compose.yml does:
+    # read-only, no capabilities, 512 MB. Then talks to it over HTTP like a real client.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: docker build -t foodguide-mcp .
+      - name: Run the container
+        run: |
+          docker run -d --name fg --read-only --tmpfs /tmp --cap-drop ALL \
+            --security-opt no-new-privileges:true --memory 512m \
+            -p 127.0.0.1:8000:8000 foodguide-mcp
+          for i in $(seq 1 40); do curl -fs -o /dev/null http://127.0.0.1:8000/mcp/ && break; sleep 2; done
+          curl -fsS -o /dev/null -w "GET /mcp/ -> %{http_code}\n" http://127.0.0.1:8000/mcp/
+      - name: Runs as a non-root user
+        run: test "$(docker exec fg id -u)" = "10001"
+      - name: Data is installed and verified
+        run: |
+          docker exec fg foodguide data status | tee status.txt
+          test "$(grep -c ': ok' status.txt)" -ge 5
+      - name: 24 tools over HTTP
+        run: |
+          uv run --with fastmcp python - <<'EOF'
+          import asyncio
+          from fastmcp import Client
+          async def main():
+              async with Client("http://127.0.0.1:8000/mcp") as c:
+                  n = len(await c.list_tools())
+                  print("tools:", n)
+                  assert n == 24, n
+                  r = await c.call_tool("search_and_get_cnf_macronutrients",
+                      {"input_data": {"food_name": "lentils", "session_id": "ci", "max_results": 2}})
+                  assert "Lentils" in str(r), r
+          asyncio.run(main())
+          EOF
+      - name: Container logs on failure
+        if: failure()
+        run: docker logs fg
+

foodguidecanada-3.0.0/.github/workflows/data-refresh.yml

@@ -0,0 +1,114 @@
+name: Data refresh
+
+# Rebuilds the datasets the CLI and MCP server read (CNF 2026 SQLite, recipes, DRI, EER) and
+# publishes them as assets of the `data-latest` release. Runs weekly; publishes only when the
+# content changed. `foodguide data fetch` installs from that release.
+
+on:
+  schedule:
+    - cron: "17 9 * * 1" # Mondays 09:17 UTC
+  pull_request: # dry run: builds and checks everything, never publishes
+    paths:
+      - ".github/workflows/data-refresh.yml"
+      - "scripts/check_manifest.py"
+      - "src/foodguide/pipeline/**"
+      - "src/foodguide/builders/**"
+  workflow_dispatch:
+    inputs:
+      force:
+        description: "Publish even if nothing changed"
+        type: boolean
+        default: false
+
+permissions:
+  contents: write # release assets
+  issues: write # failure report
+
+concurrency:
+  group: data-refresh
+  cancel-in-progress: false
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    env:
+      GH_TOKEN: ${{ github.token }}
+      TAG: data-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync
+
+      - name: Run the live test suite (full recipes crawl + snapshot comparisons)
+        run: uv run pytest -q -m live
+
+      - name: Fetch previous manifest
+        id: prev
+        run: |
+          mkdir -p prev
+          if gh release download "$TAG" -p manifest.json -D prev 2>/dev/null; then
+            echo "have=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "have=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build all datasets
+        run: uv run foodguide data build all --download-cnf --out-dir out
+
+      - name: Sanity-check the build
+        run: |
+          if [ "${{ steps.prev.outputs.have }}" = "true" ]; then
+            uv run python scripts/check_manifest.py out/manifest.json prev/manifest.json
+          else
+            uv run python scripts/check_manifest.py out/manifest.json
+          fi
+
+      - name: Did anything change?
+        id: changed
+        run: |
+          if [ "${{ steps.prev.outputs.have }}" != "true" ] || [ "${{ inputs.force }}" = "true" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"; exit 0
+          fi
+          set +e
+          uv run foodguide data changed prev/manifest.json out/manifest.json | tee changed.txt
+          code=${PIPESTATUS[0]}
+          set -e
+          if [ "$code" = "0" ]; then echo "changed=false" >> "$GITHUB_OUTPUT"
+          elif [ "$code" = "10" ]; then echo "changed=true" >> "$GITHUB_OUTPUT"
+          else exit "$code"; fi
+
+      - name: Publish release assets
+        if: steps.changed.outputs.changed == 'true' && github.event_name != 'pull_request'
+        run: |
+          if ! gh release view "$TAG" >/dev/null 2>&1; then
+            gh release create "$TAG" --title "Data (latest)" \
+              --notes "Datasets built by the Data refresh workflow. Install with: foodguide data fetch"
+          fi
+          rm -f out/*.zip
+          gh release upload "$TAG" out/* --clobber
+          gh release edit "$TAG" --notes "Built $(date -u +%FT%TZ) from workflow run ${{ github.run_id }}. Install with: foodguide data fetch"
+
+      - name: Summary
+        if: always()
+        run: |
+          {
+            echo "## Data refresh"
+            echo "Published: ${{ steps.changed.outputs.changed || 'not reached' }}"
+            [ -f changed.txt ] && { echo '```'; cat changed.txt; echo '```'; }
+            [ -f out/manifest.json ] && { echo '```json'; cat out/manifest.json; echo '```'; }
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Report failure
+        if: failure() && github.event_name != 'pull_request'
+        run: |
+          title="Data refresh failed"
+          url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          existing=$(gh issue list --state open --search "\"$title\" in:title" --json number --jq '.[0].number')
+          if [ -n "$existing" ]; then
+            gh issue comment "$existing" --body "Failed again: $url"
+          else
+            gh issue create --title "$title" --body "The scheduled data refresh failed: $url. Likely cause: a source page changed. The previous release is still in place."
+          fi

foodguidecanada-3.0.0/.github/workflows/release.yml

@@ -0,0 +1,91 @@
+name: Release
+
+# Push a tag like v3.0.0 (it must match the version in pyproject.toml). Builds the package, makes
+# a GitHub release with the wheel and sdist, and publishes to PyPI with trusted publishing
+# (no token: configure the "foodguidecanada" project's publisher on pypi.org once, see docs/RELEASING.md).
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv sync
+      - run: uv run ruff check .
+      - run: uv run pytest -q -m "not live"
+      - name: Tag matches the package version
+        run: |
+          v=$(uv run python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          [ "v$v" = "${GITHUB_REF_NAME}" ] || { echo "tag ${GITHUB_REF_NAME} != package version $v"; exit 1; }
+      - run: uv build
+      - run: uvx twine check dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  github-release:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - name: Release notes from CHANGELOG.md
+        run: |
+          v="${GITHUB_REF_NAME#v}"
+          awk -v v="$v" '$0 ~ "^## "v" " {f=1; next} /^## / {f=0} f' CHANGELOG.md > notes.md
+          [ -s notes.md ] || echo "Release $v" > notes.md
+      - name: Create the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          v="${GITHUB_REF_NAME#v}"
+          gh release create "$GITHUB_REF_NAME" dist/* --title "MCP${v%.*}" --notes-file notes.md
+
+  pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  docker:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Image tags
+        id: meta
+        run: |
+          v="${GITHUB_REF_NAME#v}"
+          repo=$(echo "ghcr.io/${GITHUB_REPOSITORY}" | tr '[:upper:]' '[:lower:]')
+          echo "tags=$repo:$v,$repo:latest" >> "$GITHUB_OUTPUT"
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}

foodguidecanada-3.0.0/.gitignore

@@ -0,0 +1,29 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+dist/
+build/
+
+# Tooling caches
+.pytest_cache/
+.ruff_cache/
+
+# Local databases (never commit)
+*.db
+*.sqlite
+*.sqlite3
+
+# Secrets / local env
+.env
+.env.*
+
+# Scrape caches and logs
+cache/
+logs/
+uv.lock
+
+# macOS
+.DS_Store

foodguidecanada-3.0.0/CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+## 3.0.0 (2026-11-02)
+
+A rewrite around an installable package and offline data. The old `v2.0` was the MCP server alone.
+
+- **Package:** published as `foodguidecanada` (import name and commands stay `foodguide`): a typer CLI
+  (`foodguide`) and the MCP server (`foodguide-mcp`, install with the `mcp` extra). The CLI install is light (no pandas, no fastmcp).
+- **Offline data, no network at run time:** Canadian Nutrient File 2026 as SQLite (EN/FR full-text search),
+  the Food Guide recipes (141, from the new canada.ca pages), Health Canada DRI and EER tables.
+- **CLI:** `cnf`, `recipes`, `dri`, `eer`, `data` (build, status, fetch, manifest, changed).
+- **Data pipeline:** `foodguide data build all` plus a weekly GitHub Actions workflow that rebuilds the
+  datasets and publishes them to the `data-latest` release only when the content changed.
+- **MCP fixes:** state folder is created, session tables are created at startup, `list_filters` validates,
+  recipe tools work again against the local data.
+- **Tests:** no mocks. Real saved pages, local servers and real subprocesses; golden answer keys made by a
+  separate script.
+- **Breaking changes for MCP clients (recipes):**
+  - `search_recipes`: `max_pages` is replaced by `limit` (default 20); it returns an object
+    `{recipes, count, filters_applied, filters_ignored, ...}` instead of a list.
+  - `fruits`, `vegetables`, `proteins`, `whole_grains` and `appliances` filters no longer exist on the
+    new canada.ca pages; they are reported in `filters_ignored`. Use `search_text`, `meals` and
+    `collections`.
+  - `get_recipe`: the `url` argument is now `url_or_slug` (a slug or a canada.ca recipe URL).
+  - `list_filters` returns `{group: {tag: label}}`.
+  - CNF tools read the local SQLite database. Run `foodguide data fetch` (or `data build cnf`) first.
+- **Security default:** the MCP HTTP transport now listens on `127.0.0.1` (it was `0.0.0.0` with no
+  authentication). Use `--host` or `HOST` to expose it deliberately.
+- **Docker:** a `Dockerfile` and `docker-compose.yml` for the HTTP MCP server (pinned base image, non-root,
+  read-only, data baked in), and images published to GHCR on release.
+- **Removed:** the live scrapers of the old `food-guide.canada.ca` host and `uv.lock`.

foodguidecanada-3.0.0/CONTRIBUTING.md

@@ -0,0 +1,262 @@
+# Contributing to foodguide
+
+`foodguide` is a command-line tool and an MCP server for Canada's Food Guide data. It reads the
+Canadian Nutrient File (CNF) 2026, the Food Guide recipes, and the Health Canada DRI and EER
+tables. All data is read from local files at run time. The MCP server exposes 46 tools on the
+stdio transport.
+
+Bug fixes, docs and new features are welcome. This page says how to set up, test and change the
+code. For how the code fits together, read [IMPLEMENTATIONS.MD](IMPLEMENTATIONS.MD).
+
+## Setup
+
+You need Python 3.12 or newer, [uv](https://docs.astral.sh/uv/) and Git.
+
+```bash
+git clone https://github.com/Aryan-Jhaveri/mcp-foodguidecanada.git
+cd mcp-foodguidecanada
+uv sync
+uv run foodguide --help
+```
+
+`uv sync` installs the package in editable mode and the dev group. The dev group includes pytest,
+ruff and the `mcp` extra (`foodguidecanada[mcp]`), so the MCP server tests can run.
+
+Datasets are not in the repo. The CLI reads them from `~/.local/share/foodguide` (override with
+`FOODGUIDE_DATA_DIR`). Install them with `uv run foodguide data fetch`, or build them yourself
+(see "Change a dataset builder" below). The bundled DRI and EER JSON files in
+`src/foodguide/data/` are the fallback for those two datasets.
+
+## Workflow
+
+1. Make a branch: `git checkout -b feat/short-name` or `fix/short-name`.
+2. Change the code. Add or update a test.
+3. Run lint and the tests (below).
+4. Commit with a clear message: `feat:`, `fix:`, `docs:`, `refactor:`, `test:` or `perf:`.
+5. Push and open a pull request.
+
+## Lint
+
+```bash
+uv run ruff check .
+```
+
+Settings are in `pyproject.toml`: line length 100, rules E, F, W and I. E501 is ignored because
+older code has long data-table lines; keep new code under 100 characters.
+`src/foodguide/server.py` ignores E402 on purpose: it sets warning filters before it imports
+fastmcp.
+
+## Tests
+
+```bash
+uv run pytest -q -m "not live"   # what CI runs: fast, no internet needed
+uv run pytest -q -m live         # slow: fetches live canada.ca pages
+```
+
+- `-m "not live"` is the CI run (`.github/workflows/ci.yml`, after `ruff check .`).
+- `-m live` runs the full 141-page recipes crawl and the live DRI/EER snapshot comparisons. The
+  weekly data-refresh workflow (`.github/workflows/data-refresh.yml`) runs it too.
+- `FOODGUIDE_SKIP_LIVE_TESTS=1` skips the live DRI/EER snapshot comparisons
+  (`tests/test_dri_eer_snapshot.py`), even in a `-m live` run. It does not skip the live recipes
+  crawl.
+- Tests that start a local `http.server` skip cleanly in sandboxes that block loopback TCP
+  connections. They run in CI.
+- `tests/test_cnf_golden.py` needs the CNF 2026 zip. It skips if the zip is missing. Point it at
+  your copy with `FOODGUIDE_TEST_CNF_ZIP`. The live recipes test can use a folder of crawled
+  pages in `FOODGUIDE_TEST_RECIPE_CACHE`.
+
+### Tests: no mocks (project rule)
+
+We do **not** mock our tests. The suite runs against real inputs: real saved
+canada.ca pages (`tests/fixtures/pages/`, served by a real localhost
+`http.server` from the `pages_server` fixture), real files, a real SQLite
+database, real subprocess runs of the CLI, and answer keys
+(`tests/fixtures/golden_*.json`) produced by separate, independent scripts
+that share no code with the package. Never edit an answer key by hand.
+
+**Allowed**
+
+- `monkeypatch.setenv` / `monkeypatch.delenv` / `monkeypatch.chdir`. These set
+  the environment, they fake nothing. The production code reads all its
+  configuration points from the environment at call time
+  (`FOODGUIDE_DATA_DIR`, `FOODGUIDE_DB_FILE`, `FOODGUIDE_STATE_DIR`,
+  `FOODGUIDE_SOURCE_BASE_URL`, `FOODGUIDE_CKAN_PACKAGE_URL`,
+  `FOODGUIDE_RECIPES_CACHE_DIR`, `SOURCE_DATE_EPOCH`), so tests never need to
+  patch attributes.
+- A real `http.server.ThreadingHTTPServer` on 127.0.0.1 in a background thread
+  (`tests/pages_fixture.py`), including "broken" responses derived from real
+  pages (truncated HTML, a page with its Ingredients heading removed, HTTP 500).
+- Answer keys from independent scripts; build options such as
+  `data build recipes --max-recipes/--only` to work with a small fixture set.
+
+**Not allowed**
+
+- `unittest.mock`, `MagicMock`, `pytest`'s `patch`, and any
+  `monkeypatch.setattr` / `monkeypatch.setitem` on code under test or on
+  libraries (`requests`, `datetime`, builders, fetchers).
+- "Network is blocked" fixtures that swap `requests.Session.request` for a
+  raiser. Prove offline-ness instead with the static import check
+  (`tests/test_offline_modules.py`) and real subprocess runs with
+  `HTTP_PROXY`/`HTTPS_PROXY` pointed at a dead port
+  (`tests/test_offline_subprocess.py`).
+
+### Golden answer keys
+
+- `tests/fixtures/golden_cnf.json`: CNF foods, nutrient values and measures, taken straight from the
+  CNF 2026 zip. Used by `tests/test_cnf_golden.py`.
+- `tests/fixtures/golden_recipes.json`: recipe titles, ingredients, directions, times and servings.
+  Used by `tests/test_recipes_golden.py`.
+
+The tests compare CLI output against these keys. The keys are checked in. The generator scripts
+are **not** in this repo: they were written separately on purpose, so that they share no code with
+the package, and there is no command here that regenerates them. Do not edit the files by hand. If
+upstream data changes and a golden test fails, raise it in the pull request and regenerate the
+key with an independent script that reads the source directly (the CNF zip or the canada.ca
+pages), then commit the new key.
+
+## Add a CLI command
+
+The CLI is one typer app in `src/foodguide/cli.py`.
+
+- `app` is the root app. Each group is its own `typer.Typer` (`cnf_app`, `dri_app`, `eer_app`,
+  `recipes_app`, `data_app`, and `data_build_app` under `data_app`), attached with
+  `app.add_typer(...)`.
+- A command is a function with `@<group>_app.command("name")`.
+- The global `--format table|csv|json` option is the `OutputFormat` enum. It is stored in
+  `ctx.obj["format"]`. Commands also accept their own `--format` and fall back to the global one:
+  `fmt = format if format is not None else ctx.obj["format"]`.
+- **stdout is data only.** Print results with `typer.echo` (or `csv.writer(sys.stdout)`). Print
+  log lines, warnings and errors with `_log(message)`, which writes to stderr.
+- Exit codes: `raise typer.Exit(code=0)` on success, `1` on an error, `2` for bad usage. The
+  exception is `data changed`, which exits `10` when datasets differ.
+
+Steps:
+
+1. Add `@<group>_app.command("name")` in `src/foodguide/cli.py`, with a docstring and an example.
+2. Support the three output formats. Keep stdout data-only.
+3. Add a test in `tests/` that runs the command against real data (the CLI tests use
+   `typer.testing.CliRunner` or a real subprocess).
+4. Run `uv run ruff check .` and `uv run pytest -q -m "not live"`.
+5. Update the command list in README.md.
+
+## Add an MCP tool
+
+Tools are registered in `src/foodguide/server.py` through the `register_*` functions in
+`src/foodguide/db/` and `src/foodguide/api/`, with `@mcp.tool()`. Tools that need SQLite session
+state are only registered on the stdio transport. Add a test in `tests/` (see
+`tests/test_dri_eer_mcp.py` and `tests/test_recipes_mcp.py`).
+
+## Change a dataset builder
+
+Builders live here:
+
+- DRI and EER: `src/foodguide/builders/dri_eer.py`
+- CNF: `src/foodguide/cnf/builder.py` (reads the CNF zip from open.canada.ca)
+- Recipes: `src/foodguide/recipes/` (`fetch.py`, `parser.py`, `builder.py`)
+
+Rules for anything that fetches a page:
+
+- Send the identifying User-Agent
+  `foodguide-data-build/0.1 (+https://github.com/Aryan-Jhaveri/mcp-foodguidecanada)`. canada.ca
+  stalls plain `Mozilla/5.0` agents. Do not change it.
+- Wait at least 1 second between fetches (`PoliteFetcher`).
+- Retry with backoff on network errors and 5xx responses.
+- Build page URLs from `source_base_url()` in `src/foodguide/config.py`. It returns
+  `FOODGUIDE_SOURCE_BASE_URL`, default `https://www.canada.ca`. Tests use this to point the
+  builders at the local fixture server. Never hard-code the host.
+
+After you change a builder:
+
+```bash
+uv run foodguide data build dri          # or: eer, recipes, cnf, all
+uv run pytest -q -m "not live"
+```
+
+If the output changed, regenerate the golden key with its independent generator (see "Golden
+answer keys") and explain the change in the pull request. For a full build into a clean folder
+with a manifest, use `uv run foodguide data build all --out-dir out`. Use `--download-cnf` to
+download the CNF zip, or `--cnf-zip PATH`.
+
+## Code standards
+
+Follow the patterns already in `src/foodguide`. `uv run ruff check .` must pass.
+
+- **Type hints** on every function parameter and return value. Use `Optional[X]` for values that can be
+  `None`, and `List[...]` and `Dict[str, Any]` for collections.
+- **Docstrings:** a short module docstring at the top of each file, and a docstring on each public
+  function that says what it does and what it returns. MCP tool docstrings are the text the model
+  reads, so write them for the model: say when to use the tool and what the arguments mean.
+- **Comments:** use `#` for field explanations in dataclasses.
+- **Errors:** return a clear message instead of raising into the client. MCP tools return
+  `{"error": "..."}`, and CLI commands print the message to stderr and exit 1.
+
+```python
+def get_recipe(url_or_slug: str) -> Dict[str, Any]:
+    """Return one recipe by slug or canada.ca URL."""
+    try:
+        recipe = _get_source().get_recipe(url_or_slug)
+    except RuntimeError as exc:
+        return {"error": str(exc)}
+    if recipe is None:
+        return {"error": f"Recipe '{url_or_slug}' not found in local data."}
+    return recipe
+```
+
+- **Offline modules stay offline.** Code that runs when a user asks a question (CLI readers, MCP tools)
+  must not import `requests` or `urllib.request`. Only the builders and `data fetch` touch the network.
+  `tests/test_offline_modules.py` checks this.
+
+## Commit messages
+
+Use a short prefix and a clear sentence:
+
+- `feat:` new feature
+- `fix:` bug fix
+- `docs:` documentation
+- `refactor:` code change with no behaviour change
+- `test:` adding or fixing tests
+- `perf:` performance
+
+## Pull requests
+
+Before you open one:
+
+- `uv run ruff check .` passes.
+- `uv run pytest -q -m "not live"` passes.
+- Docs are updated if behaviour changed (README.md, IMPLEMENTATIONS.MD).
+- If you tested the MCP server, say which client and transport.
+
+A pull request should say what changed and why, the type of change (fix, feature, breaking, docs),
+how you tested it, and any issue it closes. Maintainers review within a few days.
+
+## Releases
+
+Maintainers cut releases. The steps (version bump, tag `vX.Y.Z`, PyPI trusted publishing) are in
+[docs/RELEASING.md](docs/RELEASING.md). The PyPI name is `foodguidecanada`. The import package and
+commands stay `foodguide` and `foodguide-mcp`.
+
+## Where help is wanted
+
+- **Fewer tool calls.** Merge `calculate_recipe_nutrition_summary` and `query_recipe_macros_table`,
+  and `store_recipe_in_temp_tables` and `simple_recipe_setup`, so a model needs fewer steps.
+- **Smaller files.** Split `db/cnf_tools.py` and move helpers into utility modules.
+- **Diagrams.** A Mermaid diagram of the data flow and of how the tools work together.
+- **More nutrition.** Micronutrients, vitamins and minerals in the DRI tables and the adequacy tools.
+- **Easier install.** A Dockerfile for the HTTP transport, Smithery or npm packaging.
+- **Ideas:** weekly meal planning, tracking ingredients in stock, personal nutrition goals, more
+  export formats.
+
+Check [IMPLEMENTATIONS.MD](IMPLEMENTATIONS.MD) for the current list before you start, and open an
+issue first for anything large.
+
+## Community
+
+Be respectful, collaborative, constructive and patient. Use GitHub Issues for bugs and feature
+requests, with clear titles and steps to reproduce. When you discuss nutrition behaviour, link the
+Health Canada page it comes from.
+
+## Data credits
+
+- Canadian Nutrient File 2026, Health Canada, under the Open Government Licence – Canada.
+- Food Guide recipes, Crown copyright, Health Canada.
+- Dietary Reference Intakes (DRI) and Estimated Energy Requirement (EER) tables, Health Canada.

foodguidecanada-3.0.0/Dockerfile

@@ -0,0 +1,39 @@
+# foodguidecanada MCP server over HTTP, with the datasets baked into the image.
+#
+#   docker build -t foodguide-mcp .
+#   docker run --rm -p 127.0.0.1:8000:8000 --read-only --tmpfs /tmp --memory 512m foodguide-mcp
+#   endpoint: http://127.0.0.1:8000/mcp
+#
+# Lessons from running containers on a real server: pinned base image, non-root user, read-only
+# root filesystem, a memory limit, published on loopback only (put TLS and auth in front for other
+# people), and no network at run time (the data is fetched once, at build time).
+#
+# python:3.12-slim-bookworm, pinned by digest (2026-11-02).
+FROM python:3.12-slim-bookworm@sha256:e697c81897302a4c4333bade000d98038fbb21eb064f8ee1fd42d02ebcd9d337
+
+LABEL org.opencontainers.image.source="https://github.com/Aryan-Jhaveri/mcp-foodguidecanada" \
+      org.opencontainers.image.description="Canada's Food Guide MCP server (HTTP) with offline data" \
+      org.opencontainers.image.licenses="MIT"
+
+# Which release of the datasets to bake in (the Data refresh workflow publishes them).
+ARG DATA_TAG=data-latest
+
+RUN useradd --create-home --uid 10001 app
+WORKDIR /src
+COPY pyproject.toml README.md LICENSE ./
+COPY src ./src
+RUN pip install --no-cache-dir '.[mcp]' && rm -rf /src
+
+USER app
+ENV FOODGUIDE_DATA_DIR=/home/app/data \
+    MCP_TRANSPORT=http \
+    HOST=0.0.0.0 \
+    PORT=8000 \
+    PYTHONUNBUFFERED=1
+# Downloads from GitHub over HTTPS and checks every file against the release manifest.
+RUN foodguide data fetch --tag "${DATA_TAG}" && foodguide data status | head -3
+
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s \
+  CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/mcp/', timeout=4).status == 200 else 1)"
+CMD ["foodguide-mcp"]