mcp-github-crunchtools 2.0.0__tar.gz → 2.0.1__tar.gz

{mcp_github_crunchtools-2.0.0 → mcp_github_crunchtools-2.0.1}/.github/workflows/constitution.yml

@@ -18,4 +18,4 @@ permissions:
 jobs:
   constitution:
     name: Constitution
-    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.27.0
+    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.28.0

{mcp_github_crunchtools-2.0.0 → mcp_github_crunchtools-2.0.1}/.github/workflows/dependabot-automerge.yml

@@ -15,4 +15,4 @@ permissions:
 jobs:
   automerge:
     name: Dependabot
-    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.27.0
+    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.28.0

mcp_github_crunchtools-2.0.1/.github/workflows/security.yml

@@ -0,0 +1,68 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Run every Monday at 9 AM UTC
+    - cron: "0 9 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+  security-events: write
+
+jobs:
+  dependency-audit:
+    name: Dependency CVE Scan
+    permissions:
+      contents: read
+      issues: write
+    uses: crunchtools/constitution/.github/workflows/dependency-audit.yml@v1.28.0
+
+  container-scan:
+    name: Container Security Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Build container image
+        run: |
+          docker build -f Containerfile -t mcp-github:scan .
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: "mcp-github:scan"
+          format: "sarif"
+          output: "trivy-results.sarif"
+          severity: "CRITICAL,HIGH"
+
+      - name: Upload Trivy scan results
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: "trivy-results.sarif"
+
+  codeql:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: python
+          queries: security-extended
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:python"

{mcp_github_crunchtools-2.0.0 → mcp_github_crunchtools-2.0.1}/.pre-commit-config.yaml

@@ -12,7 +12,7 @@ repos:
         types: [python]
         stages: [pre-commit, pre-merge-commit]
   - repo: https://github.com/crunchtools/constitution
-    rev: v1.27.0
+    rev: v1.28.0
     hooks:
       - id: validate-constitution
 

{mcp_github_crunchtools-2.0.0 → mcp_github_crunchtools-2.0.1}/.specify/memory/constitution.md

@@ -4,7 +4,7 @@
 > **Ratified:** 2026-06-14
 > **Amended:** 2026-10-14
 > **Status:** Active
-> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.27.0
+> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.28.0
 > **Profile:** MCP Server
 
 This file holds what is specific to mcp-github. The fleet rules and the MCP

{mcp_github_crunchtools-2.0.0 → mcp_github_crunchtools-2.0.1}/CHANGELOG.md

@@ -6,6 +6,13 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [2.0.1] - 2026-10-31
+
+### Security
+
+- Upgraded locked dependencies within their declared ranges to clear the
+  advisories the fleet dependency audit found (anyio, authlib, cryptography, dnspython, joserfc, opentelemetry-api, pydantic-settings, pyjwt).
+
 ## [2.0.0] - 2026-10-30
 
 ### Changed

{mcp_github_crunchtools-2.0.0 → mcp_github_crunchtools-2.0.1}/Containerfile

@@ -27,7 +27,7 @@ FROM quay.io/hummingbird/python:3.14
 
 # Labels for container metadata
 LABEL name="mcp-github-crunchtools" \
-      version="2.0.0" \
+      version="2.0.1" \
       summary="Secure MCP server for GitHub issues, pull requests, Actions, releases, files, and search" \
       description="A security-focused MCP server for GitHub built on Red Hat UBI" \
       maintainer="crunchtools.com" \

{mcp_github_crunchtools-2.0.0 → mcp_github_crunchtools-2.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcp-github-crunchtools
-Version: 2.0.0
+Version: 2.0.1
 Summary: Secure MCP server for GitHub issues, pull requests, Actions, releases, files, and search
 Author: crunchtools.com
 License-Expression: AGPL-3.0-or-later

{mcp_github_crunchtools-2.0.0 → mcp_github_crunchtools-2.0.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcp-github-crunchtools"
-version = "2.0.0"
+version = "2.0.1"
 description = "Secure MCP server for GitHub issues, pull requests, Actions, releases, files, and search"
 requires-python = ">=3.10"
 license = "AGPL-3.0-or-later"

{mcp_github_crunchtools-2.0.0 → mcp_github_crunchtools-2.0.1}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/crunchtools/mcp-github",
     "source": "github"
   },
-  "version": "2.0.0",
+  "version": "2.0.1",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "mcp-github-crunchtools",
-      "version": "2.0.0",
+      "version": "2.0.1",
       "transport": {
         "type": "stdio"
       }

{mcp_github_crunchtools-2.0.0 → mcp_github_crunchtools-2.0.1}/src/mcp_github_crunchtools/__init__.py

@@ -29,7 +29,7 @@ import argparse
 
 from .server import mcp
 
-__version__ = "2.0.0"
+__version__ = "2.0.1"
 __all__ = ["main", "mcp"]
 
 

{mcp_github_crunchtools-2.0.0 → mcp_github_crunchtools-2.0.1}/src/mcp_github_crunchtools/server.py

@@ -46,7 +46,7 @@ READ_ONLY = {"readOnlyHint": True}
 
 mcp = FastMCP(
     name="mcp-github",
-    version="2.0.0",
+    version="2.0.1",
     instructions=(
         "Secure MCP server for GitHub repositories: issues, pull requests "
         "(open, review discussion, diffs, CI checks, merge), Actions runs and "