mcp-latchpoint 0.1.0__tar.gz

mcp_latchpoint-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,41 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python-version: ["3.11", "3.13"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install -e ".[dev]"
+      - run: pytest --cov=mcp_latchpoint --cov-report=term --cov-fail-under=80
+
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install -e ".[dev]"
+      - run: ruff check .
+      - run: mypy
+      - run: python -m pip check
+      - run: python -m pip wheel . --no-deps --wheel-dir dist

mcp_latchpoint-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,68 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pypi-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    if: ${{ !github.event.release.prerelease }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+      - name: Check release tag and branch
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          python - <<'PY'
+          import os
+          import tomllib
+          from pathlib import Path
+
+          with Path("pyproject.toml").open("rb") as source:
+              version = tomllib.load(source)["project"]["version"]
+          expected = f"v{version}"
+          if os.environ["RELEASE_TAG"] != expected:
+              raise SystemExit(f"Release tag must be {expected}")
+          PY
+          git fetch --no-tags origin main
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+      - name: Test and build distributions
+        run: |
+          python -m pip install -e ".[dev]" build twine
+          python -m pytest -q
+          python -m build
+          python -m twine check dist/*
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: python-distributions
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/mcp-latchpoint/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: python-distributions
+          path: dist/
+      - name: Publish distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

mcp_latchpoint-0.1.0/.gitignore

@@ -0,0 +1,11 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.coverage
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.venv/
+build/
+dist/
+htmlcov/

mcp_latchpoint-0.1.0/CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog
+
+## 0.1.0
+
+- Add bounded JSON, JSONC, and Codex TOML parsing for documented MCP client layouts.
+- Add seven deterministic configuration rules with redacted evidence.
+- Add text, JSON, and SARIF output with severity-based CI exits.
+- Add a root-confined, read-only MCP stdio server.

mcp_latchpoint-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,15 @@
+# Contributing
+
+Keep changes small enough to review and add tests for parser, rule, or containment behavior. Rule evidence must be deterministic and must not include credential values.
+
+Before opening a pull request, run:
+
+```console
+pytest
+ruff check .
+mypy
+```
+
+New rules need a stable ID, a concrete risk, a remediation, positive and negative fixtures, and a clear statement of uncertainty. Avoid rules that infer server behavior from a package name alone.
+
+Use synthetic configurations in tests and examples. Follow `SECURITY.md` for anything that could expose private data.

mcp_latchpoint-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Robert Vind-Gardoș
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mcp_latchpoint-0.1.0/PKG-INFO

@@ -0,0 +1,190 @@
+Metadata-Version: 2.5
+Name: mcp-latchpoint
+Version: 0.1.0
+Summary: Offline-first auditor for MCP client configuration files
+Project-URL: Repository, https://github.com/robyroro/mcp-latchpoint
+Project-URL: Issues, https://github.com/robyroro/mcp-latchpoint/issues
+Project-URL: Changelog, https://github.com/robyroro/mcp-latchpoint/blob/main/CHANGELOG.md
+Author: Robert Vind-Gardoș
+License: MIT License
+        
+        Copyright (c) 2026 Robert Vind-Gardoș
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+License-File: LICENSE
+Keywords: audit,configuration,mcp,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Requires-Python: >=3.11
+Requires-Dist: mcp<3,>=2.3
+Provides-Extra: dev
+Requires-Dist: jsonschema<5,>=4.23; extra == 'dev'
+Requires-Dist: mypy<2,>=1.15; extra == 'dev'
+Requires-Dist: pytest-cov<8,>=6; extra == 'dev'
+Requires-Dist: pytest<10,>=8.3; extra == 'dev'
+Requires-Dist: ruff<1,>=0.11; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# mcp-latchpoint
+
+`mcp-latchpoint` audits MCP client configuration files without running the configured servers. It works offline, reads only local files you select, and produces text, JSON, or SARIF results.
+
+This is an early defensive tool. Review findings in context before changing a working configuration.
+
+## What it checks
+
+The v0.1 rules cover:
+
+- plain HTTP for non-loopback remote endpoints
+- shell wrappers and inline shell control syntax
+- identifiable `npx` and `uvx` packages without exact versions
+- literal credentials in environment values, headers, arguments, or URLs
+- filesystem roots and home roots passed as recognizable access scopes
+- wildcard hosts and recognizable wildcard scopes
+- conflicting, missing, invalid, or unsupported transport settings
+
+Every finding has a stable rule ID, severity, location, remediation, redacted evidence, and a confidence note when interpretation depends on the launched server.
+
+## Install
+
+Python 3.11 or newer is required.
+
+```console
+python -m venv .venv
+# Linux or macOS
+. .venv/bin/activate
+# Windows PowerShell
+.venv\Scripts\Activate.ps1
+python -m pip install .
+```
+
+For development:
+
+```console
+python -m pip install -e ".[dev]"
+pytest
+ruff check .
+mypy
+```
+
+The MCP server uses the official Python SDK v2 and the dependency is constrained to `mcp>=2.3,<3`.
+
+## CLI
+
+Scan one or more explicit files:
+
+```console
+mcp-latchpoint scan ~/.config/Code/User/mcp.json
+mcp-latchpoint scan examples/risky.json --format json
+mcp-latchpoint scan examples/risky.json --format sarif --fail-on high > results.sarif
+```
+
+Restrict every explicit path to an approved directory:
+
+```console
+mcp-latchpoint scan ./configs --allowed-root ./configs
+```
+
+Directories are searched only for recognized MCP config filenames, up to 256 files. A file is limited to 1 MiB by default. Change these bounds with `--max-files` and `--max-bytes`.
+
+Exit codes are `0` for a completed scan below the chosen threshold, `1` when a finding meets `--fail-on`, and `2` for input, containment, or parse errors. The default `--fail-on none` reports findings without failing a build.
+
+List and explain rules:
+
+```console
+mcp-latchpoint rules
+mcp-latchpoint explain MCP004
+```
+
+### Recognized layouts
+
+Explicit files may use these structures:
+
+| Client layout | Container | Accepted file syntax |
+| --- | --- | --- |
+| Claude Desktop, Cursor, portable `.mcp.json`, generic MCP JSON | top-level `mcpServers` object | JSON |
+| Claude Code user/local settings | top-level `mcpServers`, plus `projects.<path>.mcpServers` in `~/.claude.json` | JSON |
+| VS Code | top-level `servers` object | JSONC for `.vscode/mcp.json` |
+| Codex | `[mcp_servers.<name>]` tables | TOML |
+
+Files ending in `.jsonc` are also parsed as JSONC. Other `.json` files remain strict JSON so malformed input is not silently accepted.
+
+`--discover` checks only the following paths when they exist. It does not search the rest of the home directory.
+
+- All systems: `~/.claude.json`, `~/.cursor/mcp.json`, `~/.codex/config.toml`, `$COPILOT_HOME/mcp-config.json` with `~/.copilot/mcp-config.json` as the fallback
+- Current project: `.mcp.json`, `.codex/config.toml`, `.cursor/mcp.json`, `.vscode/mcp.json`
+- Windows: `%APPDATA%\Claude\claude_desktop_config.json`, `%APPDATA%\Code\User\mcp.json`
+- macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`, `~/Library/Application Support/Code/User/mcp.json`
+- Linux: `$XDG_CONFIG_HOME/Code/User/mcp.json`, falling back to `~/.config/Code/User/mcp.json`
+
+## Read-only MCP server
+
+The stdio server exposes two tools: `list_rules` and `scan`. It requires an allowed root at startup. Relative scan paths are resolved below that root; absolute paths, `..` traversal, and symlinks cannot escape it.
+
+```console
+mcp-latchpoint-server --root /absolute/path/to/reviewed-configs
+```
+
+Example client entry:
+
+```json
+{
+  "mcpServers": {
+    "latchpoint": {
+      "command": "/absolute/path/to/mcp-latchpoint-server",
+      "args": ["--root", "/absolute/path/to/reviewed-configs"]
+    }
+  }
+}
+```
+
+The server returns findings and scan metadata, never raw configuration content. Stdio is the only server transport exposed by the entry point, and stdout is reserved for MCP protocol messages.
+
+### Glama build
+
+The [Glama listing](https://glama.ai/mcp/servers/robyroro/mcp-latchpoint) builds a container from the repository. In its Dockerfile configuration, use Python 3.13, these build steps and command arguments:
+
+```json
+["uv sync --no-dev"]
+```
+
+```json
+["mcp-proxy", "--", "/app/.venv/bin/mcp-latchpoint-server", "--root", "/app/examples"]
+```
+
+The root is an existing directory with synthetic sample configurations. It lets Glama start and inspect the tools without giving the server access to a user's files. The command uses the executable inside the virtual environment created by `uv sync`. For this demo, the environment-variable schema can be `{"type":"object","properties":{}}` and placeholder parameters can be `{}`.
+
+To scan your own configurations, run the server locally with `--root` pointing to a directory you explicitly trust. Glama's demo root is only for the sample files in `examples/`.
+
+## Safety and limitations
+
+The scanner never executes commands, installs packages, resolves referenced environment variables, or connects to endpoints. It does not follow configuration includes or inspect an MCP server's code or runtime behavior. Argument-based rules are intentionally limited to recognizable patterns, so custom flags can be missed. A clean report is not proof that a server is safe.
+
+Secret detection is designed to emit field names and `<redacted>` markers rather than values. If you find a leak or a path-containment problem, follow [SECURITY.md](SECURITY.md) and do not attach a real configuration to a public issue.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

mcp_latchpoint-0.1.0/README.md

@@ -0,0 +1,140 @@
+# mcp-latchpoint
+
+`mcp-latchpoint` audits MCP client configuration files without running the configured servers. It works offline, reads only local files you select, and produces text, JSON, or SARIF results.
+
+This is an early defensive tool. Review findings in context before changing a working configuration.
+
+## What it checks
+
+The v0.1 rules cover:
+
+- plain HTTP for non-loopback remote endpoints
+- shell wrappers and inline shell control syntax
+- identifiable `npx` and `uvx` packages without exact versions
+- literal credentials in environment values, headers, arguments, or URLs
+- filesystem roots and home roots passed as recognizable access scopes
+- wildcard hosts and recognizable wildcard scopes
+- conflicting, missing, invalid, or unsupported transport settings
+
+Every finding has a stable rule ID, severity, location, remediation, redacted evidence, and a confidence note when interpretation depends on the launched server.
+
+## Install
+
+Python 3.11 or newer is required.
+
+```console
+python -m venv .venv
+# Linux or macOS
+. .venv/bin/activate
+# Windows PowerShell
+.venv\Scripts\Activate.ps1
+python -m pip install .
+```
+
+For development:
+
+```console
+python -m pip install -e ".[dev]"
+pytest
+ruff check .
+mypy
+```
+
+The MCP server uses the official Python SDK v2 and the dependency is constrained to `mcp>=2.3,<3`.
+
+## CLI
+
+Scan one or more explicit files:
+
+```console
+mcp-latchpoint scan ~/.config/Code/User/mcp.json
+mcp-latchpoint scan examples/risky.json --format json
+mcp-latchpoint scan examples/risky.json --format sarif --fail-on high > results.sarif
+```
+
+Restrict every explicit path to an approved directory:
+
+```console
+mcp-latchpoint scan ./configs --allowed-root ./configs
+```
+
+Directories are searched only for recognized MCP config filenames, up to 256 files. A file is limited to 1 MiB by default. Change these bounds with `--max-files` and `--max-bytes`.
+
+Exit codes are `0` for a completed scan below the chosen threshold, `1` when a finding meets `--fail-on`, and `2` for input, containment, or parse errors. The default `--fail-on none` reports findings without failing a build.
+
+List and explain rules:
+
+```console
+mcp-latchpoint rules
+mcp-latchpoint explain MCP004
+```
+
+### Recognized layouts
+
+Explicit files may use these structures:
+
+| Client layout | Container | Accepted file syntax |
+| --- | --- | --- |
+| Claude Desktop, Cursor, portable `.mcp.json`, generic MCP JSON | top-level `mcpServers` object | JSON |
+| Claude Code user/local settings | top-level `mcpServers`, plus `projects.<path>.mcpServers` in `~/.claude.json` | JSON |
+| VS Code | top-level `servers` object | JSONC for `.vscode/mcp.json` |
+| Codex | `[mcp_servers.<name>]` tables | TOML |
+
+Files ending in `.jsonc` are also parsed as JSONC. Other `.json` files remain strict JSON so malformed input is not silently accepted.
+
+`--discover` checks only the following paths when they exist. It does not search the rest of the home directory.
+
+- All systems: `~/.claude.json`, `~/.cursor/mcp.json`, `~/.codex/config.toml`, `$COPILOT_HOME/mcp-config.json` with `~/.copilot/mcp-config.json` as the fallback
+- Current project: `.mcp.json`, `.codex/config.toml`, `.cursor/mcp.json`, `.vscode/mcp.json`
+- Windows: `%APPDATA%\Claude\claude_desktop_config.json`, `%APPDATA%\Code\User\mcp.json`
+- macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`, `~/Library/Application Support/Code/User/mcp.json`
+- Linux: `$XDG_CONFIG_HOME/Code/User/mcp.json`, falling back to `~/.config/Code/User/mcp.json`
+
+## Read-only MCP server
+
+The stdio server exposes two tools: `list_rules` and `scan`. It requires an allowed root at startup. Relative scan paths are resolved below that root; absolute paths, `..` traversal, and symlinks cannot escape it.
+
+```console
+mcp-latchpoint-server --root /absolute/path/to/reviewed-configs
+```
+
+Example client entry:
+
+```json
+{
+  "mcpServers": {
+    "latchpoint": {
+      "command": "/absolute/path/to/mcp-latchpoint-server",
+      "args": ["--root", "/absolute/path/to/reviewed-configs"]
+    }
+  }
+}
+```
+
+The server returns findings and scan metadata, never raw configuration content. Stdio is the only server transport exposed by the entry point, and stdout is reserved for MCP protocol messages.
+
+### Glama build
+
+The [Glama listing](https://glama.ai/mcp/servers/robyroro/mcp-latchpoint) builds a container from the repository. In its Dockerfile configuration, use Python 3.13, these build steps and command arguments:
+
+```json
+["uv sync --no-dev"]
+```
+
+```json
+["mcp-proxy", "--", "/app/.venv/bin/mcp-latchpoint-server", "--root", "/app/examples"]
+```
+
+The root is an existing directory with synthetic sample configurations. It lets Glama start and inspect the tools without giving the server access to a user's files. The command uses the executable inside the virtual environment created by `uv sync`. For this demo, the environment-variable schema can be `{"type":"object","properties":{}}` and placeholder parameters can be `{}`.
+
+To scan your own configurations, run the server locally with `--root` pointing to a directory you explicitly trust. Glama's demo root is only for the sample files in `examples/`.
+
+## Safety and limitations
+
+The scanner never executes commands, installs packages, resolves referenced environment variables, or connects to endpoints. It does not follow configuration includes or inspect an MCP server's code or runtime behavior. Argument-based rules are intentionally limited to recognizable patterns, so custom flags can be missed. A clean report is not proof that a server is safe.
+
+Secret detection is designed to emit field names and `<redacted>` markers rather than values. If you find a leak or a path-containment problem, follow [SECURITY.md](SECURITY.md) and do not attach a real configuration to a public issue.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

mcp_latchpoint-0.1.0/SECURITY.md

@@ -0,0 +1,17 @@
+# Security policy
+
+## Supported versions
+
+Until the first stable release, security fixes are made on the latest `0.x` release and the default branch.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a vulnerability that could expose configuration data, credentials, or files outside an allowed root. Use GitHub's private vulnerability reporting feature on the eventual public repository. If that feature is not available, contact the repository owner privately before sharing details.
+
+Include a minimal reproduction built from synthetic data, the affected version, and the operating system. Do not send real MCP configurations, tokens, home-directory listings, or other private files.
+
+Reasonable reports will be acknowledged when the maintainer is available. A public disclosure timeline should be agreed only after the impact and fix have been checked independently.
+
+## Security boundaries
+
+`mcp-latchpoint` is a static configuration auditor. It must not execute configured commands, install packages, connect to configured endpoints, or return raw configuration through MCP tools. The stdio server's allowed root is a security boundary, including for traversal and symlink resolution.

mcp_latchpoint-0.1.0/examples/codex-config.toml

@@ -0,0 +1,7 @@
+[mcp_servers.reviewed_local]
+command = "uvx"
+args = ["example-mcp-server==1.4.2", "--workspace", "/srv/mcp/project"]
+
+[mcp_servers.reviewed_remote]
+url = "https://mcp.example.com/api"
+bearer_token_env_var = "EXAMPLE_MCP_TOKEN"

mcp_latchpoint-0.1.0/examples/risky.json

@@ -0,0 +1,18 @@
+{
+  "mcpServers": {
+    "shell-launch": {
+      "command": "sh",
+      "args": ["-c", "npx @example/mcp-server --root /"],
+      "env": {
+        "API_TOKEN": "synthetic-example-value"
+      }
+    },
+    "remote": {
+      "type": "http",
+      "url": "http://mcp.example.com/connect?api_key=synthetic-example-value",
+      "headers": {
+        "Authorization": "Bearer synthetic-example-value"
+      }
+    }
+  }
+}

mcp_latchpoint-0.1.0/examples/safe.json

@@ -0,0 +1,19 @@
+{
+  "mcpServers": {
+    "reviewed-files": {
+      "command": "npx",
+      "args": [
+        "--yes",
+        "@modelcontextprotocol/server-filesystem@1.2.3",
+        "/srv/mcp/shared-documents"
+      ],
+      "env": {
+        "SERVICE_TOKEN": "${SERVICE_TOKEN}"
+      }
+    },
+    "internal-api": {
+      "type": "http",
+      "url": "https://mcp.example.com/api"
+    }
+  }
+}

mcp_latchpoint-0.1.0/glama.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://glama.ai/mcp/schemas/server.json",
+  "maintainers": ["robyroro"]
+}

mcp_latchpoint-0.1.0/pyproject.toml

@@ -0,0 +1,64 @@
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[project]
+name = "mcp-latchpoint"
+version = "0.1.0"
+description = "Offline-first auditor for MCP client configuration files"
+readme = "README.md"
+requires-python = ">=3.11"
+license = { file = "LICENSE" }
+authors = [{ name = "Robert Vind-Gardoș" }]
+keywords = ["mcp", "security", "configuration", "audit"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Environment :: Console",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
+  "Topic :: Security",
+]
+dependencies = [
+  "mcp>=2.3,<3",
+]
+
+[project.optional-dependencies]
+dev = [
+  "jsonschema>=4.23,<5",
+  "mypy>=1.15,<2",
+  "pytest>=8.3,<10",
+  "pytest-cov>=6,<8",
+  "ruff>=0.11,<1",
+]
+
+[project.urls]
+Repository = "https://github.com/robyroro/mcp-latchpoint"
+Issues = "https://github.com/robyroro/mcp-latchpoint/issues"
+Changelog = "https://github.com/robyroro/mcp-latchpoint/blob/main/CHANGELOG.md"
+
+[project.scripts]
+mcp-latchpoint = "mcp_latchpoint.cli:main"
+mcp-latchpoint-server = "mcp_latchpoint.mcp_server:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/mcp_latchpoint"]
+
+[tool.pytest.ini_options]
+addopts = "-ra --strict-markers --strict-config"
+testpaths = ["tests"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "SIM"]
+
+[tool.mypy]
+python_version = "3.11"
+strict = true
+packages = ["mcp_latchpoint"]

mcp_latchpoint-0.1.0/src/mcp_latchpoint/__init__.py

@@ -0,0 +1,6 @@
+"""Offline-first MCP configuration auditing."""
+
+from mcp_latchpoint.scanner import ScanOptions, scan_paths
+
+__all__ = ["ScanOptions", "scan_paths"]
+__version__ = "0.1.0"