mcp-server-taxcode 0.1.1__tar.gz

mcp_server_taxcode-0.1.1/.github/dependabot.yml

@@ -0,0 +1,47 @@
+version: 2
+# The Dockerfile pulls its base from public.ecr.aws. Declaring that host
+# under registries (no credentials; it allows anonymous pulls) lets the
+# docker update job reach it. See "Configuring access to private registries
+# for Dependabot" on docs.github.com.
+registries:
+  public-ecr:
+    type: docker-registry
+    url: https://public.ecr.aws
+
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "04:30"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 10
+    groups:
+      dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "04:30"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 10
+    groups:
+      actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "04:30"
+      timezone: "Etc/UTC"
+    open-pull-requests-limit: 10
+    registries:
+      - public-ecr

mcp_server_taxcode-0.1.1/.github/workflows/ci.yml

@@ -0,0 +1,179 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  # Each push to main gets its own group, keyed on the commit SHA, so runs for
+  # different main commits never wait behind, replace or cancel each other.
+  # Pull request runs share one group per PR ref, and a new push to the PR cancels
+  # the run in progress.
+  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  lint-and-types:
+    name: Lint and types
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        with:
+          version: "latest"
+          enable-cache: true
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.10"
+
+      - name: Install dependencies
+        run: uv sync --locked --extra dev --python 3.10
+
+      - name: Check code formatting
+        run: uv run ruff format --check .
+
+      - name: Run linter
+        run: uv run ruff check .
+
+      - name: Static type analysis
+        run: uv run mypy --strict src
+
+  test:
+    name: Tests (py${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        with:
+          version: "latest"
+          enable-cache: true
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        # The code-mode extra is installed explicitly; with CI set, tests/conftest.py
+        # aborts the run if the Code Mode sandbox is missing instead of skipping its tests.
+        run: uv sync --locked --extra dev --extra code-mode --python "$PYTHON_VERSION"
+        env:
+          PYTHON_VERSION: ${{ matrix.python-version }}
+
+      - name: Run unit test suite
+        run: uv run pytest
+
+  tool-contract:
+    name: Tool contract assertions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        with:
+          version: "latest"
+          enable-cache: true
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.10"
+
+      - name: Install dependencies
+        run: uv sync --locked --extra dev --python 3.10
+
+      - name: Verify tool contracts
+        run: uv run python scripts/check_tool_contract.py
+
+      - name: Verify OpenAPI drift
+        run: uv run python scripts/check_openapi_drift.py
+
+      - name: Set up Node.js 22
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
+        with:
+          node-version: "22"
+
+      - name: Protocol conformance suite
+        run: ./scripts/check_conformance.sh
+
+  build-check:
+    name: Build and package check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        with:
+          version: "latest"
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.10"
+
+      - name: Install dependencies
+        run: uv sync --locked --extra dev --python 3.10
+
+      - name: Build wheel and sdist
+        run: uv build
+
+      - name: Reject fallback and untagged versions
+        run: uv run python scripts/check_version.py
+
+      - name: Validate distribution
+        run: uv run twine check dist/*
+
+  docker-build:
+    name: Container image build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Build image (no push)
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
+        with:
+          context: .
+          push: false
+          load: true
+          tags: mcp-server-ci:test
+
+      - name: Image label matches server.json name
+        run: |
+          EXPECTED="$(jq -r .name server.json)"
+          ACTUAL="$(docker inspect --format '{{ index .Config.Labels "io.modelcontextprotocol.server.name" }}' mcp-server-ci:test)"
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "::error::image label '${ACTUAL}' does not match server.json name '${EXPECTED}'"
+            exit 1
+          fi
+          echo "Image label matches ${EXPECTED}"

mcp_server_taxcode-0.1.1/.github/workflows/dependabot-automerge.yml

@@ -0,0 +1,39 @@
+name: Dependabot Auto-Merge
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions: {}
+
+# One run per PR; a newer push supersedes the pending run.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  automerge:
+    name: Auto-merge Dependabot PRs
+    runs-on: ubuntu-latest
+    # The PR author, not github.actor (the last actor on the event, which can be spoofed),
+    # and only for branches in this repository.
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
+    permissions:
+      contents: write       # auto-merge squashes the PR into main once required checks pass
+      pull-requests: write  # enable auto-merge on the PR
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98  # v3.1.0
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      # Allowlist, not a major-version denylist: update-type is the highest change in the PR
+      # (a grouped PR with one major is skipped), and it is empty when the PR carries a
+      # non-Dependabot commit, so only minor and patch updates are auto-merged.
+      - name: Enable auto-merge for semver-minor and semver-patch updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

mcp_server_taxcode-0.1.1/.github/workflows/drift-monitor.yml

@@ -0,0 +1,45 @@
+name: Weekly OpenAPI Drift Monitor
+
+on:
+  schedule:
+    # Run every Sunday at 04:00 UTC
+    - cron: "0 4 * * 0"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# One drift check at a time; a manual run waits for a scheduled one instead of racing it.
+# queue: max lets up to 100 runs wait instead of cancelling them (GitHub does not
+# guarantee their order).
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+  queue: max
+
+jobs:
+  drift-check:
+    name: Check API Drift
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        with:
+          version: "latest"
+          enable-cache: true
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.10"
+
+      - name: Install dependencies
+        run: uv sync --locked --extra dev --python 3.10
+
+      - name: Run OpenAPI drift detection
+        run: uv run python scripts/check_openapi_drift.py

mcp_server_taxcode-0.1.1/.github/workflows/release.yml

@@ -0,0 +1,226 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build distributions
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
+        with:
+          version: "latest"
+          enable-cache: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.10"
+
+      - name: Build Wheel & Source Dist
+        run: uv build
+
+      - name: Verify wheel version matches tag
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          shopt -s nullglob
+          wheels=(dist/*.whl)
+          if [ "${#wheels[@]}" -ne 1 ]; then
+            echo "::error::expected exactly one wheel in dist/, found ${#wheels[@]}"
+            exit 1
+          fi
+          WHEEL_VERSION="$(unzip -p "${wheels[0]}" '*.dist-info/METADATA' | sed -n 's/^Version: //p' | head -n 1)"
+          if [ "$WHEEL_VERSION" != "$TAG_VERSION" ]; then
+            echo "::error::wheel METADATA version '${WHEEL_VERSION}' does not match tag ${GITHUB_REF_NAME} (expected '${TAG_VERSION}')"
+            exit 1
+          fi
+          echo "Wheel version ${WHEEL_VERSION} matches tag ${GITHUB_REF_NAME}"
+
+      - name: Build release notes
+        run: python3 scripts/release_notes.py --to "$GITHUB_REF_NAME" > release-notes.md
+
+      - name: Verify Packages
+        run: |
+          uv pip install --system twine==7.0.0 cyclonedx-bom==7.5.0
+          twine check dist/*
+
+      - name: Generate CycloneDX SBOM
+        run: |
+          python -m venv --without-pip "$RUNNER_TEMP/sbom-env"
+          python -m pip --python "$RUNNER_TEMP/sbom-env/bin/python" install dist/*.whl
+          cyclonedx-py environment "$RUNNER_TEMP/sbom-env" -o sbom.cdx.json
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: dist
+          path: |
+            dist/
+            sbom.cdx.json
+            release-notes.md
+          if-no-files-found: error
+
+  publish:
+    name: Publish to PyPI and GitHub Release
+    needs: [build]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write      # OIDC for PyPI Trusted Publishing; no API token stored
+      contents: write      # create the GitHub Release
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+        with:
+          name: dist
+
+      - name: Publish to PyPI via OIDC
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3.0.3
+        with:
+          files: |
+            dist/*.whl
+            dist/*.tar.gz
+            sbom.cdx.json
+          body_path: release-notes.md
+
+  docker:
+    name: Publish GHCR image
+    needs: [publish]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read     # checkout
+      packages: write    # push the image to GHCR
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+      image: ${{ steps.image.outputs.name }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Image name (GHCR requires lowercase)
+        id: image
+        run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
+
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Build and Push Docker Image
+        id: build
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7.4.0
+        with:
+          context: .
+          push: true
+          provenance: false
+          sbom: false
+          tags: |
+            ${{ steps.image.outputs.name }}:${{ steps.version.outputs.version }}
+            ${{ steps.image.outputs.name }}:latest
+          build-args: |
+            UV_DYNAMIC_VERSIONING_BYPASS=${{ steps.version.outputs.version }}
+
+  attest:
+    name: Attest build provenance
+    needs: [build, docker]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read       # required by attest-build-provenance
+      id-token: write      # Sigstore signing certificate (OIDC)
+      attestations: write  # store the attestation on GitHub
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+        with:
+          name: dist
+
+      - name: Attest distribution provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8  # v4.2.2
+        with:
+          subject-path: "dist/*"
+
+      - name: Attest container image provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8  # v4.2.2
+        with:
+          subject-name: ${{ needs.docker.outputs.image }}
+          subject-digest: ${{ needs.docker.outputs.digest }}
+
+  registry:
+    name: Publish to MCP Registry
+    needs: [publish, docker, attest]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read     # checkout (server.json)
+      id-token: write    # mcp-publisher login github-oidc
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install and Verify mcp-publisher
+        run: |
+          OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+          ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
+          ARCHIVE="mcp-publisher_${OS}_${ARCH}.tar.gz"
+          curl -L -s -o "$ARCHIVE" "https://github.com/modelcontextprotocol/registry/releases/download/v1.8.1/$ARCHIVE"
+          curl -L -s -o checksums.txt "https://github.com/modelcontextprotocol/registry/releases/download/v1.8.1/registry_1.8.1_checksums.txt"
+          sha256sum --ignore-missing --check checksums.txt
+          tar xz -f "$ARCHIVE" mcp-publisher
+          rm "$ARCHIVE" checksums.txt
+
+      - name: Authenticate to MCP Registry
+        run: |
+          MAX_RETRIES=3
+          for ATTEMPT in $(seq 1 "$MAX_RETRIES"); do
+            if ./mcp-publisher login github-oidc; then
+              break
+            fi
+            if [ "$ATTEMPT" -eq "$MAX_RETRIES" ]; then
+              echo "mcp-publisher login failed after $MAX_RETRIES attempts" >&2
+              exit 1
+            fi
+            echo "mcp-publisher login failed (attempt $ATTEMPT/$MAX_RETRIES), retrying in 5s..."
+            sleep 5
+          done
+
+      - name: Set version in server.json
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          jq --arg v "$VERSION" '
+            .version = $v
+            | .packages |= map(
+                if .registryType == "oci"
+                then .identifier = (.identifier | sub(":[^:/]+$"; "") + ":" + $v)
+                else .version = $v end)
+          ' server.json > server.tmp && mv server.tmp server.json
+
+      - name: Publish server to MCP Registry
+        run: ./mcp-publisher publish

mcp_server_taxcode-0.1.1/.gitignore

@@ -0,0 +1,66 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Testing & Coverage
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+htmlcov/
+
+# Type Checking
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# IDEs
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Documentation / Runbooks
+COOKBOOK.md