morgenmcp 0.2.1__tar.gz

morgenmcp-0.2.1/.claude/skills/fastmcp/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: fastmcp
+description: Up-to-date reference for FastMCP (Python MCP server framework) as used in MorgenMCP — middleware authoring, tool/resource/prompt registration, ToolError conventions, in-memory Client testing, transports. Use when modifying morgenmcp/server.py, tools/, resources.py, or writing/debugging tests against fastmcp.Client. Prefer this over memory: verify against docs/fastmcp/docs/ (pinned submodule) before relying on any API detail — FastMCP ships breaking changes across 3.x minors.
+user-invocable: true
+---
+
+# FastMCP reference (MorgenMCP)
+
+**Pinned version: 3.4.3** (`pyproject.toml`: `fastmcp>=3.4,<3.5`). Local docs submodule
+`docs/fastmcp/` is checked out at tag `v3.4.3` (`1eedd1f6`) — matches the installed package
+exactly. **Always check `docs/fastmcp/docs/` before trusting a remembered API detail** —
+online docs and this skill's own prose can describe a different version.
+
+> Facts here were verified against the pinned submodule and cross-checked with a deep-research
+> pass (2026-07-07). Re-verify before relying on a signature if the submodule tag has moved —
+> see reference/CHANGELOG.md.
+
+## Where MorgenMCP deviates from FastMCP defaults (know these first)
+
+- **Call-expression registration, not decorators.** `server.py` uses `mcp.tool(name=...)(func)` /
+  `mcp.resource(uri, ...)(func)` instead of `@mcp.tool`. This is a documented-valid alternative
+  (see reference/registration.md) chosen so tool/resource functions stay plain, independently
+  importable async functions for unit testing.
+- **`ResponseCachingMiddleware` is a FastMCP-provided class**, imported directly from
+  `fastmcp.server.middleware.caching` (not subclassed). MorgenMCP's contribution is only the
+  *configuration* — `CallToolSettings`/`ReadResourceSettings` (60s TTL, which tools/resources are
+  cached) — so a FastMCP upgrade touching this module directly affects this repo's cache behavior.
+- **stdio transport only**, no HTTP/auth surface. FastMCP auth (OAuth Proxy, MultiAuth) is
+  HTTP-only by design — under stdio it is silently skipped, not rejected (`run_stdio_async` never
+  reads `self.auth`; the server runs with `skip_auth=True`). So auth is simply inert here, and
+  auth-hardening changelog entries can be skipped when assessing upgrade risk for this repo.
+
+## Quick recipes
+
+**Middleware** (subclass `fastmcp.server.middleware.Middleware`, register via `mcp.add_middleware`):
+```python
+from fastmcp.server.middleware import Middleware, MiddlewareContext
+
+class LoggingMiddleware(Middleware):
+    async def on_message(self, context: MiddlewareContext, call_next):
+        return await call_next(context)
+
+mcp.add_middleware(LoggingMiddleware())  # order = execution order, first added = outermost
+```
+Deny by **raising**, not returning falsy: `ToolError` / `ResourceError` / `PromptError` / `McpError`.
+`on_initialize` must reject *before* calling `call_next()` — raising after only logs.
+
+**Registration** (call-expression form, as used in this repo):
+```python
+mcp.tool(name="morgen_list_events", description=...)(list_events)
+mcp.resource("morgen://calendar/{calendar_id}/events")(get_calendar_events)
+```
+
+**Testing** (in-memory, no transport — pass the server instance directly):
+```python
+from fastmcp import Client
+
+async def test_x():
+    async with Client(mcp) as client:
+        result = await client.call_tool("morgen_list_events", {...})
+        assert result.data == {...}
+```
+Don't open `Client` inside a pytest fixture (event-loop issues) — only build/return the server there.
+
+**Errors**: `ToolError` messages are *always* sent to the client, regardless of `mask_error_details`.
+Generic exceptions get masked to a generic string when `mask_error_details=True`. This is why
+`utils.py`'s `@handle_tool_errors` converts everything to `ToolError`.
+
+**Transport** (this repo only uses the first):
+```python
+mcp.run()                                              # stdio (default) — what MorgenMCP uses
+mcp.run(transport="http", host="127.0.0.1", port=8000) # Streamable HTTP → http://host:port/mcp
+```
+
+## Topic reference (load as needed)
+
+- Middleware hook signatures, `MiddlewareContext` fields, deny-by-raising details → [reference/middleware.md](reference/middleware.md)
+- Tool/resource/prompt registration forms, primitive-result auto-wrapping, RFC 6570 URI templates → [reference/registration.md](reference/registration.md)
+- Testing patterns (in-memory Client, `run_server_async` vs `run_server_in_process`) → [reference/testing.md](reference/testing.md)
+- Per-version changelog (3.0.0 → 3.4.3), what's a breaking change, security-hardening timeline → [reference/CHANGELOG.md](reference/CHANGELOG.md)
+
+## Why FastMCP here (context)
+
+MorgenMCP wraps the Morgen calendar API as an MCP server. It runs stdio-only with no auth
+provider, registers 22 tools, and layers FastMCP's `ResponseCachingMiddleware` (60s TTL,
+configured not subclassed) plus a virtual-ID system on top of FastMCP's tool/resource primitives.
+See the project's own `CLAUDE.md` for the full architecture — this skill only covers the FastMCP
+framework layer.

morgenmcp-0.2.1/.claude/skills/fastmcp/reference/CHANGELOG.md

@@ -0,0 +1,163 @@
+# FastMCP version history (3.0.0 → 3.4.3)
+
+Compiled 2026-07-07 from `docs/fastmcp/docs/updates.mdx` (official changelog) plus direct git-log
+inspection of the `docs/fastmcp` submodule, then re-audited 2026-07-07 against the submodule docs,
+the installed `.venv` package source, and authoritative external sources (NVD/GHSA/PyPI/the
+PrefectHQ/fastmcp repo). Every version entry, code-name, date, CVE/GHSA ID, and the `257fe325`
+caching commit is confirmed; the re-audit corrected six items (see git history of this file).
+Version numbers are as precise as sources allow — flag anything you verify further so this file
+stays current (see "How to refresh" below).
+
+## 3.0.0
+
+- **`ResourceResult`/`ResourceContent`** established as the canonical resource return type (list
+  of per-item content, individual MIME types/metadata).
+- **`version` kwarg** added to `@mcp.resource`/`@mcp.tool`/`@mcp.prompt`; the selected version is
+  surfaced through `meta.fastmcp.version`/`meta.fastmcp.versions` (and clients can request one via
+  `_meta.fastmcp.version`) — it rides the `_meta` channel, not a field separate from it.
+- **RFC 6570 URI template query params** (`{?param1,param2}`) — note: `updates.mdx` attributes
+  these to **2.13.0** (Oct 2025), not 3.0.0. The `{param}` / `{param*}` (wildcard) / `{?...}`
+  (query) forms are all valid in 3.x; see reference/registration.md for the working syntax.
+- **OAuth Proxy gains CIMD** (client ID metadata document) support.
+- Component visibility controls added.
+
+## 3.0.2
+
+- Fix: MCP transport auth headers no longer leak through to downstream OpenAPI APIs (issue #3260,
+  fixed by PR #3262).
+- Fix: background task workers correctly receive the originating request ID.
+
+## 3.1.0 — "Code to Joy" (2026-03-03)
+
+- **Code Mode Transform**: instead of exposing the raw tool catalog, the LLM gets meta-tools —
+  search for relevant tools via BM25, inspect schemas, then write Python chaining `call_tool()`
+  calls inside a sandbox. Reduces context spent on tool schemas for large tool catalogs.
+- **`MultiAuth`**: composes multiple token-verification sources into one auth layer. Tries a
+  designated `server` (an OAuth Proxy, which owns all OAuth routes/metadata) first, then
+  `verifiers` in list order (contributing only token-verification logic); 401 if all fail.
+- PropelAuth provider support.
+- Google GenAI sampling handler.
+
+## 3.1.1
+
+- Pin `pydantic-monty<0.0.8` — hotfix for a breaking change in Monty affecting Code Mode.
+
+## 3.2.0 — "Show Don't Tool"
+
+- **The Apps release**: tools can return interactive UIs (charts, dashboards, forms, maps) via
+  `FastMCPApp` — `@app.ui()` for LLM-visible tools, `@app.tool()` for backend tools the UI calls.
+- **Security hardening pass**, tied to GHSA-vv7q-7jx5-f767 (OpenAPI provider SSRF/path
+  traversal): SSRF/path-traversal prevention (URL-encoding path params, restricting `$ref`
+  resolution to local refs), JWT algorithm restriction (blocks `HS*` when JWKS is configured),
+  OAuth scope enforcement (prefers IdP-granted scopes), CSRF double-submit cookie validation,
+  refresh-token misuse prevention (rejects refresh tokens used as Bearer tokens).
+- **Breaking change** ⚠️: `FastMCPApp` tool calls now route through `___`-prefixed compound tool
+  names internally (PR #3667), replacing a prior `_meta`-injection approach that broke in real MCP
+  hosts (Goose, MCP Jam) that don't forward `_meta` on `callServerTool`. **Superseded two patches
+  later**: 3.2.4 (#3824) replaced the `___` scheme with hash-based backend tool routing — so the
+  literal `AppName___tool_name` format is a 3.2.0–3.2.3-only artifact, not the current mechanism.
+- Dev server: `fastmcp dev apps` previews app tools in-browser with an MCP message inspector.
+
+## 3.2.1 – 3.2.4 (patch line)
+
+- 3.2.1: auth-provider audience validation fixes (Cognito `client_id`, Azure `identifier_uri`),
+  consent-cookie LRU cap, OpenAPI 3.0 `nullable` field leak fix.
+- 3.2.2: fixes the Azure audience regression from 3.2.1.
+- 3.2.3: pins `fakeredis<2.35.0` (2.35.0 rename broke pydocket's `memory://` backend).
+- 3.2.4: background tasks scoped to authorization context instead of MCP session (**breaking**
+  for session-scoped semantics), docstring-derived parameter descriptions, `FileUpload`
+  decoded-base64-size validation, proxy stops forwarding inbound headers to unrelated servers,
+  Keycloak OAuth provider added, and the 3.2.0 `___`-prefixed app-tool routing replaced with
+  hash-based backend routing (#3824) — also breaking for anyone who hard-coded the `___` names.
+
+## 3.3.0 — "Slim Reaper"
+
+- **`fastmcp-slim`**: dependency-light distribution shipping client + transport layer without
+  Starlette/Uvicorn/server stack — same import namespace, lighter footprint for CI/agents/library
+  dependents.
+- OAuth proxy hardening: silent-consent AS-in-the-middle guard, dot-segment redirect rejection,
+  per-token response cache partitioning.
+- `AzureB2CProvider` user flows, public `update_scopes()` on `OAuthProxy`.
+- `@mcp.tool(run_in_thread=False)` for thread-affine tools.
+
+## 3.3.1 — "Loop There It Is"
+
+- Hotfix for the 3.3 packaging split: standalone component imports (`from fastmcp.tools import
+  tool`) no longer pull in the server stack or trip a circular import.
+- **This is the version MorgenMCP shipped on until 2026-07-07.**
+
+## 3.4.0 — "Remote Control"
+
+- **`fastmcp-remote`**: standalone stdio↔HTTP bridge package — `uvx fastmcp-remote
+  https://example.com/mcp` connects stdio-only hosts to HTTP-hosted servers, OAuth auto-enabled
+  for HTTPS.
+- Proxies now forward `initialize` upstream — a missing/misconfigured backend fails the handshake
+  loudly instead of returning an empty-but-connected proxy.
+- `fastmcp_access_token_expiry_seconds` decouples client-facing token lifetime from short
+  upstream `expires_in`.
+- `ToolResult(..., is_error=True)` returns rich errors the model can act on instead of only
+  raising.
+
+## 3.4.1 — "Floor It"
+
+- Security patch: floors `starlette>=1.0.1`, closing CVE-2026-48710 (previously only constrained
+  transitively via `mcp`).
+- OAuthProxy logs refresh-token cache misses instead of failing silently.
+
+## 3.4.2 — "Heads Up"
+
+- Compatibility patch: `JWTVerifier` now accepts JWTs with private, non-critical JWS header
+  parameters (e.g. Clerk's `cat`) instead of rejecting before signature/claim validation.
+
+## 3.4.3 — "The Fast and the Secure-ious" (2026-07-05)
+
+- SSRF allow-list hardening: every IPv6 transition form (NAT64, 6to4, Teredo, ISATAP) now
+  unwraps to its embedded IPv4 target and is checked against the same allow-list policy.
+- DNS rebinding protection: Streamable HTTP validates `Host` and browser `Origin` before session
+  handling.
+- Stricter OAuth redirects: unsafe schemes rejected before registration, DCR clients bound to
+  their registered redirect URIs.
+- Reliability: proxy session-teardown races, discriminator-tag handling in JSON schema
+  conversion, several middleware/resource-template fixes.
+- **This is the version MorgenMCP upgraded to on 2026-07-07** (`fastmcp>=3.4,<3.5`).
+
+## Relevant to a specific bug hunt (caching middleware)
+
+Between 3.3.1 and 3.4.3, commit `257fe325` ("fix: caching middleware TypeError on cache miss due
+to mismatched call_next parameter", #4301) patched a positional/keyword mismatch in the
+*vendored `fastmcp_slim` docs-submodule snapshot's* middleware chain composition
+(`fastmcp_slim/fastmcp/server/server.py`). **This did not reproduce against the actually
+installed 3.3.1 package** — the installed chain composition (`partial(mw, call_next=chain)`) is
+shaped differently and was verified empirically (via `Client(mcp).list_tools()`) to work fine on
+both 3.3.1 and 3.4.3. Lesson: the `docs/fastmcp` submodule's *git history* can contain commits
+that don't map cleanly onto the installed PyPI package's actual code layout — always verify
+against the installed package (`.venv/lib/.../site-packages/fastmcp/`), not just submodule diffs,
+before concluding a changelog entry affects this repo.
+
+**Second lesson from the same investigation**: an earlier version of this file, and of SKILL.md /
+reference/middleware.md, claimed `ResponseCachingMiddleware` was hand-rolled by MorgenMCP rather
+than FastMCP-provided — sourced from a deep-research pass whose adversarial verifiers refuted the
+true claim 0-3, apparently because they only checked public docs pages and never inspected the
+actually-installed package. That was wrong (see reference/middleware.md for the corrected facts).
+Always cross-check "framework doesn't have X" claims directly against
+`.venv/lib/.../site-packages/fastmcp/` before writing them into a skill as fact — a web-search-based
+research pass can produce confident false negatives about implementation details that aren't
+documented in public docs but are plainly present in the source.
+
+## Not FastMCP framework features (commonly conflated)
+
+- **No `fastmcp.ValidationError`** documented for tool/resource argument validation as of 3.4.3 —
+  validation failures surface via Pydantic coercion, not a dedicated FastMCP exception type.
+- **Pydantic `by_alias`/`exclude_none` serialization** is a MorgenMCP project convention, not a
+  documented FastMCP requirement. The `model_dump(by_alias=True, exclude_none=True)` calls live in
+  `client.py` (request bodies); `models.py` supplies the field aliases and `validate_by_name`/
+  `validate_by_alias` config that make that round-trip work.
+
+## How to refresh this file
+
+1. `cd docs/fastmcp && git fetch --tags origin && git tag -l "v3.*"` — check for new tags.
+2. `git log --oneline <old-tag>..<new-tag>` — skim for security/breaking-change commits.
+3. `git show <new-tag>:docs/updates.mdx` — read the official per-release summary.
+4. Update `SKILL.md`'s "Pinned version" line and this file's changelog table.
+5. Empirically re-verify any claim about MorgenMCP's own code (like the caching-middleware note
+   above) against the *installed* package, not just the docs submodule — they can diverge.

morgenmcp-0.2.1/.claude/skills/fastmcp/reference/middleware.md

@@ -0,0 +1,85 @@
+# Middleware
+
+Source: `docs/fastmcp/docs/servers/middleware.mdx` (pinned v3.4.3).
+
+## Authoring
+
+Subclass `fastmcp.server.middleware.Middleware`, override the hooks you need:
+
+```python
+from fastmcp.server.middleware import Middleware, MiddlewareContext
+
+class LoggingMiddleware(Middleware):
+    async def on_message(self, context: MiddlewareContext, call_next):
+        result = await call_next(context)
+        return result
+```
+
+Register on a server instance:
+
+```python
+mcp.add_middleware(LoggingMiddleware())
+```
+
+`add_middleware` (`fastmcp_slim/fastmcp/server/server.py:527`):
+```python
+def add_middleware(self, middleware: Middleware) -> None:
+    self.middleware.append(middleware)
+```
+Registration order = execution order for the request leg; **reversed** for the response leg
+(first-added middleware is outermost — sees the request first, the response last). This repo's
+`ResponseCachingMiddleware` registration order in `server.py` therefore determines whether other
+middleware sees pre- or post-cache traffic.
+
+## Hook signatures
+
+All hooks share the same shape:
+```python
+async def hook(self, context: MiddlewareContext, call_next) -> result_type
+```
+
+Most general → most specific:
+- `on_message` — every message, requests + notifications
+- `on_request` / `on_notification`
+- `on_call_tool`, `on_read_resource`, `on_get_prompt`
+- `on_list_tools`, `on_list_resources`, `on_list_resource_templates`, `on_list_prompts`
+- `on_initialize`
+
+Override `__call__` directly instead of the named hooks for raw/uniform handling of every message
+type without dispatch overhead.
+
+`MiddlewareContext` fields: `method`, `source`, `type`, `message`, `timestamp`, `fastmcp_context`.
+- Tool/prompt calls: `context.message.name`, `context.message.arguments`
+- Resource reads: `context.message.uri`
+
+`on_list_tools` returns `list[Tool]` — filter/mutate the list before returning to hide tools from
+specific clients.
+
+## Denying requests
+
+Raise, don't return falsy:
+- `ToolError` — tool calls
+- `ResourceError` — resource reads
+- `PromptError` — prompt gets
+- `McpError` — general/protocol-level
+
+**`on_initialize` must reject *before* calling `call_next()`.** Raising after `call_next()`
+returns only logs the error server-side — it does not reach the client, because the initialize
+response has already been dispatched.
+
+## Caching middleware — is a framework feature
+
+FastMCP ships a built-in response-caching middleware:
+`fastmcp.server.middleware.caching.ResponseCachingMiddleware`, confirmed directly against the
+installed package (`.venv/lib/python3.14/site-packages/fastmcp/server/middleware/caching.py`,
+593 lines). It comes with per-method settings classes — `CallToolSettings`,
+`ReadResourceSettings`, `ListToolsSettings`, `ListResourcesSettings`, `ListPromptsSettings`,
+`GetPromptSettings` (all `TypedDict`s controlling TTL/enable per operation) — plus
+`ResponseCachingStatistics` and cache-key partitioning by auth token.
+
+`morgenmcp/server.py` imports and configures this class directly (not a subclass): 60s TTL,
+an explicit allowlist of cacheable read-only tools plus all resources. Upgrading FastMCP *can*
+change this repo's caching behavior if a release touches `fastmcp.server.middleware.caching` —
+check that module's diff specifically, not just the general `Middleware` base class, when
+assessing upgrade risk (see reference/CHANGELOG.md for the version-by-version history and a
+past false-negative on this exact claim).

morgenmcp-0.2.1/.claude/skills/fastmcp/reference/registration.md

@@ -0,0 +1,81 @@
+# Tool / resource / prompt registration
+
+Sources: `docs/fastmcp/docs/servers/tools.mdx`, `docs/fastmcp/docs/servers/resources.mdx`.
+
+## Registration forms
+
+Bare decorator:
+```python
+@mcp.tool
+def my_tool(x: int) -> int: ...
+
+@mcp.resource("users://email/{email}")
+def lookup_user(email: str) -> dict: ...
+```
+
+With options:
+```python
+@mcp.tool(name=..., description=..., tags={...}, meta={...}, timeout=float, output_schema={...})
+```
+
+**Call-expression form** (what MorgenMCP uses in `server.py`, so functions stay plain and
+independently testable):
+```python
+mcp.resource("users://email/{email}")(lookup_user)
+mcp.tool(name="morgen_list_events")(list_events)
+```
+This also lets one function register under multiple URIs/names by calling it more than once.
+
+For bound methods, use `fastmcp.tools.tool()` standalone then `mcp.add_tool(bound_method)` —
+the decorator form doesn't work directly on instance/class methods.
+
+## Primitive-result auto-wrapping
+
+MCP structured-output schemas require an object root. FastMCP handles this automatically based
+on the function's return annotation:
+- Annotated primitive (e.g. `-> int`) → wrapped into `structuredContent: {"result": 8}`, with
+  `"x-fastmcp-wrap-result": true` on the schema. Clients auto-unwrap this into `.data`.
+- No return annotation → no `structuredContent` at all, only `content`.
+- `dict` / dataclass / Pydantic model → always becomes structured content directly, no wrapping,
+  even without an explicit `output_schema`.
+- Full manual control: return `ToolResult(content=..., structured_content=..., meta=...)` —
+  importable as `from fastmcp.tools import ToolResult` (or `fastmcp.tools.tool`, a runtime
+  `sys.modules` alias; the actual class lives in `fastmcp/tools/base.py`, not a `tool.py` file).
+
+MorgenMCP's tools return `{"success": True, ...}` dicts (per `CLAUDE.md`), so they land in the
+"dict → structured content directly" case — no wrapping envelope to worry about.
+
+## Error handling
+
+- `ToolError` (`fastmcp.exceptions`) messages are **always** sent to the client verbatim,
+  regardless of the `mask_error_details` setting on `FastMCP(...)`.
+- Generic exceptions (`TypeError`, `ValueError`, etc.) get masked to a generic string when
+  `mask_error_details=True`.
+- No `fastmcp.ValidationError` is documented for tool/resource handlers in these files —
+  argument validation failures come from Pydantic coercion. Coercion strictness is controlled by
+  `strict_input_validation` (default: flexible coercion; `FastMCP(strict_input_validation=True)`
+  enforces strict JSON-Schema validation instead).
+- This is why `morgenmcp/tools/utils.py`'s `@handle_tool_errors` converts `ValidationError`,
+  `MorgenAPIError`, and unexpected exceptions to `ToolError` — it's the only exception type
+  guaranteed to reach the client with a useful message.
+
+## RFC 6570 URI templates (resources)
+
+`docs/fastmcp/docs/servers/resources.mdx` §"RFC 6570 URI Templates":
+- `{param}` — exactly one path segment, does not cross `/`.
+- `{param*}` — wildcard, captures multiple segments up to the next literal/param:
+  `@mcp.resource("path://{filepath*}")`.
+- `{?param1,param2}` — form-style query params (v2.13.0+). Must map to *optional* (defaulted)
+  function params; path params must map to *required* params:
+  ```python
+  @mcp.resource("data://{id}{?format}")
+  def get_data(id: str, format: str = "json"): ...
+  ```
+  Values are auto-coerced to `int`/`float`/`bool`/`str` per type hint.
+
+## Return type: `ResourceResult`
+
+Introduced v3.0.0. `ResourceResult(contents=str|bytes|list[ResourceContent], meta=dict|None)`;
+`ResourceContent(content=Any, mime_type=str|None, meta=dict|None)`. Plain `str` becomes
+`TextResourceContents`, `bytes` becomes `BlobResourceContents` (base64-encoded). Simple resources
+can just return `str`/`bytes` directly without constructing `ResourceResult`.

morgenmcp-0.2.1/.claude/skills/fastmcp/reference/testing.md

@@ -0,0 +1,42 @@
+# Testing patterns
+
+Source: `docs/fastmcp/docs/development/tests.mdx`.
+
+## In-memory Client testing (the pattern to use)
+
+Pass the `FastMCP` server instance directly to `Client` — this runs the real MCP protocol in the
+same process, no network transport, no subprocess:
+
+```python
+from fastmcp import FastMCP, Client
+
+server = FastMCP("WeatherServer")
+
+@server.tool
+def get_temperature(city: str) -> dict:
+    return {"city": city, "temp": temps.get(city, 70)}
+
+async def test_weather_operations():
+    async with Client(server) as client:
+        result = await client.call_tool("get_temperature", {"city": "NYC"})
+        assert result.data == {"city": "NYC", "temp": 72}
+```
+
+**Don't open `Client` inside a pytest fixture** — event-loop lifecycle issues. Only build/return
+the server instance from fixtures; open the `Client` context manager inside the test function
+itself.
+
+This is exactly the pattern MorgenMCP's `test_mcp_server.py` uses: `fastmcp.Client(mcp)` against
+the real server object, with `MORGENMCP_DATA_DIR=tmp_path` to isolate the persistent ID store.
+
+## Real network transport (rarely needed)
+
+Two options, in order of preference:
+- `fastmcp.utilities.tests.run_server_async(server) as url` — in-process, async context manager.
+  Prefer this when you actually need a URL (e.g. testing HTTP-specific behavior).
+- `run_server_in_process` — spawns a real subprocess. Only use when true process isolation is
+  required (e.g. testing stdio transport specifically, or crash isolation).
+
+MorgenMCP doesn't currently need either — all tests go through the in-memory `Client` pattern or
+mock the HTTP client directly (`test_client.py` via `@respx.mock`, `test_tools.py` via
+`patch("morgenmcp.tools.*.get_client")`).

morgenmcp-0.2.1/.github/dependabot.yml

@@ -0,0 +1,32 @@
+# Low-maintenance Dependabot config: monthly, grouped updates so a quiet month
+# yields one PR per ecosystem. Submodules and pre-commit hooks are left out on
+# purpose (submodules are version-pinned; stale hooks are harmless).
+version: 2
+
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      python-minor-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    ignore:
+      # fastmcp is submodule-pinned; only patch bumps are wanted here.
+      - dependency-name: fastmcp
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "chore(ci)"
+    groups:
+      actions:
+        patterns: ["*"]

morgenmcp-0.2.1/.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.14"]
+        include:
+          # Also test requires-python's floor, so newer syntax fails here.
+          - os: ubuntu-latest
+            python-version: "3.12"
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --all-extras
+
+      - name: Lint with ruff
+        run: uv run ruff check .
+
+      - name: Check formatting with ruff
+        run: uv run ruff format --check .
+
+      - name: Type check with pyright
+        run: uv run pyright
+
+      - name: Run tests
+        run: uv run pytest

morgenmcp-0.2.1/.github/workflows/release.yml

@@ -0,0 +1,48 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+      
+      - name: Install dependencies
+        run: uv sync --all-extras
+      
+      - name: Run tests
+        run: uv run pytest
+
+  release:
+    needs: test
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create ${{ github.ref_name }} dist/* --generate-notes --title "${{ github.ref_name }}"
+
+      - name: Publish to PyPI
+        run: uv publish

morgenmcp-0.2.1/.gitignore

@@ -0,0 +1,65 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Virtual environments
+.venv/
+venv/
+ENV/
+
+# PyCharm / JetBrains IDEs
+.idea/
+
+# Junie (JetBrains AI assistant)
+.junie/
+
+# VS Code
+.vscode/
+
+# Editor swap files
+*.swp
+*.swo
+*~
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+.tox/
+.nox/
+
+# Local settings and secrets — track shared config, ignore the rest
+.claude/*
+!.claude/settings.json
+!.claude/hooks
+!.claude/skills
+.env
+.env.local
+*.env
+.envrc
+mise.local.toml
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Generated at build time by hatch-vcs (see [tool.hatch.build.hooks.vcs])
+morgenmcp/_version.py

morgenmcp-0.2.1/.gitmodules

@@ -0,0 +1,8 @@
+[submodule "docs/morgen-dev-docs"]
+	path = docs/morgen-dev-docs
+	url = https://github.com/morgen-so/morgen-dev-docs.git
+
+[submodule "docs/fastmcp"]
+	path = docs/fastmcp
+	url = https://github.com/jlowin/fastmcp.git
+	shallow = true

morgenmcp-0.2.1/.pre-commit-config.yaml

@@ -0,0 +1,11 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.6
+    hooks:
+      - id: ruff
+        args: [--fix]
+      - id: ruff-format
+  - repo: https://github.com/RobertCraigie/pyright-python
+    rev: v1.1.408
+    hooks:
+      - id: pyright

morgenmcp-0.2.1/.python-version

@@ -0,0 +1 @@
+3.12