mq-sentinel 0.3.0__tar.gz

mq_sentinel-0.3.0/.github/ISSUE_TEMPLATE/bug_report 2.md

@@ -0,0 +1,37 @@
+---
+name: Bug report
+about: Report a problem with MQ-Sentinel
+title: "[bug] "
+labels: bug
+assignees: ''
+---
+
+## Describe the bug
+
+A clear description of what is wrong.
+
+## To Reproduce
+
+Steps to reproduce the behavior:
+
+1. Run `...`
+2. Call tool `...`
+3. See error
+
+## Expected behavior
+
+What you expected to happen.
+
+## Environment
+
+- MQ-Sentinel version: (run `mq-sentinel version`)
+- Python version:
+- Deployment: (stdio / http / Helm / package / docker)
+- Environment: dev / staging / prod
+- Real QM or demo fixtures?
+
+## Additional context / logs
+
+Add any logs, sanitized output, or screenshots.
+
+**Important**: Never paste real queue manager names, channel names, or sensitive data without sanitizing.

mq_sentinel-0.3.0/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,37 @@
+---
+name: Bug report
+about: Report a problem with MQ-Sentinel
+title: "[bug] "
+labels: bug
+assignees: ''
+---
+
+## Describe the bug
+
+A clear description of what is wrong.
+
+## To Reproduce
+
+Steps to reproduce the behavior:
+
+1. Run `...`
+2. Call tool `...`
+3. See error
+
+## Expected behavior
+
+What you expected to happen.
+
+## Environment
+
+- MQ-Sentinel version: (run `mq-sentinel version`)
+- Python version:
+- Deployment: (stdio / http / Helm / package / docker)
+- Environment: dev / staging / prod
+- Real QM or demo fixtures?
+
+## Additional context / logs
+
+Add any logs, sanitized output, or screenshots.
+
+**Important**: Never paste real queue manager names, channel names, or sensitive data without sanitizing.

mq_sentinel-0.3.0/.github/ISSUE_TEMPLATE/config 2.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/pramodreddyboddu/mq-sentinel/security/advisories/new
+    about: Please report security issues privately.
+  - name: Discussions
+    url: https://github.com/pramodreddyboddu/mq-sentinel/discussions
+    about: General questions, ideas, and usage help.

mq_sentinel-0.3.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/pramodreddyboddu/mq-sentinel/security/advisories/new
+    about: Please report security issues privately.
+  - name: Discussions
+    url: https://github.com/pramodreddyboddu/mq-sentinel/discussions
+    about: General questions, ideas, and usage help.

mq_sentinel-0.3.0/.github/ISSUE_TEMPLATE/feature_request 2.md

@@ -0,0 +1,25 @@
+---
+name: Feature / Diagnostic request
+about: Suggest a new tool, matcher, or improvement
+title: "[feature] "
+labels: enhancement
+assignees: ''
+---
+
+## Is your feature request related to a problem?
+
+A clear description of the problem you're facing (e.g. hard-to-diagnose Native HA split-brain in production).
+
+## Describe the solution you'd like
+
+What new behavior or tool would help?
+
+## Additional context
+
+- Which MQ topology?
+- Example MQSC output or error (sanitized)?
+- Would this be useful for others in banks/telcos/etc.?
+
+## Owner note
+
+New diagnostics must stay strictly read-only and come with verified IBM Knowledge Center citations where possible.

mq_sentinel-0.3.0/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,25 @@
+---
+name: Feature / Diagnostic request
+about: Suggest a new tool, matcher, or improvement
+title: "[feature] "
+labels: enhancement
+assignees: ''
+---
+
+## Is your feature request related to a problem?
+
+A clear description of the problem you're facing (e.g. hard-to-diagnose Native HA split-brain in production).
+
+## Describe the solution you'd like
+
+What new behavior or tool would help?
+
+## Additional context
+
+- Which MQ topology?
+- Example MQSC output or error (sanitized)?
+- Would this be useful for others in banks/telcos/etc.?
+
+## Owner note
+
+New diagnostics must stay strictly read-only and come with verified IBM Knowledge Center citations where possible.

mq_sentinel-0.3.0/.github/PULL_REQUEST_TEMPLATE 2.md

@@ -0,0 +1,35 @@
+## Description
+
+<!-- What does this PR do? Why is it needed? Link any related issues. -->
+
+## Type of change
+
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature / diagnostic (non-breaking)
+- [ ] Documentation only
+- [ ] Refactor / internal cleanup
+- [ ] Security-related (please call out explicitly)
+
+## How was this tested?
+
+- [ ] `make ci` passes locally
+- [ ] Added/updated unit tests
+- [ ] Added/updated integration tests (fixtures)
+- [ ] Security tests still green (`make security`)
+- [ ] Manually tested with `make demo` and/or real QM
+- [ ] Updated docs / README / VISION if user-facing
+
+## Checklist
+
+- [ ] My changes respect the read-only contract and sanitizer
+- [ ] No new external URLs without updating KC verification
+- [ ] I considered the threat model / RBAC impact
+- [ ] CHANGELOG.md updated (if applicable)
+
+## Screenshots / Output (if relevant)
+
+<!-- Paste example output from the tool or demo -->
+
+---
+
+**Note from owner**: High standards here. If you're unsure about security implications, open an issue first.

mq_sentinel-0.3.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,35 @@
+## Description
+
+<!-- What does this PR do? Why is it needed? Link any related issues. -->
+
+## Type of change
+
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature / diagnostic (non-breaking)
+- [ ] Documentation only
+- [ ] Refactor / internal cleanup
+- [ ] Security-related (please call out explicitly)
+
+## How was this tested?
+
+- [ ] `make ci` passes locally
+- [ ] Added/updated unit tests
+- [ ] Added/updated integration tests (fixtures)
+- [ ] Security tests still green (`make security`)
+- [ ] Manually tested with `make demo` and/or real QM
+- [ ] Updated docs / README / VISION if user-facing
+
+## Checklist
+
+- [ ] My changes respect the read-only contract and sanitizer
+- [ ] No new external URLs without updating KC verification
+- [ ] I considered the threat model / RBAC impact
+- [ ] CHANGELOG.md updated (if applicable)
+
+## Screenshots / Output (if relevant)
+
+<!-- Paste example output from the tool or demo -->
+
+---
+
+**Note from owner**: High standards here. If you're unsure about security implications, open an issue first.

mq_sentinel-0.3.0/.github/workflows/ci.yml

@@ -0,0 +1,80 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  security-events: write
+  id-token: write
+
+jobs:
+  lint-type-test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+      - name: Set up Python
+        run: uv python install ${{ matrix.python-version }}
+      - name: Install
+        run: uv sync --all-extras --dev
+      - name: Ruff (lint)
+        run: uv run ruff check .
+      - name: Ruff (format check)
+        run: uv run ruff format --check .
+      - name: Mypy
+        run: uv run mypy
+      - name: Pytest
+        run: uv run pytest -q
+      - name: Security tests (must be green)
+        run: uv run pytest -q -m security
+
+  sbom-and-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+      - run: uv sync --all-extras --dev
+      - name: pip-audit (deps CVE scan)
+        run: uv run pip-audit --strict
+      - name: CycloneDX SBOM
+        run: uv run cyclonedx-py requirements --of json --output sbom.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: sbom.json
+
+  image-build-scan-sign:
+    runs-on: ubuntu-latest
+    needs: [lint-type-test, sbom-and-audit]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build image
+        run: docker build -f deploy/Dockerfile -t ghcr.io/${{ github.repository }}:${{ github.sha }} .
+      - name: Trivy scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ghcr.io/${{ github.repository }}:${{ github.sha }}
+          severity: HIGH,CRITICAL
+          exit-code: "1"
+          ignore-unfixed: true
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+      - name: Push + sign
+        run: |
+          docker push ghcr.io/${{ github.repository }}:${{ github.sha }}
+          cosign sign --yes ghcr.io/${{ github.repository }}:${{ github.sha }}

mq_sentinel-0.3.0/.github/workflows/pages.yml

@@ -0,0 +1,33 @@
+name: deploy-landing-page
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "web/**"
+      - ".github/workflows/pages.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/configure-pages@v5
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: ./web
+      - id: deployment
+        uses: actions/deploy-pages@v4

mq_sentinel-0.3.0/.github/workflows/release.yml

@@ -0,0 +1,95 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+
+permissions:
+  contents: write     # to create releases
+  packages: write     # to push to ghcr
+  id-token: write     # cosign keyless
+
+jobs:
+  build-image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Compute tag
+        id: tag
+        run: echo "tag=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+      - name: Build + push image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: deploy/Dockerfile
+          push: true
+          tags: |
+            ghcr.io/${{ github.repository }}:${{ steps.tag.outputs.tag }}
+            ghcr.io/${{ github.repository }}:latest
+      - name: Trivy scan (HIGH+CRITICAL fail)
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ghcr.io/${{ github.repository }}:${{ steps.tag.outputs.tag }}
+          severity: HIGH,CRITICAL
+          exit-code: "1"
+          ignore-unfixed: true
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+      - name: Sign image
+        run: cosign sign --yes ghcr.io/${{ github.repository }}:${{ steps.tag.outputs.tag }}
+
+  build-pkgs:
+    runs-on: ubuntu-latest
+    container: rockylinux:9
+    steps:
+      - name: Install builders
+        run: |
+          dnf install -y --setopt=install_weak_deps=False \
+              python3.12 python3.12-devel python3.12-pip \
+              ruby ruby-devel rpm-build dpkg gcc make tar git ca-certificates curl
+          gem install --no-document fpm
+      - uses: actions/checkout@v4
+      - name: Install uv
+        run: curl -LsSf https://astral.sh/uv/install.sh | sh
+      - name: Build RPM + DEB
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          make pkg
+      - name: Generate CycloneDX SBOM
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          uv run cyclonedx-py requirements --of json --output dist/sbom.json || true
+      - uses: actions/upload-artifact@v4
+        with:
+          name: packages
+          path: |
+            dist/pkg/*.rpm
+            dist/pkg/*.deb
+            dist/sbom.json
+
+  publish-release:
+    needs: [build-image, build-pkgs]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: packages
+          path: dist/
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: |
+            dist/pkg/*.rpm
+            dist/pkg/*.deb
+            dist/sbom.json

mq_sentinel-0.3.0/.github/workflows/security.yml

@@ -0,0 +1,30 @@
+name: security-scheduled
+
+on:
+  schedule:
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  deps-cve:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+      - run: uv sync --all-extras --dev
+      - run: uv run pip-audit --strict
+
+  trivy-fs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: fs
+          severity: HIGH,CRITICAL
+          exit-code: "1"
+          ignore-unfixed: true

mq_sentinel-0.3.0/.github/workflows/verify-kc-links.yml

@@ -0,0 +1,23 @@
+name: verify-kc-links
+
+# Every IBM Knowledge Center URL we cite must resolve. IBM reorganizes docs
+# periodically; this catches a dead link within a day instead of via an angry
+# customer. Network-dependent, so it's a scheduled job — NOT a PR gate.
+
+on:
+  schedule:
+    - cron: "0 7 * * *" # daily 07:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-links:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+      - run: uv sync --extra dev
+      - name: Verify every KC URL resolves
+        run: uv run python scripts/verify_kc_links.py

mq_sentinel-0.3.0/.gitignore

@@ -0,0 +1,30 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+.env
+.env.*
+!.env.example
+dist/
+build/
+.coverage
+coverage.xml
+htmlcov/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.DS_Store
+*.log
+audit-*.jsonl
+sbom.json
+*.crt
+*.key
+*.pem
+*.kdb
+*.sth
+*.rdb
+secrets/
+.claude/
+output/
+tmp/

mq_sentinel-0.3.0/.grok/config 2.toml

@@ -0,0 +1,9 @@
+# Project-scoped MCP so Grok launched from this repo can use MQ-Sentinel.
+# Requires `uv` on PATH. Demo/fixture mode — no live IBM MQ.
+
+[mcp_servers.mq-sentinel]
+command = "uv"
+args = ["run", "mq-sentinel", "serve"]
+env = { MQS_AUTH_DISABLE_AUTH_FOR_LOCAL_DEV = "true", MQS_SERVER_ENVIRONMENT = "dev" }
+enabled = true
+startup_timeout_sec = 60

mq_sentinel-0.3.0/.grok/config.toml

@@ -0,0 +1,9 @@
+# Project-scoped MCP so Grok launched from this repo can use MQ-Sentinel.
+# Requires `uv` on PATH. Demo/fixture mode — no live IBM MQ.
+
+[mcp_servers.mq-sentinel]
+command = "uv"
+args = ["run", "mq-sentinel", "serve"]
+env = { MQS_AUTH_DISABLE_AUTH_FOR_LOCAL_DEV = "true", MQS_SERVER_ENVIRONMENT = "dev" }
+enabled = true
+startup_timeout_sec = 60

mq_sentinel-0.3.0/CHANGELOG.md

@@ -0,0 +1,54 @@
+# Changelog
+
+All notable changes to MQ-Sentinel are documented here. The format is loosely based on
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+---
+
+## [Unreleased] — MCP distribution (any client)
+
+- Official MCP Registry manifest at repo-root `server.json` (`io.github.pramodreddyboddu/mq-sentinel`).
+- Docker label `io.modelcontextprotocol.server.name` required by the official registry.
+- README `mcp-name` marker so a future PyPI package can be verified.
+- `docs/mcp-clients.md` — copy-paste install for Grok, Claude Desktop, Claude Code, Cursor, Gemini CLI, ChatGPT.
+- Project-scoped `.grok/config.toml` so Grok launched from this repo loads MQ-Sentinel.
+- Replaced the fake `@modelcontextprotocol/server-mq-sentinel` npm snippet.
+- Registry submit path rewritten: official registry first, then Smithery — not the old servers README PR.
+
+## [Unreleased] — Owner Polish & DX (Full Ownership Mode)
+
+Treated the project as a long-term owned artifact:
+- Added `mq-sentinel tools` command — clean discovery of all diagnostics.
+- Added `mq-sentinel doctor` — environment, pymqi, config, and audit path self-check.
+- Added professional GitHub templates (PULL_REQUEST_TEMPLATE, bug/feature issue templates).
+- Added VISION.md (owner principles, success criteria, roadmap philosophy).
+- Added CONTRIBUTING.md with high bar for security-sensitive changes.
+- Added DEVELOPMENT.md — detailed owner-level guide for contributors and future maintainers.
+- Updated mcp-manifest.json, smithery metadata, CLI help text, and README for stronger owned-product voice.
+- Consistent maintainer/author metadata across packaging.
+
+These are additive, non-breaking improvements focused on discoverability, contributor experience, and long-term ownership quality.
+
+## [Unreleased] — Org-Readiness Hardening
+
+Major push to make MQ-Sentinel production- and org-ready for mid-to-large enterprises.
+
+### Added
+- Comprehensive Org-Readiness Plan (docs/ORG-READINESS-PLAN.md) with 7 phases.
+- `docs/getting-started-platform-teams.md`, `docs/onboard-new-qm.md`, `docs/rbac-best-practices.md`.
+- `docs/compliance/soc2-evidence-checklist.md`.
+- Enhanced SECURITY_POSTURE.md and PRODUCTION.md (SLOs, full enterprise checklist).
+- `docs/oidc-examples.md` with real IdP configs (Okta, Entra ID, Keycloak).
+- `docs/metrics.md`.
+- Helm improvements: HPA, ServiceMonitor, Ingress template, affinity, production values, ServiceAccount support.
+- Fleet-scale inventory: `load_from_multiple` and directory loading, `inventory_dir` config support.
+- Example org inventory in `examples/org/`.
+- Grafana dashboard and Prometheus alerts in `observability/`.
+- Updated smithery.yaml and launch materials with org positioning.
+- Ingress and better volume support in Helm templates.
+
+### Changed
+- Chart.yaml bumped, better metadata for orgs.
+- INSTALL.md and README updated with org focus and plan links.
+- Inventory and server enhanced for large fleets.