pywrit 0.2.7__tar.gz → 0.2.9__tar.gz

{pywrit-0.2.7/src/pywrit.egg-info → pywrit-0.2.9}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: pywrit
-Version: 0.2.7
+Version: 0.2.9
 Summary: Python client + CLI for Writ — the gate before the write
 License-Expression: MIT
-Project-URL: Homepage, https://github.com/AvenueDAdmin/pywrit
+Project-URL: Homepage, https://github.com/withwrit/pywrit
 Project-URL: Documentation, https://withwrit.com/docs
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
@@ -27,7 +27,9 @@ client and `writ` CLI for [Writ](https://withwrit.com): an allow/deny gate that
 in front of your agent's consequential writes (database, HTTP, files, email, queues,
 AWS) and records a hash-chained receipt for every decision.
 
-![writ scan finds 4 write sites in a Python agent (0/4 gated); writ scan --apply inserts gates; a re-scan shows 4/4 gated](https://raw.githubusercontent.com/AvenueDAdmin/pywrit/main/docs/assets/scan-python.gif)
+[![Listed on mcpservers.org](https://mcpservers.org/badge.svg)](https://mcpservers.org/servers/avenuedadmin/pywrit)
+
+![writ scan finds 4 write sites in a Python agent (0/4 gated); writ scan --apply inserts gates; a re-scan shows 4/4 gated](https://raw.githubusercontent.com/withwrit/pywrit/main/docs/assets/scan-python.gif)
 
 `writ scan` is **local, deterministic, and free**: it parses your code with Python's
 `ast` module, makes no network calls, and needs no API key.
@@ -52,7 +54,7 @@ first run it installs `pywrit[polyglot]` from PyPI using your Python 3.9+
 environment overrides (`WRIT_PYTHON`, `WRIT_SCAN_NO_INSTALL`), and the
 install test.
 
-## 60-second quickstart: scan → apply → gate
+## 60-second quickstart: scan → wrap → gate
 
 **1. Scan.** See which functions write, and how many of them are gated.
 
@@ -75,14 +77,17 @@ It also prints a **risk report** (0-100, weighted by risk tier), writes the disc
 verbs to `writ-policy.json`, and shows the instrumentation it would add as a unified
 diff. Nothing in your code changes yet. `writ scan . --score` prints just the risk report.
 
-**2. Apply.** Insert a gate at the top of each writing function.
+**2. Wrap.** One command takes the repo from unwrapped to wrapped: scan, show the diff,
+ask for explicit approval, apply the gates, and report before/after coverage.
 
 ```bash
-writ scan . --apply        # shows the diff, then asks before writing
-writ scan . --apply --yes  # no prompt (e.g. in CI)
+writ wrap .        # interactive approval
+writ wrap . --yes  # no prompt (e.g. in CI)
 ```
 
-Each gated function now asks Writ before it writes, and fails closed:
+`--dry-run` previews the plan and exits before prompting; `--diff-only` prints the
+unified diff for review tools. Each gated function now asks Writ before it writes, and
+fails closed:
 
 ```python
 def issue_refund(charge_id, amount_cents):
@@ -91,7 +96,8 @@ def issue_refund(charge_id, amount_cents):
     ...
 ```
 
-Re-run `writ scan .` and you'll see `gated: 4/4 (100%)`.
+`writ scan . --apply` is still available as the manual alternative. Re-run `writ scan .`
+and you'll see `gated: 4/4 (100%)`.
 
 **3. Gate.** Get a free API key, load the discovered policy, and run your agent.
 
@@ -148,11 +154,15 @@ Python scanning never needs it.
 TS/JS is **scan-only**: findings are listed with verbs for your policy file,
 but `writ scan --apply` never rewrites TS/JS files — gate those by hand.
 Covered patterns: `fetch`/`axios` writes, `fs` writes, SQL through knex-style
-clients, Prisma writes, and JS SDK calls such as `stripe.refunds.create(...)`.
+clients, Prisma writes, JS SDK calls such as `stripe.refunds.create(...)`, and
+generated REST resource clients: `create` / `update` / `patch` / `remove`
+methods (plus their `...WithHttpInfo` variants) that build request options
+with an explicit write HTTP method and route them through the client request
+pipeline (twilio-style generated clients, e.g. `twilio-node`).
 (Still not covered: the *Python* SDK equivalents like `stripe.Refund.create(...)`
 — see "Not covered" above.)
 
-![writ scan on a TypeScript agent finds 5 write sites, 1 of 5 gated](https://raw.githubusercontent.com/AvenueDAdmin/pywrit/main/docs/assets/scan-tsjs.gif)
+![writ scan on a TypeScript agent finds 5 write sites, 1 of 5 gated](https://raw.githubusercontent.com/withwrit/pywrit/main/docs/assets/scan-tsjs.gif)
 
 ## GitHub Action
 
@@ -163,7 +173,7 @@ job summary. The check fails when an ungated finding meets your
 
 ```yaml
 - uses: actions/checkout@v4
-- uses: AvenueDAdmin/pywrit@v0
+- uses: withwrit/pywrit@v0
   with:
     fail-on-risk: high   # high | medium | low | never
 ```
@@ -171,6 +181,46 @@ job summary. The check fails when an ungated finding meets your
 No API key needed. Full reference: [docs/github-action.md](docs/github-action.md) ·
 example workflow: [examples/github-action/writ-scan.yml](examples/github-action/writ-scan.yml)
 
+## GitHub App
+
+Install the [Writ GitHub App](https://docs.withwrit.com/git-hub-app) on selected
+repositories: every push and pull request is scanned for ungated write-sites,
+with results as a check run on the PR and in the
+[portal](https://app.withwrit.com), where you manage policy, keys, and the audit log.
+
+## MCP server (`writ-mcp`)
+
+Give any MCP-compatible agent point-of-action policy checks. `writ-mcp` is a
+[Model Context Protocol](https://modelcontextprotocol.io) server (stdio transport,
+built on the MCP Python SDK) that exposes the Writ gate as **8 MCP tools**:
+the agent calls `writ_check` before a consequential write and gets back `ALLOW`,
+`DENY`, or `STEP_UP` — with a tamper-evident, hash-chained audit receipt for
+every decision.
+
+```bash
+uvx writ-mcp            # no install — runs on demand
+# or
+pip install writ-mcp   # then run `writ-mcp`
+```
+
+| Tool | What it does |
+|---|---|
+| `writ_check` | The gate: `ALLOW` / `DENY` / `STEP_UP` for a proposed write |
+| `writ_verify_token` | Validate an `ALLOW` auth token (catches purpose drift) |
+| `writ_grant` | Human-sponsor approval for the `STEP_UP` path |
+| `writ_revoke` / `writ_reinstate` | The kill switch |
+| `writ_receipts` | Read the tenant's audit log |
+| `writ_policy` | Manage the verb policy |
+| `writ_sandbox` | Keyless 90-second demo grant — no API key needed |
+
+The gate tools need a free Writ API key (`WRIT_API_KEY`): 10,000 receipts/month
+free, no credit card. `writ_sandbox` works with no key at all.
+
+The server implementation lives in [`mcp/`](mcp/) (MIT). Also published on the
+official MCP Registry as `io.github.withwrit/writ`, on
+[Smithery](https://smithery.ai/server/withwrit/writ-mcp), and listed on
+[Glama](https://glama.ai/mcp/servers/withwrit/pywrit).
+
 ## Python client
 
 ```python
@@ -223,6 +273,9 @@ What's covered:
 ## CLI reference
 
 ```bash
+writ wrap .                         # scan, diff, approve, apply, verify coverage
+writ wrap . --dry-run               # preview only
+writ wrap . --yes                   # non-interactive CI mode
 writ check --key writ_... --sponsor acme --agent agent-7 \
   --verb db.write --target prod.customers --purpose "backfill region field"
 writ policy --key writ_... --set payments.refund require_grant
@@ -241,7 +294,7 @@ Show that your agent's writes are gated by Writ. Two flavors:
 **Static** (works today, no API key) — same design, no live count:
 
 ```md
-[![agent writes gated by Writ](https://cdn.jsdelivr.net/gh/AvenueDAdmin/pywrit@main/badge/writ-gated.svg)](https://withwrit.com)
+[![agent writes gated by Writ](https://cdn.jsdelivr.net/gh/withwrit/pywrit@main/badge/writ-gated.svg)](https://withwrit.com)
 ```
 
 **Dynamic** (live 30-day gated-write count from your audit log) — mint a badge

{pywrit-0.2.7 → pywrit-0.2.9}/README.md

@@ -5,7 +5,9 @@ client and `writ` CLI for [Writ](https://withwrit.com): an allow/deny gate that
 in front of your agent's consequential writes (database, HTTP, files, email, queues,
 AWS) and records a hash-chained receipt for every decision.
 
-![writ scan finds 4 write sites in a Python agent (0/4 gated); writ scan --apply inserts gates; a re-scan shows 4/4 gated](https://raw.githubusercontent.com/AvenueDAdmin/pywrit/main/docs/assets/scan-python.gif)
+[![Listed on mcpservers.org](https://mcpservers.org/badge.svg)](https://mcpservers.org/servers/avenuedadmin/pywrit)
+
+![writ scan finds 4 write sites in a Python agent (0/4 gated); writ scan --apply inserts gates; a re-scan shows 4/4 gated](https://raw.githubusercontent.com/withwrit/pywrit/main/docs/assets/scan-python.gif)
 
 `writ scan` is **local, deterministic, and free**: it parses your code with Python's
 `ast` module, makes no network calls, and needs no API key.
@@ -30,7 +32,7 @@ first run it installs `pywrit[polyglot]` from PyPI using your Python 3.9+
 environment overrides (`WRIT_PYTHON`, `WRIT_SCAN_NO_INSTALL`), and the
 install test.
 
-## 60-second quickstart: scan → apply → gate
+## 60-second quickstart: scan → wrap → gate
 
 **1. Scan.** See which functions write, and how many of them are gated.
 
@@ -53,14 +55,17 @@ It also prints a **risk report** (0-100, weighted by risk tier), writes the disc
 verbs to `writ-policy.json`, and shows the instrumentation it would add as a unified
 diff. Nothing in your code changes yet. `writ scan . --score` prints just the risk report.
 
-**2. Apply.** Insert a gate at the top of each writing function.
+**2. Wrap.** One command takes the repo from unwrapped to wrapped: scan, show the diff,
+ask for explicit approval, apply the gates, and report before/after coverage.
 
 ```bash
-writ scan . --apply        # shows the diff, then asks before writing
-writ scan . --apply --yes  # no prompt (e.g. in CI)
+writ wrap .        # interactive approval
+writ wrap . --yes  # no prompt (e.g. in CI)
 ```
 
-Each gated function now asks Writ before it writes, and fails closed:
+`--dry-run` previews the plan and exits before prompting; `--diff-only` prints the
+unified diff for review tools. Each gated function now asks Writ before it writes, and
+fails closed:
 
 ```python
 def issue_refund(charge_id, amount_cents):
@@ -69,7 +74,8 @@ def issue_refund(charge_id, amount_cents):
     ...
 ```
 
-Re-run `writ scan .` and you'll see `gated: 4/4 (100%)`.
+`writ scan . --apply` is still available as the manual alternative. Re-run `writ scan .`
+and you'll see `gated: 4/4 (100%)`.
 
 **3. Gate.** Get a free API key, load the discovered policy, and run your agent.
 
@@ -126,11 +132,15 @@ Python scanning never needs it.
 TS/JS is **scan-only**: findings are listed with verbs for your policy file,
 but `writ scan --apply` never rewrites TS/JS files — gate those by hand.
 Covered patterns: `fetch`/`axios` writes, `fs` writes, SQL through knex-style
-clients, Prisma writes, and JS SDK calls such as `stripe.refunds.create(...)`.
+clients, Prisma writes, JS SDK calls such as `stripe.refunds.create(...)`, and
+generated REST resource clients: `create` / `update` / `patch` / `remove`
+methods (plus their `...WithHttpInfo` variants) that build request options
+with an explicit write HTTP method and route them through the client request
+pipeline (twilio-style generated clients, e.g. `twilio-node`).
 (Still not covered: the *Python* SDK equivalents like `stripe.Refund.create(...)`
 — see "Not covered" above.)
 
-![writ scan on a TypeScript agent finds 5 write sites, 1 of 5 gated](https://raw.githubusercontent.com/AvenueDAdmin/pywrit/main/docs/assets/scan-tsjs.gif)
+![writ scan on a TypeScript agent finds 5 write sites, 1 of 5 gated](https://raw.githubusercontent.com/withwrit/pywrit/main/docs/assets/scan-tsjs.gif)
 
 ## GitHub Action
 
@@ -141,7 +151,7 @@ job summary. The check fails when an ungated finding meets your
 
 ```yaml
 - uses: actions/checkout@v4
-- uses: AvenueDAdmin/pywrit@v0
+- uses: withwrit/pywrit@v0
   with:
     fail-on-risk: high   # high | medium | low | never
 ```
@@ -149,6 +159,46 @@ job summary. The check fails when an ungated finding meets your
 No API key needed. Full reference: [docs/github-action.md](docs/github-action.md) ·
 example workflow: [examples/github-action/writ-scan.yml](examples/github-action/writ-scan.yml)
 
+## GitHub App
+
+Install the [Writ GitHub App](https://docs.withwrit.com/git-hub-app) on selected
+repositories: every push and pull request is scanned for ungated write-sites,
+with results as a check run on the PR and in the
+[portal](https://app.withwrit.com), where you manage policy, keys, and the audit log.
+
+## MCP server (`writ-mcp`)
+
+Give any MCP-compatible agent point-of-action policy checks. `writ-mcp` is a
+[Model Context Protocol](https://modelcontextprotocol.io) server (stdio transport,
+built on the MCP Python SDK) that exposes the Writ gate as **8 MCP tools**:
+the agent calls `writ_check` before a consequential write and gets back `ALLOW`,
+`DENY`, or `STEP_UP` — with a tamper-evident, hash-chained audit receipt for
+every decision.
+
+```bash
+uvx writ-mcp            # no install — runs on demand
+# or
+pip install writ-mcp   # then run `writ-mcp`
+```
+
+| Tool | What it does |
+|---|---|
+| `writ_check` | The gate: `ALLOW` / `DENY` / `STEP_UP` for a proposed write |
+| `writ_verify_token` | Validate an `ALLOW` auth token (catches purpose drift) |
+| `writ_grant` | Human-sponsor approval for the `STEP_UP` path |
+| `writ_revoke` / `writ_reinstate` | The kill switch |
+| `writ_receipts` | Read the tenant's audit log |
+| `writ_policy` | Manage the verb policy |
+| `writ_sandbox` | Keyless 90-second demo grant — no API key needed |
+
+The gate tools need a free Writ API key (`WRIT_API_KEY`): 10,000 receipts/month
+free, no credit card. `writ_sandbox` works with no key at all.
+
+The server implementation lives in [`mcp/`](mcp/) (MIT). Also published on the
+official MCP Registry as `io.github.withwrit/writ`, on
+[Smithery](https://smithery.ai/server/withwrit/writ-mcp), and listed on
+[Glama](https://glama.ai/mcp/servers/withwrit/pywrit).
+
 ## Python client
 
 ```python
@@ -201,6 +251,9 @@ What's covered:
 ## CLI reference
 
 ```bash
+writ wrap .                         # scan, diff, approve, apply, verify coverage
+writ wrap . --dry-run               # preview only
+writ wrap . --yes                   # non-interactive CI mode
 writ check --key writ_... --sponsor acme --agent agent-7 \
   --verb db.write --target prod.customers --purpose "backfill region field"
 writ policy --key writ_... --set payments.refund require_grant
@@ -219,7 +272,7 @@ Show that your agent's writes are gated by Writ. Two flavors:
 **Static** (works today, no API key) — same design, no live count:
 
 ```md
-[![agent writes gated by Writ](https://cdn.jsdelivr.net/gh/AvenueDAdmin/pywrit@main/badge/writ-gated.svg)](https://withwrit.com)
+[![agent writes gated by Writ](https://cdn.jsdelivr.net/gh/withwrit/pywrit@main/badge/writ-gated.svg)](https://withwrit.com)
 ```
 
 **Dynamic** (live 30-day gated-write count from your audit log) — mint a badge

{pywrit-0.2.7 → pywrit-0.2.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pywrit"
-version = "0.2.7"
+version = "0.2.9"
 description = "Python client + CLI for Writ — the gate before the write"
 readme = "README.md"
 license = "MIT"
@@ -22,7 +22,7 @@ polyglot = [
 keywords = ["ai-agents", "policy", "audit-log", "guardrails"]
 
 [project.urls]
-Homepage = "https://github.com/AvenueDAdmin/pywrit"
+Homepage = "https://github.com/withwrit/pywrit"
 Documentation = "https://withwrit.com/docs"
 
 [project.scripts]

{pywrit-0.2.7 → pywrit-0.2.9}/src/pywrit/__init__.py

@@ -27,7 +27,7 @@ from .errors import (
     WritError,
 )
 
-__version__ = "0.2.7"
+__version__ = "0.2.8"
 
 __all__ = [
     "WritClient",