qsp-client 0.3.0__tar.gz

qsp_client-0.3.0/.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+# Cancel superseded runs on the same ref (push or PR) so we don't waste
+# minutes when commits land in rapid succession.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: pytest (${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install package + test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+          pip install pytest pytest-asyncio
+
+      - name: Run unit tests (L2)
+        run: python -m pytest tests --ignore=tests/test_security.py -v
+
+      - name: Run security tests
+        run: python -m pytest tests/test_security.py -v
+
+  ci-all-green:
+    name: ci-all-green
+    needs: [test]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Verify required jobs all succeeded
+        run: |
+          if [[ "${{ needs.test.result }}" != "success" ]]; then
+            echo "FAIL: test matrix did not all succeed (result=${{ needs.test.result }})"
+            exit 1
+          fi
+          echo "All required CI jobs passed."

qsp_client-0.3.0/.github/workflows/publish-shim.yml

@@ -0,0 +1,67 @@
+name: Publish the qsp-mcp rename shim
+
+# Run once, by hand, after qsp-client 0.3.0 is published everywhere:
+#   1. publish qsp-mcp 0.3.0 to PyPI: no code, it installs qsp-client
+#   2. mark the old io.github.qso-graph/qsp-mcp Registry entry deprecated,
+#      pointing to io.github.qso-graph/qsp-client
+# Needs qsp-mcp's PyPI trusted publisher set to this repo and this workflow.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  shim:
+    name: Publish qsp-mcp 0.3.0 (installs qsp-client)
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: qsp-client must already be on PyPI
+        run: |
+          WANT="$(grep -m1 '"qsp-client>=' shim/pyproject.toml | sed -E 's/.*>=([0-9.]+).*/\1/')"
+          HAVE="$(curl -fsS https://pypi.org/pypi/qsp-client/json | jq -r '.info.version')"
+          echo "shim needs qsp-client>=${WANT}; PyPI has ${HAVE}"
+          python3 -c "import sys; v=lambda s: tuple(map(int, s.split('.'))); sys.exit(0 if v('${HAVE}') >= v('${WANT}') else 1)"
+
+      - name: Build the shim
+        run: |
+          pip install build
+          python -m build shim --outdir dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  deprecate:
+    name: Deprecate the old Registry entry
+    needs: shim
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Install mcp-publisher
+        run: |
+          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+          ./mcp-publisher --help > /dev/null
+
+      - name: The new entry must already be in the Registry
+        run: |
+          REG="$(curl -fsS 'https://registry.modelcontextprotocol.io/v0/servers?search=io.github.qso-graph/qsp-client&version=latest' | jq -r '[.servers[] | select(.server.name == "io.github.qso-graph/qsp-client")][0].server.version // empty')"
+          echo "io.github.qso-graph/qsp-client in the Registry: ${REG:-none}"
+          [ -n "$REG" ]
+
+      - name: Authenticate to MCP Registry (GitHub OIDC)
+        run: ./mcp-publisher login github-oidc
+
+      - name: Deprecate io.github.qso-graph/qsp-mcp
+        run: |
+          ./mcp-publisher status --status deprecated --all-versions \
+            --message "Renamed to io.github.qso-graph/qsp-client (pip install qsp-client)" \
+            io.github.qso-graph/qsp-mcp

qsp_client-0.3.0/.github/workflows/publish.yml

@@ -0,0 +1,190 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  security:
+    name: Security gates
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # PyPI publishes pyproject's version; the Registry publishes the tag's.
+      # They must be the same, or the two would disagree about what was released.
+      - name: Tag matches pyproject.toml version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PKG_VERSION="$(grep -m1 '^version' pyproject.toml | cut -d'"' -f2)"
+          echo "tag=${TAG_VERSION} pyproject=${PKG_VERSION}"
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "FAIL: tag v${TAG_VERSION} does not match pyproject.toml version ${PKG_VERSION}"
+            exit 1
+          fi
+
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install test dependencies
+        run: pip install pytest pip-audit
+
+      - name: Run security test suite
+        run: python -m pytest tests/test_security.py -v
+
+      - name: Audit dependencies for vulnerabilities
+        run: pip-audit --strict --desc 2>&1 || true
+
+      - name: Grep check — no subprocess/shell
+        run: |
+          if grep -rn 'subprocess\.\|os\.system\|shell=True' src/; then
+            echo "FAIL: subprocess/shell found in source"
+            exit 1
+          fi
+
+      - name: Grep check — no plaintext http://
+        run: |
+          if grep -rn 'http://' src/ | grep -v 'localhost\|127\.0\.0\.1\|::1\|10\.\|192\.168\.'; then
+            echo "FAIL: non-HTTPS URL found in source"
+            exit 1
+          fi
+
+      - name: Grep check — no credential logging
+        run: |
+          if grep -rn -i 'print.*password\|print.*api_key\|logging.*password\|logging.*api_key' src/; then
+            echo "FAIL: credential logging found in source"
+            exit 1
+          fi
+
+  publish:
+    name: Build and publish to PyPI
+    needs: security
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write  # Required for trusted publishing (OIDC)
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build dependencies
+        run: pip install build
+
+      - name: Build package
+        run: python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  # ---------------------------------------------------------------------------
+  # Registry-publish — pushes server.json to the Official MCP Registry after
+  # PyPI publish succeeds, so discovery surfaces stay in sync with PyPI.
+  # Canonical template: https://github.com/qso-graph/.github/blob/main/TEMPLATES.md
+  # ---------------------------------------------------------------------------
+  registry-publish:
+    name: Publish to MCP Registry
+    needs: publish  # waits for PyPI publish to succeed
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # GitHub OIDC
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install jq (server.json bump)
+        run: sudo apt-get update && sudo apt-get install -y jq
+
+      - name: Install mcp-publisher
+        run: |
+          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+          ./mcp-publisher --help > /dev/null  # smoke test
+
+      - name: Bump server.json to tag version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          echo "Setting server.json to ${TAG_VERSION}"
+          jq --arg v "$TAG_VERSION" \
+             '.version = $v | .packages[0].version = $v' \
+             server.json > /tmp/server.json
+          mv /tmp/server.json server.json
+          cat server.json
+
+      # The Registry checks PyPI itself and refuses a version PyPI isn't
+      # serving yet, which can lag the upload by a minute or more.
+      - name: Wait until PyPI serves this version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PACKAGE="$(jq -r '.packages[0].identifier' server.json)"
+          for i in $(seq 1 40); do
+            if curl -fsS "https://pypi.org/pypi/${PACKAGE}/${TAG_VERSION}/json" > /dev/null; then
+              echo "PyPI serves ${PACKAGE} ${TAG_VERSION}"
+              exit 0
+            fi
+            echo "attempt ${i}: PyPI doesn't serve ${PACKAGE} ${TAG_VERSION} yet"
+            sleep 15
+          done
+          echo "FAIL: PyPI never served ${PACKAGE} ${TAG_VERSION}"
+          exit 1
+
+      - name: Authenticate to MCP Registry (GitHub OIDC)
+        run: ./mcp-publisher login github-oidc
+
+      # Retries ride out the Registry's own transient failures. Before each
+      # retry, check whether an earlier attempt landed despite the error.
+      - name: Publish to MCP Registry
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          NAME="$(jq -r '.name' server.json)"
+          REGISTRY="https://registry.modelcontextprotocol.io/v0/servers?search=${NAME}&version=latest"
+          for i in 1 2 3 4 5; do
+            if ./mcp-publisher publish; then
+              exit 0
+            fi
+            echo "attempt ${i} failed; retrying in $((i * 30)) s"
+            sleep $((i * 30))
+            REG="$(curl -fsS "$REGISTRY" | jq -r --arg n "$NAME" '[.servers[] | select(.server.name == $n) | .server.version][0] // empty' || true)"
+            if [ "$REG" = "$TAG_VERSION" ]; then
+              echo "The Registry already has ${NAME} ${TAG_VERSION}; an earlier attempt landed"
+              exit 0
+            fi
+          done
+          echo "FAIL: the MCP Registry refused the publish 5 times"
+          exit 1
+
+  # ---------------------------------------------------------------------------
+  # Verify — a release is complete only when PyPI AND the MCP Registry both
+  # serve the tagged version. If either doesn't within 10 minutes, this run
+  # fails: a green run means published everywhere, a red one means not done.
+  # ---------------------------------------------------------------------------
+  verify:
+    name: Verify PyPI and MCP Registry
+    needs: registry-publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: PyPI and Registry serve the tagged version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PACKAGE="$(jq -r '.packages[0].identifier' server.json)"
+          NAME="$(jq -r '.name' server.json)"
+          REGISTRY="https://registry.modelcontextprotocol.io/v0/servers?search=${NAME}&version=latest"
+          for i in $(seq 1 40); do
+            PYPI="$(curl -fsS "https://pypi.org/pypi/${PACKAGE}/json" | jq -r '.info.version' || true)"
+            REG="$(curl -fsS "$REGISTRY" | jq -r --arg n "$NAME" '[.servers[] | select(.server.name == $n) | .server.version][0] // empty' || true)"
+            echo "attempt ${i}: PyPI=${PYPI:-none} Registry=${REG:-none} want=${TAG_VERSION}"
+            if [ "$PYPI" = "$TAG_VERSION" ] && [ "$REG" = "$TAG_VERSION" ]; then
+              echo "Published everywhere: ${PACKAGE} ${TAG_VERSION} on PyPI and ${NAME} ${TAG_VERSION} in the MCP Registry"
+              exit 0
+            fi
+            sleep 15
+          done
+          echo "FAIL: release incomplete. PyPI=${PYPI:-none} Registry=${REG:-none}, expected ${TAG_VERSION}"
+          exit 1

qsp_client-0.3.0/.gitignore

@@ -0,0 +1,9 @@
+__pycache__/
+*.pyc
+*.egg-info/
+dist/
+build/
+.venv/
+uv.lock
+.pytest_cache/
+.mcpregistry_*

qsp_client-0.3.0/CHANGELOG.md

@@ -0,0 +1,36 @@
+# Changelog
+
+All notable changes to `qsp-client` (formerly `qsp-mcp`) are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.3.0] — 2026-09-28
+
+### Changed
+
+- **Renamed from qsp-mcp to qsp-client.** In the MCP world, `-mcp` names mark servers, and this is a
+  client. The PyPI package, the Python module (`qsp_client`), the command, the repository and the MCP
+  Registry entry (`io.github.qso-graph/qsp-client`) all use the new name.
+- Config is read from `~/.config/qsp-client/config.json` or `~/.qsp-client.json`, then from the old
+  `~/.config/qsp-mcp/config.json` or `~/.qsp-mcp.json`, so existing setups keep working.
+- The `qsp-mcp` command still works, and says it has moved.
+- A final `qsp-mcp` 0.3.0 on PyPI has no code and installs qsp-client, so `pip install -U qsp-mcp`
+  moves users over. The old Registry entry is marked deprecated, pointing to the new one.
+
+### Added (CI hygiene)
+
+- **MCP Registry sync** — `publish.yml` publishes to the [Official MCP Registry](https://registry.modelcontextprotocol.io)
+  after each PyPI publish, using GitHub OIDC for auth. Triggered on
+  `v*` tag push; no manual steps. The Registry job waits until PyPI
+  serves the version, and retries. Pattern documented in
+  [qso-graph/.github/TEMPLATES.md](https://github.com/qso-graph/.github/blob/main/TEMPLATES.md).
+- **Registry version badge** in README.
+- **Release gates** — the tag must match `pyproject.toml`, and a
+  `verify` job fails the release unless PyPI and the MCP Registry
+  both serve the new version.
+- **CI** on pull requests (Python 3.10–3.13).
+
+## [0.2.2] and earlier
+
+Released as qsp-mcp; see the git history.