rootly-mcp-server 2.2.18__tar.gz → 2.2.20__tar.gz

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/.github/dependabot.yml

@@ -1,35 +1,51 @@
 version: 2
+
 updates:
-  - package-ecosystem: "github-actions"
+  - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 20
     cooldown:
       default-days: 3
+      semver-major-days: 7
     groups:
-      actions:
+      minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
         patterns:
           - "*"
 
-  - package-ecosystem: "pip"
+  - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 20
     cooldown:
       default-days: 3
-      semver-major-days: 7
     groups:
       minor-and-patch:
         applies-to: version-updates
         update-types:
           - "minor"
           - "patch"
+        patterns:
+          - "*"
 
-  - package-ecosystem: "docker"
+  - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 20
     cooldown:
       default-days: 3
-      semver-major-days: 7
+    groups:
+      minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+        patterns:
+          - "*"

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/.github/workflows/ci.yml

@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.12"
 
@@ -53,10 +53,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -87,13 +87,13 @@ jobs:
     name: Container Tests
     runs-on: ubuntu-latest
     needs: test
-    if: ${{ secrets.ROOTLY_API_TOKEN != '' }}
+    if: ${{ github.repository == 'Rootly-AI-Labs/rootly-mcp-server' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.12"
 
@@ -135,10 +135,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.12"
 
@@ -161,10 +161,10 @@ jobs:
     needs: [quality, test, security]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.12"
 
@@ -175,7 +175,7 @@ jobs:
         run: uv build
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: dist
           path: dist/

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/.github/workflows/dependency-review.yml

@@ -12,4 +12,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/.github/workflows/openapi-audit.yml

@@ -36,10 +36,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.12"
 
@@ -58,10 +58,10 @@ jobs:
     if: ${{ github.event_name != 'pull_request' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "3.12"
 

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/.github/workflows/pypi-release.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.12'
 

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/.gitignore

@@ -1,3 +1,7 @@
+# Benchmark and performance tracking files
+*benchmark*.json
+*_benchmark_*.json
+
 # Byte-compiled / optimized / DLL files
 __pycache__/
 *.py[cod]

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to the Rootly MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.2.20] - Released 2026-04-21
+
+### Security
+
+- **Critical Security Updates**: Upgraded vulnerable dependencies to address 3 security advisories
+- **authlib**: Updated from `1.6.9` to `1.7.0` to fix CSRF protection vulnerability (GHSA-jj8c-mmj3-mmgv)
+- **python-dotenv**: Updated from `1.1.0` to `1.2.2` to fix symlink attack vulnerability (GHSA-m8f7-34r5-grfg) 
+- **python-multipart**: Updated from `0.0.22` to `0.0.26` to fix denial of service vulnerability (CVE-2026-40347)
+- **Dependabot Configuration**: Fixed unsupported `semver-major-days` property for docker and github-actions ecosystems
+
+### Dependencies
+
+- **joserfc**: Added `1.6.4` as new dependency (required by updated authlib)
+- **Security Scanning**: All known vulnerabilities resolved as confirmed by pip-audit
+
+## [2.2.19] - Released 2026-04-17
+
+### Features
+
+- **Scoped Incident Creation Tool**: Added a custom `createIncident` tool so agents can create incidents directly from MCP without exposing the full raw `/incidents` OpenAPI surface
+
+### Documentation
+
+- **Custom Tool List Updated**: Added `createIncident` to the README custom tool section with its scoped workflow-oriented behavior
+
 ## [2.2.18] - Released 2026-04-15
 
 ### Features

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rootly-mcp-server
-Version: 2.2.18
+Version: 2.2.20
 Summary: Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation
 Project-URL: Homepage, https://github.com/Rootly-AI-Labs/Rootly-MCP-server
 Project-URL: Issues, https://github.com/Rootly-AI-Labs/Rootly-MCP-server/issues
@@ -21,7 +21,7 @@ Classifier: Topic :: Software Development :: Build Tools
 Classifier: Topic :: System :: Monitoring
 Classifier: Topic :: System :: Systems Administration
 Requires-Python: >=3.12
-Requires-Dist: authlib>=1.6.9
+Requires-Dist: authlib>=1.6.11
 Requires-Dist: brotli>=1.2.0
 Requires-Dist: cryptography>=46.0.7
 Requires-Dist: fastmcp[code-mode]==3.2.0
@@ -29,6 +29,8 @@ Requires-Dist: httpx==0.28.1
 Requires-Dist: numpy>=1.24.0
 Requires-Dist: pydantic==2.12.5
 Requires-Dist: pygments>=2.20.0
+Requires-Dist: python-dotenv>=1.2.2
+Requires-Dist: python-multipart>=0.0.26
 Requires-Dist: requests==2.33.1
 Requires-Dist: scikit-learn>=1.3.0
 Provides-Extra: dev
@@ -276,36 +278,6 @@ Add to `claude_desktop_config.json`:
 
 </details>
 
-## ChatGPT App Starter
-
-The server now includes a built-in ChatGPT app surface for incident exploration.
-
-- **Model-visible app tool:** `open_rootly_incident_workbench`
-- **App-only detail tool:** `get_rootly_incident_detail`
-- **UI resource:** `ui://rootly/incident-workbench.html`
-
-This gives ChatGPT a visual Rootly incident workbench without needing a separate backend.
-
-### What it does
-
-- Applies structured incident filters such as team, time range, severity, and status
-- Collects a bounded set of incident summaries for the widget
-- Lets the widget open a detailed incident pane without exposing the detail tool to the model
-
-### Try it in ChatGPT Developer Mode
-
-Once the MCP server is connected in ChatGPT Developer Mode, try prompts like:
-
-- `Open the Rootly incident workbench for Infrastructure incidents from the last 7 days`
-- `Show me resolved critical incidents for Infrastructure from April 1 through April 13`
-- `Open the Rootly incident workbench for database timeout incidents`
-
-### Production auth note
-
-For internal testing and developer-mode setups, the existing bearer-token flow is enough.
-
-For a public ChatGPT app that exposes customer-specific data or write actions, plan to add OAuth 2.1 support on the MCP side before submission. The current Rootly MCP server forwards bearer tokens, but public Apps SDK submissions expect OAuth 2.1-compatible MCP authorization metadata and token verification.
-
 ## Rootly CLI
 
 Standalone CLI for incidents, alerts, services, and on-call operations.
@@ -445,6 +417,7 @@ The default server configuration exposes **110 tools**.
 - `check_oncall_health_risk`
 - `check_responder_availability`
 - `collect_incidents`
+- `createIncident` - create a new incident with a scoped set of fields for agent workflows
 - `create_override_recommendation`
 - `find_related_incidents`
 - `getIncident` - retrieve a single incident for direct verification, including PIR-related fields
@@ -457,7 +430,6 @@ The default server configuration exposes **110 tools**.
 - `list_endpoints`
 - `list_incidents`
 - `list_shifts`
-- `open_rootly_incident_workbench`
 - `search_incidents`
 - `suggest_solutions`
 - `updateIncident` - scoped incident update tool for `summary` and `retrospective_progress_status`

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/README.md

@@ -234,36 +234,6 @@ Add to `claude_desktop_config.json`:
 
 </details>
 
-## ChatGPT App Starter
-
-The server now includes a built-in ChatGPT app surface for incident exploration.
-
-- **Model-visible app tool:** `open_rootly_incident_workbench`
-- **App-only detail tool:** `get_rootly_incident_detail`
-- **UI resource:** `ui://rootly/incident-workbench.html`
-
-This gives ChatGPT a visual Rootly incident workbench without needing a separate backend.
-
-### What it does
-
-- Applies structured incident filters such as team, time range, severity, and status
-- Collects a bounded set of incident summaries for the widget
-- Lets the widget open a detailed incident pane without exposing the detail tool to the model
-
-### Try it in ChatGPT Developer Mode
-
-Once the MCP server is connected in ChatGPT Developer Mode, try prompts like:
-
-- `Open the Rootly incident workbench for Infrastructure incidents from the last 7 days`
-- `Show me resolved critical incidents for Infrastructure from April 1 through April 13`
-- `Open the Rootly incident workbench for database timeout incidents`
-
-### Production auth note
-
-For internal testing and developer-mode setups, the existing bearer-token flow is enough.
-
-For a public ChatGPT app that exposes customer-specific data or write actions, plan to add OAuth 2.1 support on the MCP side before submission. The current Rootly MCP server forwards bearer tokens, but public Apps SDK submissions expect OAuth 2.1-compatible MCP authorization metadata and token verification.
-
 ## Rootly CLI
 
 Standalone CLI for incidents, alerts, services, and on-call operations.
@@ -403,6 +373,7 @@ The default server configuration exposes **110 tools**.
 - `check_oncall_health_risk`
 - `check_responder_availability`
 - `collect_incidents`
+- `createIncident` - create a new incident with a scoped set of fields for agent workflows
 - `create_override_recommendation`
 - `find_related_incidents`
 - `getIncident` - retrieve a single incident for direct verification, including PIR-related fields
@@ -415,7 +386,6 @@ The default server configuration exposes **110 tools**.
 - `list_endpoints`
 - `list_incidents`
 - `list_shifts`
-- `open_rootly_incident_workbench`
 - `search_incidents`
 - `suggest_solutions`
 - `updateIncident` - scoped incident update tool for `summary` and `retrospective_progress_status`

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rootly-mcp-server"
-version = "2.2.18"
+version = "2.2.20"
 description = "Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -37,7 +37,9 @@ classifiers = [
 ]
 dependencies = [
     "fastmcp[code-mode]==3.2.0",  # Pin to patched version with Code Mode support
-    "authlib>=1.6.9",  # Override vulnerable transitive authlib from fastmcp
+    "authlib>=1.6.11",  # Override vulnerable transitive authlib (GHSA-jj8c-mmj3-mmgv)
+    "python-dotenv>=1.2.2",  # Override vulnerable transitive python-dotenv (GHSA-m8f7-34r5-grfg)
+    "python-multipart>=0.0.26",  # Override vulnerable transitive python-multipart (CVE-2026-40347)
     "cryptography>=46.0.7",  # Override vulnerable transitive cryptography
     "Pygments>=2.20.0",  # Override vulnerable transitive Pygments
     "requests==2.33.1", # Pin to patched version

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/src/rootly_mcp_server/__main__.py

@@ -50,9 +50,7 @@ def normalize_transport(value: str) -> TransportName:
     return mapped
 
 
-def normalize_transport_or_default(
-    value: str, default: TransportName = "stdio"
-) -> TransportName:
+def normalize_transport_or_default(value: str, default: TransportName = "stdio") -> TransportName:
     """Normalize transport value, falling back to default when invalid."""
     try:
         return normalize_transport(value)
@@ -275,7 +273,9 @@ def run_dual_http_server(
             stateless=stateless_http,
         )
         code_mode_http_app = StreamableHTTPASGIApp(code_mode_session_manager)
-        routes.append(Route(code_mode_path, endpoint=code_mode_http_app, methods=streamable_methods))
+        routes.append(
+            Route(code_mode_path, endpoint=code_mode_http_app, methods=streamable_methods)
+        )
 
     routes.extend(server._get_additional_http_routes())  # noqa: SLF001
 
@@ -373,7 +373,11 @@ def main():
         # argparse already normalizes/validates --transport via type=normalize_transport
         normalized_transport = args.transport
         code_mode_enabled = args.enable_code_mode or code_mode_enabled_from_env(default=True)
-        code_mode_path = normalize_code_mode_path(args.code_mode_path) if args.code_mode_path else code_mode_path_from_env()
+        code_mode_path = (
+            normalize_code_mode_path(args.code_mode_path)
+            if args.code_mode_path
+            else code_mode_path_from_env()
+        )
         server = create_rootly_mcp_server(
             swagger_path=args.swagger_path,
             name=args.name,

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/src/rootly_mcp_server/code_mode.py

@@ -172,8 +172,7 @@ class CompatibleMontySandboxProvider(MontySandboxProvider):
 
         inputs = inputs or {}
         async_functions = {
-            key: _ensure_async(value)
-            for key, value in (external_functions or {}).items()
+            key: _ensure_async(value) for key, value in (external_functions or {}).items()
         }
 
         monty = self._build_monty_runner(
@@ -219,10 +218,9 @@ class RootlyCodeMode(CodeMode):
             async def call_tool(tool_name: str, params: dict[str, Any]) -> Any:
                 resolved_name = _normalize_execute_tool_name(tool_name)
                 backend_tools = await _get_cached_tools()
-                tool = (
-                    transform._find_tool(resolved_name, transform._build_discovery_tools())
-                    or transform._find_tool(resolved_name, backend_tools)
-                )
+                tool = transform._find_tool(
+                    resolved_name, transform._build_discovery_tools()
+                ) or transform._find_tool(resolved_name, backend_tools)
                 if tool is None:
                     raise NotFoundError(f"Unknown tool: {tool_name}")
 

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/src/rootly_mcp_server/server.py

@@ -22,7 +22,6 @@ from .exceptions import RootlyAuthenticationError
 from .mcp_error import MCPError
 from .security import mask_sensitive_data, sanitize_error_message
 from .tools.alerts import register_alert_tools
-from .tools.chatgpt_app import register_chatgpt_app_tools
 from .tools.incidents import register_incident_tools
 from .tools.oncall import register_oncall_tools
 from .tools.resources import register_resource_handlers
@@ -202,16 +201,14 @@ def _log_tool_usage_event(
         event["error_type"] = error_type
     if error_context:
         event.update(
-            {
-                key: value
-                for key, value in error_context.items()
-                if value not in ("", [], None, {})
-            }
+            {key: value for key, value in error_context.items() if value not in ("", [], None, {})}
         )
 
     _configure_tool_usage_json_logger()
     _tool_usage_json_logger.info(
-        json.dumps({k: v for k, v in event.items() if v not in ("", [], None)}, separators=(",", ":"))
+        json.dumps(
+            {k: v for k, v in event.items() if v not in ("", [], None)}, separators=(",", ":")
+        )
     )
 
 
@@ -406,8 +403,7 @@ def create_rootly_mcp_server(
         f"/v1{path}" if not path.startswith("/v1") else path for path in allowed_paths
     ]
     delete_allowed_paths_v1 = [
-        f"/v1{path}" if not path.startswith("/v1") else path
-        for path in delete_allowed_paths
+        f"/v1{path}" if not path.startswith("/v1") else path for path in delete_allowed_paths
     ]
 
     logger.info(f"Creating Rootly MCP Server with allowed paths: {allowed_paths_v1}")
@@ -519,7 +515,9 @@ def create_rootly_mcp_server(
                 logger.debug(
                     f"make_authenticated_request: client_ip={client_ip}, headers_keys={list(request_headers.keys()) if request_headers else []}"
                 )
-                direct_auth_header = request_headers.get("authorization", "") if request_headers else ""
+                direct_auth_header = (
+                    request_headers.get("authorization", "") if request_headers else ""
+                )
                 effective_auth_header = direct_auth_header or _session_auth_token.get("")
                 if direct_auth_header:
                     logger.debug("make_authenticated_request: Found auth header, adding to request")
@@ -576,13 +574,6 @@ def create_rootly_mcp_server(
         mcp_error=MCPError,
     )
 
-    register_chatgpt_app_tools(
-        mcp=mcp,
-        make_authenticated_request=make_authenticated_request,
-        strip_heavy_nested_data=strip_heavy_nested_data,
-        mcp_error=MCPError,
-    )
-
     register_alert_tools(
         mcp=mcp,
         make_authenticated_request=make_authenticated_request,

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/src/rootly_mcp_server/spec_transform.py

@@ -164,8 +164,7 @@ def _filter_openapi_spec(
         if not allow_delete:
             path_item.pop("delete", None)
         if not any(
-            method.lower() in ["get", "post", "put", "patch", "delete"]
-            for method in path_item
+            method.lower() in ["get", "post", "put", "patch", "delete"] for method in path_item
         ):
             paths_to_remove.append(path)
     for path in paths_to_remove:

{rootly_mcp_server-2.2.18 → rootly_mcp_server-2.2.20}/src/rootly_mcp_server/tools/__init__.py

@@ -1,14 +1,12 @@
 """Tool registration modules for Rootly MCP server."""
 
 from .alerts import register_alert_tools
-from .chatgpt_app import register_chatgpt_app_tools
 from .incidents import register_incident_tools
 from .oncall import register_oncall_tools
 from .resources import register_resource_handlers
 
 __all__ = [
     "register_alert_tools",
-    "register_chatgpt_app_tools",
     "register_incident_tools",
     "register_oncall_tools",
     "register_resource_handlers",