spring-runtime-mcp 0.2.0__tar.gz → 0.2.1__tar.gz

{spring_runtime_mcp-0.2.0 → spring_runtime_mcp-0.2.1}/CHANGELOG.md

@@ -1,5 +1,18 @@
 # 版本记录
 
+## 未发布 — v0.2.1 Alpha 元数据修正候选
+
+- Registry 名称与 README 所有权标记统一为 `io.github.neilmorse/spring-runtime-mcp`；项目 URL 指向当前仓库所有者。版本源、锁文件项目版本和 Registry 包版本同步为 0.2.1。
+- 仅准备候选，不表示已上传 PyPI 或 Registry。已发布的 0.2.0 标签和产物保留；生产诊断实现、公开工具 Schema、运行依赖、只读/脱敏/目标/预算边界不变。
+- 新标签、PyPI 环境标签授权、新版本上传及 Registry 登录/提交仍需操作者批准。安装说明继续固定已公开验收的 0.2.0，待新版本公开安装通过后再切换推荐版本。
+
+## v0.2.0 Alpha — 2026-10-31（正式发布）
+
+- 已发布到 [PyPI](https://pypi.org/project/spring-runtime-mcp/0.2.0/)，标签 `v0.2.0` 对应 `2394b29a84a5fcd8210d3934eee1a94e1d3fc0ac`。
+- 干净提交本地完整门禁退出 0；正式 Release 的 Python 3.11–3.14、静态检查、契约、漏洞审计、构建/两产物隔离安装与发布全部通过。
+- 公开 PyPI 仓库外全新环境安装通过两种 SDK 模式、八工具回环调用和七 replay；公开产物摘要与验收批次一致。首发保持 Alpha、本地回环与有限兼容范围，详见[发布记录](docs/launch/release-0.2.0.md)。
+- 下列“未发布”记录保留各轮实施时状态；其中交付内容已随本版纳入，不应据历史措辞判断当前未发布。2026-10-22 的 v0.2.0 条目记录开发里程碑，不是 PyPI 首次发布日期。
+
 ## 未发布 — 2026-10-31 发布流程收口
 
 - 将已审阅的生产修复、测试、资源、脚本和历史证据准备为同一发布提交；Nacos 原运行日志/逐分钟 JSONL 本地留存并精确忽略，聚合证据保留。

{spring_runtime_mcp-0.2.0 → spring_runtime_mcp-0.2.1}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: spring-runtime-mcp
-Version: 0.2.0
+Version: 0.2.1
 Summary: Read-only, sanitized Spring Boot runtime diagnostics for coding agents over MCP.
-Project-URL: Homepage, https://github.com/Kaelenx/spring-runtime-mcp
-Project-URL: Repository, https://github.com/Kaelenx/spring-runtime-mcp
-Project-URL: Issues, https://github.com/Kaelenx/spring-runtime-mcp/issues
-Project-URL: Changelog, https://github.com/Kaelenx/spring-runtime-mcp/blob/master/CHANGELOG.md
+Project-URL: Homepage, https://github.com/neilmorse/spring-runtime-mcp
+Project-URL: Repository, https://github.com/neilmorse/spring-runtime-mcp
+Project-URL: Issues, https://github.com/neilmorse/spring-runtime-mcp/issues
+Project-URL: Changelog, https://github.com/neilmorse/spring-runtime-mcp/blob/master/CHANGELOG.md
 Author: Kaelenx
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -29,7 +29,7 @@ Description-Content-Type: text/markdown
 
 # Spring Boot Runtime Diagnostics MCP
 
-[![CI](https://github.com/Kaelenx/spring-runtime-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/Kaelenx/spring-runtime-mcp/actions/workflows/ci.yml)
+[![CI](https://github.com/neilmorse/spring-runtime-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/neilmorse/spring-runtime-mcp/actions/workflows/ci.yml)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](pyproject.toml)
 [![MCP](https://img.shields.io/badge/MCP-stdio-black.svg)](https://modelcontextprotocol.io)
@@ -42,6 +42,19 @@ It is local-first and safe by default: fixed `GET` endpoints only, no redirects,
 
 [中文说明](README.zh-CN.md)
 
+**0.2.0 Alpha is available on [PyPI](https://pypi.org/project/spring-runtime-mcp/0.2.0/).**
+It supports registered loopback targets over STDIO, with fixed endpoints and optional
+Bearer environment binding. Commands below explicitly use public PyPI to avoid mirror lag. Windows/macOS and the full Boot/client matrix remain
+unverified. See the [release record](docs/launch/release-0.2.0.md).
+
+```bash
+uvx --default-index https://pypi.org/simple spring-runtime-mcp==0.2.0 --version
+uvx --default-index https://pypi.org/simple spring-runtime-mcp==0.2.0 --base-url http://127.0.0.1:18081
+```
+
+Configure your local target first using the [target setup guide](docs/target-app-setup.md).
+The second command is the persistent MCP host; it waits for a client on STDIO.
+
 ## Why not just curl `/actuator`?
 
 Because an agent that can `curl` an Actuator can also `POST /actuator/shutdown`, read `/actuator/heapdump`, leak `spring.datasource.password` into a transcript, or paste 2 MB of `beans` JSON into its context window. This project replaces that with a narrow, auditable surface:
@@ -77,7 +90,7 @@ Tools are registered in alphabetical order, each carries `readOnlyHint`, `destru
 Requires Python 3.11+ and [uv](https://docs.astral.sh/uv/). No JDK, Docker, model API key or network target is needed; the replay command runs a tool against a committed synthetic Actuator fixture.
 
 ```bash
-git clone https://github.com/Kaelenx/spring-runtime-mcp.git && cd spring-runtime-mcp
+git clone --branch v0.2.0 --depth 1 https://github.com/neilmorse/spring-runtime-mcp.git && cd spring-runtime-mcp
 uv run --locked python -m pytest -q
 uv run --locked python -m spring_runtime_mcp.replay \
   --scenario stripe-missing --tool springboot_inspect_beans \
@@ -275,7 +288,7 @@ uv run --no-sync ruff format --check src tests scripts
 uv build
 ```
 
-Add `--offline` to the initial sync once dependencies are cached. `uv.lock` fixes the tested runtime and development dependency versions; the wheel includes its tool Schema and `py.typed`. Tests block outbound network by default; real Shop acceptance is a separate operator-invoked script. PR CI runs the Python test matrix and static checks; release additionally runs the full audited pre-release script and requires a matching version tag. The changed workflow awaits remote verification.
+Add `--offline` to the initial sync once dependencies are cached. `uv.lock` fixes the tested runtime and development dependency versions; the wheel includes its tool Schema and `py.typed`. Tests block outbound network by default; real Shop acceptance is a separate operator-invoked script. PR CI runs the Python test matrix and static checks; release additionally runs the full audited pre-release script and requires a matching version tag. The release workflow passed on the published commit; see the release record.
 
 For a working-tree review, run `uv run --no-sync python scripts/pre_release_check.py --allow-dirty`. Add `--audit` to run the separate online `uv audit --locked` dependency check. Skipping the audit or build, allowing a dirty tree, or accepting skipped tests makes the result incomplete (exit 2); a failure exits 1. The clean-room stage compares wheel and sdist resources and versions with the source, installs each into a separate environment using lockfile constraints for runtime dependencies, checks the CLI version, and runs `scripts/check_stdio_install.py` outside the repository with isolated Python. Both installations cover both SDK modes, eight handlers against a disposable loopback fixture and seven packaged replay scenarios. Build dependencies are pinned in the build system and included in the development lock and audit. The earlier verification is recorded in the [MCP delivery audit](docs/audits/mcp-release-gate-2026-10-23.md).
 
@@ -297,10 +310,10 @@ Security findings should go to the repository's private vulnerability reporting
 
 [Apache-2.0](LICENSE)
 
-<!-- mcp-name: io.github.Kaelenx/spring-runtime-mcp -->
+<!-- mcp-name: io.github.neilmorse/spring-runtime-mcp -->
 
 
-The first release candidate remains **0.2.0 Alpha**: loopback targets, STDIO,
+The published release is **0.2.0 Alpha**: loopback targets, STDIO,
 eight existing tools and Bearer environment binding. See the
 [release readiness report](docs/audits/release-readiness-2026-10-31.md) for separate
 platform, historical sample, SDK and actual client evidence.
@@ -315,6 +328,7 @@ uv pip install --python /tmp/spring-runtime-user/bin/python /absolute/path/sprin
 /tmp/spring-runtime-user/bin/spring-runtime-mcp --base-url http://127.0.0.1:18081
 ```
 
-Public PyPI availability was not verified this round. `uvx spring-runtime-mcp==0.2.0`
-is a post-publication path awaiting validation. Replay is a one-shot offline command,
-not the MCP host.
+Public PyPI installation has passed an independent clean-environment check on
+Linux/Python 3.12, including both SDK modes, eight fixture routes and seven replay
+scenarios. Replay is a one-shot offline command, not the MCP host. See the
+[release record](docs/launch/release-0.2.0.md) for evidence and remaining limits.

{spring_runtime_mcp-0.2.0 → spring_runtime_mcp-0.2.1}/README.md

@@ -1,6 +1,6 @@
 # Spring Boot Runtime Diagnostics MCP
 
-[![CI](https://github.com/Kaelenx/spring-runtime-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/Kaelenx/spring-runtime-mcp/actions/workflows/ci.yml)
+[![CI](https://github.com/neilmorse/spring-runtime-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/neilmorse/spring-runtime-mcp/actions/workflows/ci.yml)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](pyproject.toml)
 [![MCP](https://img.shields.io/badge/MCP-stdio-black.svg)](https://modelcontextprotocol.io)
@@ -13,6 +13,19 @@ It is local-first and safe by default: fixed `GET` endpoints only, no redirects,
 
 [中文说明](README.zh-CN.md)
 
+**0.2.0 Alpha is available on [PyPI](https://pypi.org/project/spring-runtime-mcp/0.2.0/).**
+It supports registered loopback targets over STDIO, with fixed endpoints and optional
+Bearer environment binding. Commands below explicitly use public PyPI to avoid mirror lag. Windows/macOS and the full Boot/client matrix remain
+unverified. See the [release record](docs/launch/release-0.2.0.md).
+
+```bash
+uvx --default-index https://pypi.org/simple spring-runtime-mcp==0.2.0 --version
+uvx --default-index https://pypi.org/simple spring-runtime-mcp==0.2.0 --base-url http://127.0.0.1:18081
+```
+
+Configure your local target first using the [target setup guide](docs/target-app-setup.md).
+The second command is the persistent MCP host; it waits for a client on STDIO.
+
 ## Why not just curl `/actuator`?
 
 Because an agent that can `curl` an Actuator can also `POST /actuator/shutdown`, read `/actuator/heapdump`, leak `spring.datasource.password` into a transcript, or paste 2 MB of `beans` JSON into its context window. This project replaces that with a narrow, auditable surface:
@@ -48,7 +61,7 @@ Tools are registered in alphabetical order, each carries `readOnlyHint`, `destru
 Requires Python 3.11+ and [uv](https://docs.astral.sh/uv/). No JDK, Docker, model API key or network target is needed; the replay command runs a tool against a committed synthetic Actuator fixture.
 
 ```bash
-git clone https://github.com/Kaelenx/spring-runtime-mcp.git && cd spring-runtime-mcp
+git clone --branch v0.2.0 --depth 1 https://github.com/neilmorse/spring-runtime-mcp.git && cd spring-runtime-mcp
 uv run --locked python -m pytest -q
 uv run --locked python -m spring_runtime_mcp.replay \
   --scenario stripe-missing --tool springboot_inspect_beans \
@@ -246,7 +259,7 @@ uv run --no-sync ruff format --check src tests scripts
 uv build
 ```
 
-Add `--offline` to the initial sync once dependencies are cached. `uv.lock` fixes the tested runtime and development dependency versions; the wheel includes its tool Schema and `py.typed`. Tests block outbound network by default; real Shop acceptance is a separate operator-invoked script. PR CI runs the Python test matrix and static checks; release additionally runs the full audited pre-release script and requires a matching version tag. The changed workflow awaits remote verification.
+Add `--offline` to the initial sync once dependencies are cached. `uv.lock` fixes the tested runtime and development dependency versions; the wheel includes its tool Schema and `py.typed`. Tests block outbound network by default; real Shop acceptance is a separate operator-invoked script. PR CI runs the Python test matrix and static checks; release additionally runs the full audited pre-release script and requires a matching version tag. The release workflow passed on the published commit; see the release record.
 
 For a working-tree review, run `uv run --no-sync python scripts/pre_release_check.py --allow-dirty`. Add `--audit` to run the separate online `uv audit --locked` dependency check. Skipping the audit or build, allowing a dirty tree, or accepting skipped tests makes the result incomplete (exit 2); a failure exits 1. The clean-room stage compares wheel and sdist resources and versions with the source, installs each into a separate environment using lockfile constraints for runtime dependencies, checks the CLI version, and runs `scripts/check_stdio_install.py` outside the repository with isolated Python. Both installations cover both SDK modes, eight handlers against a disposable loopback fixture and seven packaged replay scenarios. Build dependencies are pinned in the build system and included in the development lock and audit. The earlier verification is recorded in the [MCP delivery audit](docs/audits/mcp-release-gate-2026-10-23.md).
 
@@ -268,10 +281,10 @@ Security findings should go to the repository's private vulnerability reporting
 
 [Apache-2.0](LICENSE)
 
-<!-- mcp-name: io.github.Kaelenx/spring-runtime-mcp -->
+<!-- mcp-name: io.github.neilmorse/spring-runtime-mcp -->
 
 
-The first release candidate remains **0.2.0 Alpha**: loopback targets, STDIO,
+The published release is **0.2.0 Alpha**: loopback targets, STDIO,
 eight existing tools and Bearer environment binding. See the
 [release readiness report](docs/audits/release-readiness-2026-10-31.md) for separate
 platform, historical sample, SDK and actual client evidence.
@@ -286,6 +299,7 @@ uv pip install --python /tmp/spring-runtime-user/bin/python /absolute/path/sprin
 /tmp/spring-runtime-user/bin/spring-runtime-mcp --base-url http://127.0.0.1:18081
 ```
 
-Public PyPI availability was not verified this round. `uvx spring-runtime-mcp==0.2.0`
-is a post-publication path awaiting validation. Replay is a one-shot offline command,
-not the MCP host.
+Public PyPI installation has passed an independent clean-environment check on
+Linux/Python 3.12, including both SDK modes, eight fixture routes and seven replay
+scenarios. Replay is a one-shot offline command, not the MCP host. See the
+[release record](docs/launch/release-0.2.0.md) for evidence and remaining limits.

{spring_runtime_mcp-0.2.0 → spring_runtime_mcp-0.2.1}/README.zh-CN.md

@@ -2,7 +2,16 @@
 
 [English README](README.md)
 
-当前版本为 **v0.2.0**，工作树另含尚未发布的综合审查修复。交付范围、实际验证与限制见 [版本记录](CHANGELOG.md)及[修复验收报告](docs/audits/comprehensive-remediation-2026-10-22.md)。
+**v0.2.0 Alpha 已发布到 [PyPI](https://pypi.org/project/spring-runtime-mcp/0.2.0/)**。限定支持登记的回环目标、STDIO、固定端点及可选 Bearer 环境变量绑定；Windows/macOS 与完整 Boot/客户端矩阵仍未验证。发布提交、产物摘要与实际验收见[发布记录](docs/launch/release-0.2.0.md)。
+
+安装并检查版本（显式使用官方 PyPI，避免镜像尚未同步新包）：
+
+```bash
+uvx --default-index https://pypi.org/simple spring-runtime-mcp==0.2.0 --version
+uvx --default-index https://pypi.org/simple spring-runtime-mcp==0.2.0 --base-url http://127.0.0.1:18081
+```
+
+先按[目标配置指南](docs/target-app-setup.md)配置本地应用。第二条命令为常驻 MCP 宿主，等待客户端通过 STDIO 发出请求；replay 仍是一次性离线命令。
 
 面向编码 Agent 的本地优先、只读、安全默认运行时诊断工具。项目目标是把获权 Spring Boot 实例的 Actuator 与 OpenAPI 响应转换为脱敏、可追溯、有界的运行证据。
 
@@ -249,14 +258,14 @@ uv run --no-sync ruff format --check src tests scripts
 uv build
 ```
 
-`uv.lock` 锁定运行及开发依赖；已缓存时首条同步可加 `--offline`。当前离线结果见[版本记录](CHANGELOG.md)，历史交付核验见[报告](docs/audits/final-delivery-audit-2026-10-23.md)；超大型 Fineract 验收见[审计报告](docs/audits/ultra-project-fineract-2026-10-23.md)。官方 SDK 的 legacy 和 2026-07-28 模式也完成隔离 wheel 安装验收。PR CI 运行 Python 测试矩阵与静态检查；正式发布另运行完整联网审计门禁并检查标签与包版本一致，修改后的远端工作流待验证。TypeScript 红队入口是 `tests/security/redteam-audit.test.ts`，需要本机 Node，不属于默认 Python 门禁。
+`uv.lock` 锁定运行及开发依赖；已缓存时首条同步可加 `--offline`。当前离线结果见[版本记录](CHANGELOG.md)，历史交付核验见[报告](docs/audits/final-delivery-audit-2026-10-23.md)；超大型 Fineract 验收见[审计报告](docs/audits/ultra-project-fineract-2026-10-23.md)。官方 SDK 的 legacy 和 2026-07-28 模式也完成隔离 wheel 安装验收。PR CI 运行 Python 测试矩阵与静态检查；正式发布另运行完整联网审计门禁并检查标签与包版本一致，发布提交的远端工作流已通过，见发布记录。TypeScript 红队入口是 `tests/security/redteam-audit.test.ts`，需要本机 Node，不属于默认 Python 门禁。
 
 工作树自检运行 `uv run --no-sync python scripts/pre_release_check.py --allow-dirty`；加 `--audit` 才执行独立的联网 `uv audit --locked` 漏洞审计。未执行审计、跳过构建、允许脏工作树或接受跳过的测试时，检查不完整并返回 2；失败返回 1。净室阶段比对 wheel 与 sdist 的资源和版本，分别在独立环境按锁文件约束安装运行依赖、检查 CLI 版本，再从仓库外用隔离 Python 执行 SDK 两模式、八个自建回环 HTTP 处理器调用和七个内置 replay 场景。构建后端及其构建依赖固定版本，并纳入开发锁文件与漏洞审计。历史证据见 [MCP 交付专项核验](docs/audits/mcp-release-gate-2026-10-23.md)。
 
 Python 实现位于 `src/spring_runtime_mcp/`；公开契约位于 `src/spring_runtime_mcp/schemas/tools-contract.json`，随 wheel 一起分发；`tests/` 默认阻断外部网络。架构速查见 [HANDOVER.md](HANDOVER.md)。[SPEC](SPEC.md)定义产品目标，[目标配置指南](docs/target-app-setup.md)解释版本及授权，[归一化设计](docs/architecture/cross-version-normalization.md)说明响应差异，[红队报告](docs/audits/security-redteam-2026-10-17.md)列出已修复问题与仍未覆盖的真实实例边界。
 
 
-首发候选为 **0.2.0 Alpha**，仅支持本地回环、STDIO、现有八工具和 Bearer 环境变量绑定。平台、历史样本、SDK 与实际客户端证据分列于[发布准备报告](docs/audits/release-readiness-2026-10-31.md)，不代表完整兼容矩阵。
+已发布版本为 **0.2.0 Alpha**，仅支持本地回环、STDIO、现有八工具和 Bearer 环境变量绑定。平台、历史样本、SDK 与实际客户端证据分列于[发布准备报告](docs/audits/release-readiness-2026-10-31.md)，不代表完整兼容矩阵。
 
 源码检出使用上方锁定项目命令。wheel 安装后直接运行入口：
 
@@ -267,4 +276,4 @@ uv pip install --python /tmp/spring-runtime-user/bin/python /absolute/path/sprin
 /tmp/spring-runtime-user/bin/spring-runtime-mcp --base-url http://127.0.0.1:18081
 ```
 
-以上是 Linux/macOS 路径示例，Windows 尚未验收。公开 PyPI 版本存在性本轮未核实；`uvx spring-runtime-mcp==0.2.0` 仅为发布后待验路径。replay 是一次性离线命令，不是 MCP 宿主。
+以上是 Linux/macOS 路径示例，Windows 尚未验收。公开 PyPI 的仓库外全新环境安装已在 Linux/Python 3.12 验收，通过 SDK 两模式、八工具回环调用与七个 replay；详见[发布记录](docs/launch/release-0.2.0.md)。replay 是一次性离线命令，不是 MCP 宿主。

{spring_runtime_mcp-0.2.0 → spring_runtime_mcp-0.2.1}/docs/audits/release-readiness-2026-10-31.md

@@ -1,5 +1,14 @@
 # 正式发布准备收口 — 2026-10-31
 
+**当前状态：0.2.0 Alpha 已发布并通过公开安装验收。** 标签 `v0.2.0` 指向
+`2394b29a84a5fcd8210d3934eee1a94e1d3fc0ac`；本地干净提交完整门禁退出 0，
+[正式 Release](https://github.com/neilmorse/spring-runtime-mcp/actions/runs/41176181251) 全部通过。
+公开文件摘要、支持范围与验证见[发布记录](../launch/release-0.2.0.md)。
+以下内容是发布前各阶段的历史快照；“尚未发布”“账户待核实”“工作树未提交”等不代表当前状态。
+本次文档同步不修改发布标签、生产源码或已上传的 PyPI 产物。
+
+## 发布前历史记录
+
 当前仍为 **0.2.0 Alpha、限定范围发布候选**。本报告保存前两轮本地验证与缺陷修复历史；本轮已获授权形成发布提交，并在该提交上运行不带旁路标志的完整门禁。最终提交 SHA、门禁退出码和同批产物 SHA256 写入仓库外的 `/tmp/spring-runtime-release-evidence/final-gate.json`，避免为补录结果改变被验证提交。只有该记录退出码为 0 才表示最终本地门禁通过。历史批次不作为最终发布产物。
 
 ## 本轮发布提交范围与流程

spring_runtime_mcp-0.2.1/docs/launch/announcement.md

@@ -0,0 +1,90 @@
+# 0.2.0 Alpha：发布与投稿材料
+
+更新于 2026-10-31。PyPI 0.2.0 已发布，发布与公开安装验证见
+[发布记录](release-0.2.0.md)。Registry 尚未提交；命名空间迁移见[方案](registry-plan.md)。
+
+## GitHub Release 文案
+
+Title: **Spring Runtime MCP 0.2.0 Alpha**
+
+Spring Runtime MCP gives coding agents bounded, sanitized evidence from a registered
+local Spring Boot instance: beans and conditions, routes, health, migrations,
+startup, configuration origin, OpenAPI and drift.
+
+Install with Python 3.11+ and uv:
+
+```bash
+uvx --default-index https://pypi.org/simple spring-runtime-mcp==0.2.0 --version
+uvx --default-index https://pypi.org/simple spring-runtime-mcp==0.2.0 --base-url http://127.0.0.1:18081
+```
+
+Prepare a local, read-only Actuator endpoint using the
+[target setup guide](https://github.com/neilmorse/spring-runtime-mcp/blob/v0.2.0/docs/target-app-setup.md).
+The second command is the persistent STDIO host for your MCP client.
+
+This Alpha supports loopback targets, fixed endpoints and optional Bearer environment
+binding. It permits read-only GET requests, rejects redirects and environment proxies,
+validates TLS, sanitizes results through two layers and limits complete tool responses
+to 16 KiB. Missing evidence remains partial/unknown.
+
+The release passed Python 3.11–3.14 offline tests, the complete audited gate,
+independent wheel/sdist installations and a public PyPI clean-environment check.
+Windows/macOS, the complete Boot/Java/client matrix and production clusters remain
+unverified. Remote targets, Basic/custom headers, custom management paths and OpenAPI
+path fallback are outside this release. Configuration diagnostics stay disabled by default.
+
+- [PyPI 0.2.0](https://pypi.org/project/spring-runtime-mcp/0.2.0/)
+- [Verified release workflow](https://github.com/neilmorse/spring-runtime-mcp/actions/runs/41176181251)
+- [Release source](https://github.com/neilmorse/spring-runtime-mcp/tree/v0.2.0)
+
+## awesome-mcp-servers 投稿
+
+目标：[punkpeye/awesome-mcp-servers](https://github.com/punkpeye/awesome-mcp-servers)。
+遵循其[贡献指南](https://github.com/punkpeye/awesome-mcp-servers/blob/main/CONTRIBUTING.md)，
+添加到 Developer Tools 类别并按仓库所有者排序，不声明 Registry 收录或完整兼容。
+
+```markdown
+- [neilmorse/spring-runtime-mcp](https://github.com/neilmorse/spring-runtime-mcp) 🐍 🏠 - Read-only Spring Boot runtime diagnostics: beans and conditions, routes, health, migrations, startup, config origin, OpenAPI and drift. Loopback-only, sanitized, bounded responses.
+```
+
+PR title: **Add Spring Runtime MCP**
+
+PR body:
+
+```text
+Add spring-runtime-mcp under Developer Tools. It is an Apache-2.0 Python STDIO server
+with a public PyPI 0.2.0 Alpha package. Eight read-only tools inspect a registered
+loopback Spring Boot instance; results are sanitized and bounded to 16 KiB.
+
+Repository: https://github.com/neilmorse/spring-runtime-mcp
+Package: https://pypi.org/project/spring-runtime-mcp/0.2.0/
+
+The entry describes implemented scope only. It does not claim full Boot/client
+compatibility or MCP Registry publication. Documentation and submission preparation
+were assisted by a coding agent.
+```
+
+## 其他目录与社区公告
+
+- [Smithery](https://smithery.ai/new) 当前跳转账户登录；需可用账户，且应先确认其安装模型适用于本地 STDIO。
+- [Glama](https://glama.ai/mcp/servers) 的 Add Server 入口需实际页面核查；不使用旧的 `/submit` 搜索路由冒充提交端点。
+- PulseMCP、mcp.so 未核实可用的直接提交路径，不能声称已提交或会自动同步。
+- Reddit/dev.to 等帖子需选择平台并使用操作者已授权账户；本轮先准备下列短文，不跨平台自动群发。
+
+Title: **Spring Runtime MCP 0.2.0 Alpha: read-only runtime evidence for Spring Boot agents**
+
+```text
+Spring Runtime MCP 0.2.0 Alpha is available on PyPI. It gives coding agents eight
+read-only tools for Spring Boot beans/conditions, routes, health, migrations,
+startup, configuration origin, OpenAPI and drift.
+
+It reads a registered local loopback instance over fixed Actuator endpoints.
+Responses are sanitized and bounded to 16 KiB; missing evidence stays partial/unknown.
+Configuration diagnostics are off by default. It never invokes business operations.
+
+This is a limited Alpha, with fixture, isolated-install and fixed-project evidence.
+It does not claim every Boot/Java/client combination or production-cluster readiness.
+
+Package: https://pypi.org/project/spring-runtime-mcp/0.2.0/
+Source: https://github.com/neilmorse/spring-runtime-mcp
+```

spring_runtime_mcp-0.2.1/docs/launch/registry-0.2.1.patch

@@ -0,0 +1,35 @@
+--- a/src/spring_runtime_mcp/__init__.py
++++ b/src/spring_runtime_mcp/__init__.py
+@@ -3 +3 @@
+-__version__ = "0.2.0"
++__version__ = "0.2.1"
+--- a/README.md
++++ b/README.md
+@@ -284 +284 @@
+-<!-- mcp-name: io.github.Kaelenx/spring-runtime-mcp -->
++<!-- mcp-name: io.github.neilmorse/spring-runtime-mcp -->
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -46,4 +46,4 @@
+-Homepage = "https://github.com/Kaelenx/spring-runtime-mcp"
+-Repository = "https://github.com/Kaelenx/spring-runtime-mcp"
+-Issues = "https://github.com/Kaelenx/spring-runtime-mcp/issues"
+-Changelog = "https://github.com/Kaelenx/spring-runtime-mcp/blob/master/CHANGELOG.md"
++Homepage = "https://github.com/neilmorse/spring-runtime-mcp"
++Repository = "https://github.com/neilmorse/spring-runtime-mcp"
++Issues = "https://github.com/neilmorse/spring-runtime-mcp/issues"
++Changelog = "https://github.com/neilmorse/spring-runtime-mcp/blob/master/CHANGELOG.md"
+--- a/server.json
++++ b/server.json
+@@ -3 +3 @@
+-  "name": "io.github.Kaelenx/spring-runtime-mcp",
++  "name": "io.github.neilmorse/spring-runtime-mcp",
+@@ -6 +6 @@
+-  "version": "0.2.0",
++  "version": "0.2.1",
+@@ -8 +8 @@
+-    "url": "https://github.com/Kaelenx/spring-runtime-mcp",
++    "url": "https://github.com/neilmorse/spring-runtime-mcp",
+@@ -15 +15 @@
+-      "version": "0.2.0",
++      "version": "0.2.1",

spring_runtime_mcp-0.2.1/docs/launch/registry-plan.md

@@ -0,0 +1,46 @@
+# MCP Registry：命名空间与后续补丁方案
+
+核对日期：2026-10-31。当前尚未提交 Registry，0.2.0 的 PyPI 发布不依赖 Registry。
+
+## 已确认事实
+
+- 本机 gh 的 GitHub 身份和仓库所有者均为 `neilmorse`；该身份的组织列表为空。
+- 公开 PyPI 0.2.0 的包描述包含 `mcp-name: io.github.Kaelenx/spring-runtime-mcp`。
+- 根 `server.json` 的 name 与该已发布标记一致，保留为 0.2.0 的历史发布元数据。
+- GitHub `/users/Kaelenx` 查询返回 404；没有当前账号拥有旧命名空间的证据。
+- GitHub 插件身份与本机 gh 不同，且对本仓库只有读取权限，不用于发布。
+
+官方规则要求 GitHub 登录授权其本人/组织的命名空间，并要求 PyPI 包 README 中的
+`mcp-name` 与 server.json 的 name 完全一致。参见
+[CLI 认证说明](https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/cli/commands.md#github-interactive)和
+[PyPI 所有权验证](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/package-types.mdx#pypi-packages)。
+因此，仅将根 server.json 改为 `io.github.neilmorse/...` 会与公开 0.2.0 包描述冲突；
+GitHub 仓库 URL 跳转也不构成旧 Registry 命名空间授权。
+
+## 建议方案：0.2.1 元数据补丁
+
+候选 JSON 为 [server-0.2.1.json](server-0.2.1.json)，仅供下次发布审阅，不表示该版本已存在。
+可审阅改动如下；本轮不执行新版本发布或更改既有标签：
+
+1. 源码版本与锁文件项目版本从 0.2.0 升为 0.2.1，成熟度继续 Alpha。
+2. README 的所有权标记改为 `io.github.neilmorse/spring-runtime-mcp`。
+3. 根 server.json 使用候选名称、仓库 URL、包版本和服务版本；pyproject 的项目 URL 同步为当前所有者。
+4. 工具 Schema、生产诊断算法、认证、目标边界与预算保持现状；安装示例固定到新版本。
+5. 更新 CHANGELOG，干净提交上执行完整发布门禁及无发布 CI，记录新 SHA 和产物摘要。
+6. 发布前检查 GitHub pypi 环境规则。当前规则仅允许 `v0.2.0`，新增版本标签授权需单独批准；不能关闭保护或管理员绕过。
+7. 新版本 PyPI 发布和公开安装验收完成后，核对公开包标记，再以正确 GitHub 身份登录 Registry 并提交候选元数据。
+
+准备好的[补丁](registry-0.2.1.patch)覆盖版本源、README 标记、项目 URL 和 server.json。
+经批准后用 `git apply --unidiff-zero docs/launch/registry-0.2.1.patch` 应用，
+再运行 `uv lock --offline` 更新项目版本，复核文档示例并补充 CHANGELOG，再运行全部检查。
+补丁不包含账户权限修改、凭据、发布命令执行或网络守卫变更。
+
+不得覆盖 0.2.0 的标签或重新上传同版本包。若操作者能提供旧命名空间的独立授权证据，
+可另行核查保留旧名称的方案；当前不假定该授权存在。
+
+## 校验与投稿状态
+
+本轮会校验现有与候选 server.json 的官方 Schema/CLI 规则；本地校验不验证登录权限或 PyPI 包所有权。
+候选版本在 PyPI 不存在时不可执行 publish。CLI 身份认证可能需要操作者完成 GitHub 登录。
+
+目录和公告可以引用已发布的 PyPI 包及 GitHub 仓库，无需声称 Registry 已收录。

spring_runtime_mcp-0.2.1/docs/launch/release-0.2.0.md

@@ -0,0 +1,56 @@
+# 0.2.0 Alpha — 2026-10-31
+
+Spring Runtime MCP 0.2.0 Alpha 已发布到 [PyPI](https://pypi.org/project/spring-runtime-mcp/0.2.0/)。
+发布标签为 [`v0.2.0`](https://github.com/neilmorse/spring-runtime-mcp/tree/v0.2.0)，对应提交
+`2394b29a84a5fcd8210d3934eee1a94e1d3fc0ac`。发布后的文档同步不改变该标签或已上传的产物。
+
+## 安装
+
+需要 Python 3.11+ 与 uv。首次运行从公开包索引安装依赖：
+
+```bash
+uvx --default-index https://pypi.org/simple spring-runtime-mcp==0.2.0 --version
+uvx --default-index https://pypi.org/simple spring-runtime-mcp==0.2.0 --base-url http://127.0.0.1:18081
+```
+
+第二条命令为 STDIO MCP 宿主；先按[目标配置指南](../target-app-setup.md)准备本地回环实例，
+再由客户端启动并完成 initialize、tools/list 和一次只读调用。工具发现不证明目标已经授权。
+
+## 范围
+
+八个工具覆盖 Bean/条件、路由、健康、迁移、启动、配置来源、OpenAPI 和运行态漂移。
+限定登记回环目标、固定逻辑端点、STDIO、可选 Bearer 环境绑定；配置诊断默认关闭。
+只读 GET、禁止重定向/环境代理、验证 TLS、双层脱敏和 16 KiB 完整工具回包预算保持。
+证据缺失返回 partial/unknown。
+
+非回环目标、Basic/自定义头、自定义管理基路径、OpenAPI 路径回退尚未实现。
+Windows/macOS、完整 Boot/Java/Web 栈矩阵及其他实际客户端交互仍未验收。
+Codex CLI 只有一次自建 fixture 健康调用的实际客户端冒烟证据，不能外推全部客户端场景。
+
+## 验证与产物
+
+[正式发布流水线](https://github.com/neilmorse/spring-runtime-mcp/actions/runs/41176181251)
+通过 Python 3.11–3.14 的各 1100 项离线测试、类型/格式/契约检查和完整发布门禁。
+本地干净提交完整门禁退出 0；wheel/sdist 分别在隔离环境完成两种 SDK 模式、八工具
+自建回环 HTTP 调用及七个 replay 场景。
+
+公开 PyPI 文件摘要与本地、验证型 CI 及正式 Release 同批产物一致：
+
+| 文件 | SHA256 |
+| --- | --- |
+| `spring_runtime_mcp-0.2.0-py3-none-any.whl` | `5c1cada7be8c233cae7a8956fa2bc1e2f7bb3554bc0f6ead1fda9bdbef8380e0` |
+| `spring_runtime_mcp-0.2.0.tar.gz` | `19e78b902790c8a8a83846cacb8e353585e705f7e16abcbf53abc75f3d4505cd` |
+
+公开 PyPI 安装在仓库外新建 Python 3.12.15 环境完成，不使用 uv 缓存、本地 wheel 或锁文件约束；
+版本、SDK 两模式、八工具回环调用、协议与脱敏、16 KiB 和七 replay 均通过。
+后续独立验收再次通过相同公开安装链路，111 个生产代码/资源文件与发布提交一致。
+这不代表未来所有传递依赖组合均已验证。
+
+## 发布后的事项
+
+默认分支文档、目录投稿和公告与 PyPI 产物分别维护。
+MCP Registry 的命名空间迁移尚未完成：0.2.0 包描述仍为 `io.github.Kaelenx/...`，
+当前仓库所有者为 `neilmorse`，详见[Registry 方案](registry-plan.md)。不得声称已进入 Registry。
+
+历史修复、样本与失败记录保留在[发布准备报告](../audits/release-readiness-2026-10-31.md)
+和 [CHANGELOG](../../CHANGELOG.md)，其中“未发布”是对应历史阶段的状态。

spring_runtime_mcp-0.2.1/docs/launch/server-0.2.1.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.neilmorse/spring-runtime-mcp",
+  "title": "Spring Boot Runtime Diagnostics",
+  "description": "Read-only Spring Boot runtime evidence for agents: beans, routes, health, startup.",
+  "version": "0.2.1",
+  "repository": {
+    "url": "https://github.com/neilmorse/spring-runtime-mcp",
+    "source": "github"
+  },
+  "packages": [
+    {
+      "registryType": "pypi",
+      "identifier": "spring-runtime-mcp",
+      "version": "0.2.1",
+      "transport": {
+        "type": "stdio"
+      }
+    }
+  ]
+}

{spring_runtime_mcp-0.2.0 → spring_runtime_mcp-0.2.1}/pyproject.toml

@@ -43,10 +43,10 @@ dev = [
 ]
 
 [project.urls]
-Homepage = "https://github.com/Kaelenx/spring-runtime-mcp"
-Repository = "https://github.com/Kaelenx/spring-runtime-mcp"
-Issues = "https://github.com/Kaelenx/spring-runtime-mcp/issues"
-Changelog = "https://github.com/Kaelenx/spring-runtime-mcp/blob/master/CHANGELOG.md"
+Homepage = "https://github.com/neilmorse/spring-runtime-mcp"
+Repository = "https://github.com/neilmorse/spring-runtime-mcp"
+Issues = "https://github.com/neilmorse/spring-runtime-mcp/issues"
+Changelog = "https://github.com/neilmorse/spring-runtime-mcp/blob/master/CHANGELOG.md"
 
 [tool.hatch.version]
 path = "src/spring_runtime_mcp/__init__.py"

{spring_runtime_mcp-0.2.0 → spring_runtime_mcp-0.2.1}/src/spring_runtime_mcp/__init__.py

@@ -1,3 +1,3 @@
 """Bounded, read-only Spring Boot diagnostic analysis."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"

spring_runtime_mcp-0.2.0/docs/launch/announcement.md

@@ -1,97 +0,0 @@
-# Launch checklist and drafts
-
-Status on 2026-10-31: v0.2.0 Alpha release preparation based on `49ffdb9`.
-The release commit and final audited batch are recorded outside the repository
-to keep the verified commit clean; see the readiness report. No release tag is
-authorized yet. Public PyPI project/version endpoints returned 404, account
-access is blocked, and GitHub currently has no `pypi` environment. Codex CLI has a single-call
-fixture smoke check; other clients and complete client coverage remain unverified.
-The authoritative scope and current evidence are in
-[the release readiness report](../audits/release-readiness-2026-10-31.md).
-
-## 1. PyPI (blocking for everything else)
-
-1. Create the project `spring-runtime-mcp` on PyPI (or let the first trusted
-   publish create it).
-2. On PyPI → project → Publishing, add a trusted publisher:
-   - owner: `neilmorse` (current repository owner; the old Kaelenx URL redirects)
-   - repository: `spring-runtime-mcp`
-   - workflow: `release.yml`
-   - environment: `pypi`
-3. After a clean-commit gate exits 0, validation-only CI succeeds, account checks
-   are complete, and the operator approves publication, tag and push:
-
-   ```bash
-   git tag -a v0.2.0 -m "v0.2.0"
-   git push origin v0.2.0
-   ```
-
-4. The `Release` workflow runs the strict audited gate, validates wheel and sdist
-   independently, and publishes those same verified artifacts via OIDC. The updated
-   workflow needs a successful remote run. Use `Release validation only` on a
-   `codex/release-*` branch first; it has no publish job or OIDC permission.
-5. After the package is live, update the README quick start to
-   `uvx spring-runtime-mcp --base-url ...` and add the PyPI badge.
-
-## 2. Official MCP Registry
-
-`server.json` declares the 2025-12-11 schema; online Registry validation and account
-authorization remain to be checked before submission. The
-README contains the ownership token `mcp-name: io.github.Kaelenx/spring-runtime-mcp`,
-which the registry checks against the PyPI project description.
-
-After PyPI shows version 0.2.0:
-
-```bash
-# install the publisher CLI from the modelcontextprotocol/registry releases
-mcp-publisher login github
-mcp-publisher publish
-```
-
-Verify that the GitHub login authorizes namespace `io.github.Kaelenx`; the
-PyPI package must already contain the `mcp-name` token in its README.
-
-## 3. Directory submissions
-
-- **Smithery** — submit the repository at https://smithery.ai/new (or via the
-  Smithery CLI once the PyPI package exists). Use the same description as
-  `server.json`.
-- **awesome-mcp-servers** — open a PR to `punkpeye/awesome-mcp-servers` adding
-  under Developer Tools:
-
-  ```markdown
-  - [Kaelenx/spring-runtime-mcp](https://github.com/Kaelenx/spring-runtime-mcp) - Read-only, sanitized Spring Boot runtime diagnostics for coding agents: beans and conditions, routes, health, migrations, startup, config origin, OpenAPI and drift.
-  ```
-
-- **mcp.so / Glama / PulseMCP** — most index from the official registry, so
-  publish there first and only submit manually where a form requires it.
-
-External submissions are visible actions; review the listing text before
-sending.
-
-## 4. Launch post draft (r/java, r/springboot, dev.to)
-
-Title: **I built a read-only MCP server that tells your agent why a Spring bean
-is missing**
-
-> Coding agents can read a Spring codebase but not what happened at runtime.
-> I built `spring-runtime-mcp`, a local stdio MCP server that reads Actuator
-> and OpenAPI from an explicitly registered instance and turns it into eight
-> bounded, sanitized tools: beans and condition chains, routes, health,
-> migrations, startup, config origin, OpenAPI and drift.
->
-> It is deliberately narrow: GET only, fixed endpoints, no redirects, no
-> heapdump/logfile, no raw env dumps, 16 KiB per response, and missing evidence
-> is reported as `partial`/`unknown` instead of a confident guess.
->
-> Example from the included Boot 3.4 demo: `springboot_inspect_beans` returns
->
-> ```text
-> REQUIRED_BEAN_MISSING      (StripeConfiguration#paymentGateway)
->   → SOURCE_FACTORY_NOT_CREATED
->     → PROPERTY_NOT_FOUND   (StripeConfiguration#stripeClient, stripe.enabled)
-> ```
->
-> Repo: https://github.com/Kaelenx/spring-runtime-mcp (Apache-2.0). Feedback from
-> people running Spring Boot 2.7/3.x/4.x in unusual setups is especially
-> welcome — synthetic fixtures only go so far.