tool-compass 2.5.4__tar.gz → 2.5.6__tar.gz

{tool_compass-2.5.4 → tool_compass-2.5.6}/.env.example

@@ -47,13 +47,18 @@ LOG_LEVEL=INFO
 
 # Host / port are set on the CLI, not via env vars — `ui.py` passes them
 # explicitly to Gradio's launch(), which overrides GRADIO_SERVER_NAME/PORT:
-#   tool-compass ui --host 0.0.0.0 --port 7860
-# (defaults: 127.0.0.1:7860; the Docker image already binds 0.0.0.0.)
-
-# Public sharing: pass `tool-compass ui --share` for a public Gradio URL.
-# --share is REFUSED unless GRADIO_AUTH is set, so the link is never wide
-# open. Format is "user:pass" (both sides non-empty).
+#   tool-compass ui --host 0.0.0.0 --port 7860 --auth user:pass
+# (defaults: 127.0.0.1:7860; the Docker UI image binds 0.0.0.0.)
+
+# UI login in "user:pass" format (both sides non-empty). Applied on every UI
+# start when set, and REQUIRED when binding a non-loopback host (including the
+# Docker UI container) or passing `--share`.
+# To start the Docker UI container (or any non-loopback bind), either:
+#   1. Set GRADIO_AUTH=user:pass, OR
+#   2. Set TOOL_COMPASS_UI_ALLOW_NO_LOGIN=1 when running behind a proxy that
+#      does its own login (prints a startup warning and hides execute controls).
 # GRADIO_AUTH=user:pass
+# TOOL_COMPASS_UI_ALLOW_NO_LOGIN=1
 
 # =============================================================================
 # Docker-Specific
@@ -62,6 +67,26 @@ LOG_LEVEL=INFO
 # When running in Docker, use host.docker.internal to reach host services
 # OLLAMA_URL=http://host.docker.internal:11434
 
+# =============================================================================
+# HTTP Gateway Settings (when PORT is set or `tool-compass serve --http`)
+# =============================================================================
+
+# Port for streamable-http transport (unset = stdio mode)
+# PORT=8080
+
+# Bind host for HTTP mode (default: 127.0.0.1). Non-loopback values refuse to
+# start unless TOOL_COMPASS_GATEWAY_AUTH_TOKEN (or gateway_auth_token) is set,
+# or TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN=1 is set behind an authenticating proxy.
+# HOST=127.0.0.1
+
+# Bearer token for the HTTP gateway (overrides gateway_auth_token in
+# compass_config.json). Required off loopback; optional on loopback.
+# TOOL_COMPASS_GATEWAY_AUTH_TOKEN=
+
+# Explicit opt-out allowing non-loopback HTTP startup without a bearer token
+# when an authenticating reverse proxy sits in front (logs a startup warning).
+# TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN=1
+
 # =============================================================================
 # Analytics (optional)
 # =============================================================================

{tool_compass-2.5.4 → tool_compass-2.5.6}/.github/workflows/ci.yml

@@ -204,7 +204,7 @@ jobs:
 
       - name: Atlas check
         if: matrix.python-version == '3.12' && matrix.os == 'ubuntu-latest'
-        run: npx --yes @dogfood-lab/atlas@1.24.0 check
+        run: npx --yes @dogfood-lab/atlas@1.26.0 check
 
       - name: Install dependencies
         run: |
@@ -219,7 +219,7 @@ jobs:
 
       - name: Upload JUnit report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: junit-reports-${{ matrix.python-version }}-${{ matrix.os }}
           path: junit-${{ matrix.python-version }}-${{ matrix.os }}.xml
@@ -242,7 +242,7 @@ jobs:
       # replace the artifact its earlier attempt saved.
       - name: Save coverage for Codecov
         if: ${{ env.COVERAGE_LEG == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codecov-coverage
           path: coverage.xml
@@ -252,7 +252,7 @@ jobs:
 
       - name: Save test results for Codecov
         if: ${{ !cancelled() && env.COVERAGE_LEG == 'true' && steps.tests.outcome != 'skipped' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: codecov-test-results
           path: junit.xml
@@ -268,7 +268,7 @@ jobs:
 
       - name: Upload pip-audit report
         if: matrix.python-version == '3.12' && matrix.os == 'ubuntu-latest'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: pip-audit-report
           path: pip-audit-report.json
@@ -277,13 +277,65 @@ jobs:
           # retention and is plenty of window for incident response.
           retention-days: 14
 
-      # Now BLOCKING. The dogfood-swarm v3 pass reviewed the CVE baseline:
-      # `pip-audit -r requirements.txt` reports no known vulnerabilities. The
+      # Now BLOCKING, in two parts. The core install (requirements.txt without
+      # the Web UI line) is audited strictly, with no ignores. The Web UI extra
+      # (gradio) is audited next with the dated Pillow exception (#157). The
       # report-only artifact step above still runs for the full JSON snapshot.
-      - name: Audit dependencies for vulnerabilities
+      - name: Audit core dependencies for vulnerabilities
         if: matrix.python-version == '3.12' && matrix.os == 'ubuntu-latest'
         run: |
-          pip-audit -r requirements.txt
+          grep -vi '^gradio' requirements.txt > "$RUNNER_TEMP/requirements-core.txt"
+          pip-audit -r "$RUNNER_TEMP/requirements-core.txt"
+
+      - name: Audit Web UI extra for vulnerabilities
+        if: matrix.python-version == '3.12' && matrix.os == 'ubuntu-latest'
+        run: |
+          grep -i '^gradio' requirements.txt > "$RUNNER_TEMP/requirements-ui.txt"
+          # Dated exception until 2026-12-10 (#157): gradio 6.31.0 requires
+          # pillow<13.0, holding pillow at 12.3.0 while the 40 advisories below
+          # are fixed in 13.0.0 and unreachable from tool-compass. Remove when
+          # a stable gradio allows pillow 13, or re-read on 2026-12-10.
+          pip-audit -r "$RUNNER_TEMP/requirements-ui.txt" \
+            --ignore-vuln PYSEC-2026-4327 \
+            --ignore-vuln PYSEC-2026-4328 \
+            --ignore-vuln PYSEC-2026-4326 \
+            --ignore-vuln PYSEC-2026-4339 \
+            --ignore-vuln PYSEC-2026-4340 \
+            --ignore-vuln PYSEC-2026-4343 \
+            --ignore-vuln PYSEC-2026-4334 \
+            --ignore-vuln PYSEC-2026-4337 \
+            --ignore-vuln PYSEC-2026-4341 \
+            --ignore-vuln PYSEC-2026-4330 \
+            --ignore-vuln PYSEC-2026-4338 \
+            --ignore-vuln PYSEC-2026-4335 \
+            --ignore-vuln PYSEC-2026-4336 \
+            --ignore-vuln PYSEC-2026-4331 \
+            --ignore-vuln PYSEC-2026-4332 \
+            --ignore-vuln PYSEC-2026-4329 \
+            --ignore-vuln PYSEC-2026-4333 \
+            --ignore-vuln PYSEC-2026-4342 \
+            --ignore-vuln CVE-2026-112895 \
+            --ignore-vuln CVE-2026-112400 \
+            --ignore-vuln CVE-2026-112897 \
+            --ignore-vuln CVE-2026-112395 \
+            --ignore-vuln CVE-2026-112404 \
+            --ignore-vuln CVE-2026-112899 \
+            --ignore-vuln CVE-2026-112900 \
+            --ignore-vuln CVE-2026-112893 \
+            --ignore-vuln CVE-2026-112891 \
+            --ignore-vuln CVE-2026-112390 \
+            --ignore-vuln CVE-2026-112401 \
+            --ignore-vuln CVE-2026-112391 \
+            --ignore-vuln CVE-2026-112894 \
+            --ignore-vuln CVE-2026-112406 \
+            --ignore-vuln CVE-2026-112399 \
+            --ignore-vuln CVE-2026-112892 \
+            --ignore-vuln CVE-2026-112393 \
+            --ignore-vuln CVE-2026-96638 \
+            --ignore-vuln CVE-2026-96640 \
+            --ignore-vuln CVE-2026-96778 \
+            --ignore-vuln GHSA-78g4-xqwv-q3g8 \
+            --ignore-vuln PYSEC-2026-4363
 
   codecov:
     # Uploads what the test job saved, from a job of its own, so the OIDC
@@ -310,13 +362,13 @@ jobs:
       # that matches nothing, unlike a name, does not fail: a failing test
       # run saves test results and no coverage.
       - name: Download coverage
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: codecov-coverage
           path: .
 
       - name: Download test results
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: codecov-test-results
           path: .
@@ -531,10 +583,10 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build Docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           target: ${{ matrix.target }}
@@ -547,10 +599,55 @@ jobs:
       - name: Smoke run
         run: |
           set -euo pipefail
-          docker run -d --name tc-smoke -p ${{ matrix.port }}:${{ matrix.port }} ${{ matrix.tag }}
+          # PYTHONUNBUFFERED + PYTHONFAULTHANDLER: a start that stalls before the
+          # app logs anything (seen on hosted runners: the container printed only
+          # the entrypoint's volume warning for the whole window) must say where
+          # it is stuck. On timeout the step sends SIGABRT, which makes Python
+          # write every thread's stack to the container log before it dies.
+          if [ "${{ matrix.smoke }}" = "bind" ]; then
+            # UI image binds 0.0.0.0 and must refuse a bare start without login.
+            rc=0
+            docker run --rm ${{ matrix.tag }} >/dev/null 2>&1 || rc=$?
+            if [ "$rc" -ne 2 ]; then
+              echo "::error::UI container without GRADIO_AUTH exited $rc (expected 2)"
+              exit 1
+            fi
+            docker run -d --name tc-smoke -e PYTHONUNBUFFERED=1 -e PYTHONFAULTHANDLER=1 \
+              -e GRADIO_AUTH=u:p -p ${{ matrix.port }}:${{ matrix.port }} ${{ matrix.tag }}
+          else
+            SMOKE_ENV_ARGS=()
+            if [ "${{ matrix.target }}" = "mcp-gateway" ]; then
+              # Bare start (HOST=0.0.0.0, no token, no opt-out) must refuse with
+              # exit code 2. Bound with timeout so a fail-open start cannot hang.
+              set +e
+              BARE_OUT="$(timeout 30s docker run --rm --name tc-smoke-bare \
+                -e PYTHONUNBUFFERED=1 ${{ matrix.tag }} 2>&1)"
+              BARE_RC=$?
+              set -e
+              docker rm -f tc-smoke-bare >/dev/null 2>&1 || true
+              echo "$BARE_OUT"
+              if [ "$BARE_RC" -ne 2 ]; then
+                echo "::error::bare mcp-gateway start expected exit 2, got ${BARE_RC}"
+                exit 1
+              fi
+              SMOKE_VAL="ci-smoke"
+              SMOKE_ENV_ARGS=(-e "TOOL_COMPASS_GATEWAY_AUTH_TOKEN=${SMOKE_VAL}")
+            fi
+            docker run -d --name tc-smoke -e PYTHONUNBUFFERED=1 -e PYTHONFAULTHANDLER=1 \
+              ${SMOKE_ENV_ARGS[@]+"${SMOKE_ENV_ARGS[@]}"} \
+              -p ${{ matrix.port }}:${{ matrix.port }} ${{ matrix.tag }}
+          fi
           cleanup() { docker logs tc-smoke || true; docker rm -f tc-smoke || true; }
           trap cleanup EXIT
-          for _ in $(seq 1 45); do
+          # 90 x 2s = 3 minutes. 45 x 2s was enough on every run that started
+          # normally (the image answers in a few seconds), but a hosted runner
+          # that is slow to start the process failed the required check with no
+          # code change; a crashed container still fails at once (below).
+          for _ in $(seq 1 90); do
+            if [ "$(docker inspect -f '{{.State.Running}}' tc-smoke)" != "true" ]; then
+              echo "::error::docker smoke (${{ matrix.target }}) container exited before it was ready"
+              exit 1
+            fi
             if [ "${{ matrix.smoke }}" = "health" ]; then
               if curl -sf "http://127.0.0.1:${{ matrix.port }}/health"; then
                 echo "gateway /health ok"
@@ -569,6 +666,9 @@ jobs:
             sleep 2
           done
           echo "::error::docker smoke (${{ matrix.target }}) did not become ready on port ${{ matrix.port }}"
+          docker top tc-smoke || true
+          docker kill -s ABRT tc-smoke || true
+          sleep 2
           exit 1
 
   # ===========================================================================

{tool_compass-2.5.4 → tool_compass-2.5.6}/.github/workflows/publish.yml

@@ -77,7 +77,7 @@ jobs:
         run: twine check dist/*
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: dist
           path: dist/
@@ -104,13 +104,13 @@ jobs:
 
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: dist
           path: dist/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           # CT-B-009: emit SLSA build provenance attestations for the wheel
           # and sdist. PyPI verifies the attestation against the workflow's
@@ -207,13 +207,13 @@ jobs:
         # SHA-pinned per SLSA L3 supply-chain hygiene (CT-B-002). publish job
         # carries packages:write — a compromised mutable v3 tag would inherit
         # GHCR write capability during a release window. Bump via dependabot.
-        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           target: ${{ matrix.target }}

{tool_compass-2.5.4 → tool_compass-2.5.6}/.github/workflows/release-binaries.yml

@@ -137,7 +137,7 @@ jobs:
           "$BIN" ui --help
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: binary-${{ matrix.target }}
           path: dist/${{ env.TOOL_NAME }}-*
@@ -154,7 +154,7 @@ jobs:
       attestations: write
     steps:
       - name: Download all binaries
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: artifacts
           merge-multiple: true

tool_compass-2.5.6/.polyglot-pins.json

@@ -0,0 +1,29 @@
+{
+  "version": 1,
+  "pins": {
+    "0ec3b638688c0d83:zh": {
+      "lang": "zh",
+      "source": "Per-category scores are regenerated post-swarm via\n`bash scripts/regenerate-scorecard.sh` (which wraps `npx\n@mcptoolshop/shipcheck audit`). See [SCORECARD.md](SCORECARD.md) for the\ncurrent authoritative breakdown — the table below mirrors it and is\nintentionally not hand-authored. Hand-curated sections (Known Gaps,\nRemediation History) live outside the `<!-- SHIPCHECK-AUTO-START/END -->`\nmarkers in SCORECARD.md and survive regenerations.",
+      "translation": "通过 `bash scripts/regenerate-scorecard.sh` 在群集完成后重新生成每个类别的分数（该工具包装了 `npx @mcptoolshop/shipcheck audit`）。有关当前权威的细分，请参阅 [SCORECARD.md](SCORECARD.md)——下表是对其的镜像，并且有意不是手动编写的。手动策划的部分（已知差距、修复历史记录）位于 SCORECARD.md 中的 `<!-- SHIPCHECK-AUTO-START/END -->` 标记之外，并且会在重新生成时保留。",
+      "pinnedAt": "2026-11-12T11:38:07.275Z"
+    },
+    "28f2f2cfe1b673d7:ja": {
+      "lang": "ja",
+      "source": "Get the full `inputSchema` for a tool (required/enums/defaults)",
+      "translation": "ツールの完全な `inputSchema`（必須項目／列挙型／デフォルト値）を取得します。",
+      "pinnedAt": "2026-11-12T11:38:07.731Z"
+    },
+    "bb5538e8cb37670d:ja": {
+      "lang": "ja",
+      "source": "Set to `1` to allow starting the UI off loopback without `GRADIO_AUTH` behind an authenticating proxy (warns and hides execute controls)",
+      "translation": "`1` に設定すると、認証プロキシの背後で `GRADIO_AUTH` なしにループバック以外でUIを起動できます（警告を表示し、実行コントロールを非表示にします）。",
+      "pinnedAt": "2026-11-12T11:38:07.733Z"
+    },
+    "ee7649ad38ebf58b:zh": {
+      "lang": "zh",
+      "source": "📖 **Full documentation:** See the [Tool Compass Handbook](https://mcp-tool-shop-org.github.io/tool-compass/handbook/) for installation, configuration, and architecture deep-dives.",
+      "translation": "📖 **完整文档：** 请参阅 [Tool Compass Handbook](https://mcp-tool-shop-org.github.io/tool-compass/handbook/)，其中包含有关安装、配置和架构的详细信息。",
+      "pinnedAt": "2026-11-12T11:38:07.271Z"
+    }
+  }
+}

{tool_compass-2.5.4 → tool_compass-2.5.6}/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.5.6] - 2026-11-12
+
+### Changed
+
+- **The Gradio UI honours `GRADIO_AUTH` / `--auth` on every start, and refuses to start off loopback (including the Docker UI container) without a login.** Loopback starts (`127.0.0.1`, `localhost`, `::1`) continue to work without a login when `GRADIO_AUTH` is unset, and apply the login whenever `GRADIO_AUTH=user:pass` or `tool-compass ui --auth user:pass` is set (malformed values exit with code 2). Non-loopback starts and the Docker UI image require `GRADIO_AUTH=user:pass`, or `TOOL_COMPASS_UI_ALLOW_NO_LOGIN=1` when running behind a proxy that enforces its own login (which prints a startup warning and hides the UI execute controls).
+- Added a dated `pip-audit` exception in CI until 2026-12-10 (#157) for 39 unreachable `pillow` 12.3.0 advisories held below `13.0.0` by `gradio` 6.31.0's `pillow<13.0` requirement, and raised the coverage floor (`[tool.coverage.report].fail_under`) from 77 to 78.
+- The HTTP gateway off loopback (`HOST` other than `127.0.0.1`, `localhost`, or `::1`) — including the `mcp-gateway` Docker image, the `docker-compose.yml` `gateway` service, and `fly.toml` — now refuses to start (exits 2) unless a non-empty bearer token is configured via `TOOL_COMPASS_GATEWAY_AUTH_TOKEN` (or `gateway_auth_token` in `compass_config.json`, or `fly secrets set TOOL_COMPASS_GATEWAY_AUTH_TOKEN=<token>` on Fly.io) or the proxy opt-out `TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN=1` is set (which logs a warning on every start). Loopback HTTP starts without a token continue to work unchanged, and `/health` and `/ready` remain unauthenticated for probes.
+- Site dependencies updated with `npm audit fix` (`vite`, `undici`, `zod` and related packages); `npm audit` now reports 0 vulnerabilities for `site/`.
+- The CI dependency audit is split in two: the core install is audited strictly with no exceptions, and the Web UI extra (`gradio`) keeps the dated Pillow exception.
+
+### Fixed
+
+- The gateway's bearer check compares bytes instead of text. A non-ASCII `Authorization` header (or a non-ASCII configured token) made `hmac.compare_digest` raise, so the request got a 500 instead of a 401. It still refused the request, and a non-ASCII token now works.
+
+## [2.5.5] - 2026-10-15
+
+### Fixed
+
+- **The Docker image no longer crashes with "Illegal instruction" on a CPU older than the one that built it.** `hnswlib` has no wheel for the image's Python, so the build compiles it, and its `setup.py` adds `-march=native` unless `HNSWLIB_NO_NATIVE` is set. The compiled extension therefore carried the build host's CPU extensions, and on a CPU without them `import hnswlib` (first reached from `indexer.py`) killed the process with SIGILL before the gateway printed anything. The builder stage now sets `HNSWLIB_NO_NATIVE=1`. It surfaced as an intermittent failure of the required `Docker mcp-gateway` smoke check, where a cached image layer built on one hosted runner ran on a different one.
+
+### Changed
+
+- The CI Docker smoke waits up to 3 minutes instead of 90 seconds, fails at once if the container exits, and on a timeout sends SIGABRT so Python writes its stack to the log. No effect on the published package.
+
 ## [2.5.4] - 2026-10-14
 
 ### Security
@@ -42,7 +66,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - `.gitattributes` pins LF on `*.sh`, the `Dockerfile` and the entrypoint. A
   shell script checked out with CRLF on Windows makes the shebang
-  `#!/bin/sh
+  `#!/bin/sh
+`, and Linux then fails with "no such file or directory" naming
   the script rather than the line endings — invisible to CI, which checks out
   LF on Linux, and visible only to a contributor building the image on Windows.
   Caught on the sibling xrpl-camp repo the same day.

{tool_compass-2.5.4 → tool_compass-2.5.6}/Dockerfile

@@ -28,6 +28,15 @@ COPY cli.py gateway.py ui.py indexer.py embedder.py chain_indexer.py \
 # the `tool-compass` console script ends up on PATH (ships with the image).
 RUN python -m venv /opt/venv
 ENV PATH="/opt/venv/bin:$PATH"
+# hnswlib publishes no wheel for this interpreter, so pip compiles it here, and
+# its setup.py adds -march=native unless HNSWLIB_NO_NATIVE is set. That bakes the
+# build machine's CPU extensions (AVX-512 on some hosted runners) into the image;
+# on a CPU without them the first `import hnswlib` dies with SIGILL ("Illegal
+# instruction") before the gateway prints anything. Observed as an intermittent
+# CI smoke failure when a cached layer built on one runner ran on another, and
+# it is the same hazard for anyone pulling the published image onto an older CPU.
+# Builder stage only: the production stage copies the venv, not the variable.
+ENV HNSWLIB_NO_NATIVE=1
 RUN pip install --no-cache-dir --upgrade pip && \
     pip install --no-cache-dir -r requirements.txt && \
     pip install --no-cache-dir uvicorn && \
@@ -104,9 +113,10 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
 
 # Default command: Run Gradio UI.
 # UI-DOCKER-BIND-001: bind 0.0.0.0 explicitly so the UI is reachable through the
-# published port mapping (inside the container the container boundary is the
-# isolation layer; external exposure is controlled by `docker run -p` /
-# compose `ports:`). Without this the UI bound to 127.0.0.1 and was unreachable.
+# published port mapping; without this the UI bound to 127.0.0.1 inside the
+# container and was unreachable. Because 0.0.0.0 is non-loopback, startup
+# refuses to run unless GRADIO_AUTH=user:pass is set (or
+# TOOL_COMPASS_UI_ALLOW_NO_LOGIN=1 is set behind a proxy that does its own login).
 CMD ["python", "ui.py", "--host", "0.0.0.0", "--port", "7860"]
 
 # =============================================================================
@@ -114,12 +124,15 @@ CMD ["python", "ui.py", "--host", "0.0.0.0", "--port", "7860"]
 # =============================================================================
 FROM production AS mcp-gateway
 
-# Override for HTTP mode (Fly.io / Smithery)
+# Override for HTTP mode (Fly.io / Smithery / reverse-proxy deployments).
 # ci-infra-01: gateway.py's _run_http defaults HOST to 127.0.0.1 (loopback), so
-# without this the published image binds loopback and any orchestrator's proxy /
-# health check (the HEALTHCHECK below hits localhost, but Fly/Smithery reach the
-# container over the network) can't reach the gateway. 0.0.0.0 is the documented
-# reverse-proxy path — this image is meant to sit behind an authenticated edge.
+# without this the published image binds loopback and orchestrators reaching the
+# container over the network cannot connect. Because HOST=0.0.0.0 is non-loopback,
+# the container refuses to start (exit 2) unless the operator passes
+# TOOL_COMPASS_GATEWAY_AUTH_TOKEN (or sets gateway_auth_token in config), or sets
+# TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN=1 behind an authenticating proxy. Neither
+# variable is set here so the image fails closed by default; /health stays exempt
+# so the HEALTHCHECK below works with a token set.
 ENV PORT=8080 \
     HOST=0.0.0.0
 

{tool_compass-2.5.4 → tool_compass-2.5.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tool-compass
-Version: 2.5.4
+Version: 2.5.6
 Summary: Semantic MCP tool discovery gateway - find tools by intent, not memory
 Project-URL: Homepage, https://github.com/mcp-tool-shop-org/tool-compass
 Project-URL: Documentation, https://github.com/mcp-tool-shop-org/tool-compass#readme
@@ -143,21 +143,31 @@ tool-compass ui
 git clone https://github.com/mcp-tool-shop-org/tool-compass.git
 cd tool-compass
 
-# Start with Docker Compose (requires Ollama running locally)
-docker-compose up
+# Start with Docker Compose (requires Ollama running locally and a UI login)
+GRADIO_AUTH=user:pass docker compose up
 
 # Or include Ollama in the stack
-docker-compose --profile with-ollama up
+GRADIO_AUTH=user:pass docker compose --profile with-ollama up
 
 # Access the UI at http://localhost:7860
 ```
 
-Or run the published image directly, without cloning:
+Or run the published UI image directly, without cloning:
 
 ```bash
-docker run --rm -p 7860:7860   -v tool-compass-data:/app/tool_compass/db   ghcr.io/mcp-tool-shop-org/tool-compass:latest
+docker run --rm -p 7860:7860 \
+  -e GRADIO_AUTH=user:pass \
+  -v tool-compass-data:/app/tool_compass/db \
+  ghcr.io/mcp-tool-shop-org/tool-compass:ui
 ```
 
+> **UI login required in containers.** Because the container binds `0.0.0.0`,
+> startup refuses to run without a login. Start it in one of two ways: set
+> `GRADIO_AUTH=user:pass` (via `.env`, shell environment, or `-e`), or set
+> `TOOL_COMPASS_UI_ALLOW_NO_LOGIN=1` when deploying behind a reverse proxy that
+> enforces its own login (prints a startup warning and hides the UI execute
+> controls).
+
 > **Mount the volume.** The semantic index lives in `/app/tool_compass/db`, and
 > building it means embedding every tool in every configured server. Without a
 > volume that work is thrown away when the container exits and paid again on the
@@ -169,6 +179,19 @@ docker run --rm -p 7860:7860   -v tool-compass-data:/app/tool_compass/db   ghcr.
 > `linux/amd64` and `linux/arm64`, so the same tag runs on x86_64 servers
 > and Apple Silicon / ARM workstations.
 
+To run the **MCP HTTP gateway** container (`mcp-gateway` stage, port `8080`), supply a bearer token — because the container binds `HOST=0.0.0.0`, it refuses to start without `TOOL_COMPASS_GATEWAY_AUTH_TOKEN` (or `TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN=1` when behind an authenticating reverse proxy):
+
+```bash
+# Docker Compose (gateway profile)
+TOOL_COMPASS_GATEWAY_AUTH_TOKEN=<your-token> docker compose --profile gateway up
+
+# Or published gateway image directly
+docker run --rm -p 8080:8080 \
+  -e TOOL_COMPASS_GATEWAY_AUTH_TOKEN=<your-token> \
+  -v tool-compass-data:/app/tool_compass/db \
+  ghcr.io/mcp-tool-shop-org/tool-compass:gateway
+```
+
 ## Features
 
 - **Hybrid Search** - Semantic (HNSW) + lexical fusion with exact-name boost — describe what you want, or paste a tool name and it ranks #1
@@ -289,7 +312,11 @@ The `hint` field in compass results guides this flow, suggesting when to use `de
 | `OLLAMA_URL` | Ollama server URL | `http://localhost:11434` |
 | `COMFYUI_URL` | ComfyUI server | `http://localhost:8188` |
 | `PORT` | Set to enable HTTP transport (e.g., for Fly.io) | unset (stdio) |
-| `TOOL_COMPASS_GATEWAY_AUTH_TOKEN` | Bearer token required on the HTTP transport (opt-in; overrides the `gateway_auth_token` config field) | unset (no auth) |
+| `HOST` | Bind address for the HTTP transport; non-loopback values require `TOOL_COMPASS_GATEWAY_AUTH_TOKEN` (or `gateway_auth_token`) unless `TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN=1` is set | `127.0.0.1` |
+| `TOOL_COMPASS_GATEWAY_AUTH_TOKEN` | Bearer token for the HTTP transport (overrides `gateway_auth_token` in `compass_config.json`). Required when `HOST` is not loopback (`127.0.0.1`, `localhost`, `::1`); optional on loopback | unset (refuses off loopback) |
+| `TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN` | Set to `1` to allow binding the HTTP gateway off loopback without a bearer token when an authenticating reverse proxy sits in front (logs a warning on every start) | unset (disabled) |
+| `GRADIO_AUTH` | UI login (`user:pass`); applied on every UI start when set, and required off loopback / in Docker / on `--share` | unset (loopback only) |
+| `TOOL_COMPASS_UI_ALLOW_NO_LOGIN` | Set to `1` to allow starting the UI off loopback without `GRADIO_AUTH` behind an authenticating proxy (warns and hides execute controls) | unset |
 
 **Default data directories:**
 - **Windows:** `%LOCALAPPDATA%\tool-compass\`

{tool_compass-2.5.4 → tool_compass-2.5.6}/README.md

@@ -98,21 +98,31 @@ tool-compass ui
 git clone https://github.com/mcp-tool-shop-org/tool-compass.git
 cd tool-compass
 
-# Start with Docker Compose (requires Ollama running locally)
-docker-compose up
+# Start with Docker Compose (requires Ollama running locally and a UI login)
+GRADIO_AUTH=user:pass docker compose up
 
 # Or include Ollama in the stack
-docker-compose --profile with-ollama up
+GRADIO_AUTH=user:pass docker compose --profile with-ollama up
 
 # Access the UI at http://localhost:7860
 ```
 
-Or run the published image directly, without cloning:
+Or run the published UI image directly, without cloning:
 
 ```bash
-docker run --rm -p 7860:7860   -v tool-compass-data:/app/tool_compass/db   ghcr.io/mcp-tool-shop-org/tool-compass:latest
+docker run --rm -p 7860:7860 \
+  -e GRADIO_AUTH=user:pass \
+  -v tool-compass-data:/app/tool_compass/db \
+  ghcr.io/mcp-tool-shop-org/tool-compass:ui
 ```
 
+> **UI login required in containers.** Because the container binds `0.0.0.0`,
+> startup refuses to run without a login. Start it in one of two ways: set
+> `GRADIO_AUTH=user:pass` (via `.env`, shell environment, or `-e`), or set
+> `TOOL_COMPASS_UI_ALLOW_NO_LOGIN=1` when deploying behind a reverse proxy that
+> enforces its own login (prints a startup warning and hides the UI execute
+> controls).
+
 > **Mount the volume.** The semantic index lives in `/app/tool_compass/db`, and
 > building it means embedding every tool in every configured server. Without a
 > volume that work is thrown away when the container exits and paid again on the
@@ -124,6 +134,19 @@ docker run --rm -p 7860:7860   -v tool-compass-data:/app/tool_compass/db   ghcr.
 > `linux/amd64` and `linux/arm64`, so the same tag runs on x86_64 servers
 > and Apple Silicon / ARM workstations.
 
+To run the **MCP HTTP gateway** container (`mcp-gateway` stage, port `8080`), supply a bearer token — because the container binds `HOST=0.0.0.0`, it refuses to start without `TOOL_COMPASS_GATEWAY_AUTH_TOKEN` (or `TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN=1` when behind an authenticating reverse proxy):
+
+```bash
+# Docker Compose (gateway profile)
+TOOL_COMPASS_GATEWAY_AUTH_TOKEN=<your-token> docker compose --profile gateway up
+
+# Or published gateway image directly
+docker run --rm -p 8080:8080 \
+  -e TOOL_COMPASS_GATEWAY_AUTH_TOKEN=<your-token> \
+  -v tool-compass-data:/app/tool_compass/db \
+  ghcr.io/mcp-tool-shop-org/tool-compass:gateway
+```
+
 ## Features
 
 - **Hybrid Search** - Semantic (HNSW) + lexical fusion with exact-name boost — describe what you want, or paste a tool name and it ranks #1
@@ -244,7 +267,11 @@ The `hint` field in compass results guides this flow, suggesting when to use `de
 | `OLLAMA_URL` | Ollama server URL | `http://localhost:11434` |
 | `COMFYUI_URL` | ComfyUI server | `http://localhost:8188` |
 | `PORT` | Set to enable HTTP transport (e.g., for Fly.io) | unset (stdio) |
-| `TOOL_COMPASS_GATEWAY_AUTH_TOKEN` | Bearer token required on the HTTP transport (opt-in; overrides the `gateway_auth_token` config field) | unset (no auth) |
+| `HOST` | Bind address for the HTTP transport; non-loopback values require `TOOL_COMPASS_GATEWAY_AUTH_TOKEN` (or `gateway_auth_token`) unless `TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN=1` is set | `127.0.0.1` |
+| `TOOL_COMPASS_GATEWAY_AUTH_TOKEN` | Bearer token for the HTTP transport (overrides `gateway_auth_token` in `compass_config.json`). Required when `HOST` is not loopback (`127.0.0.1`, `localhost`, `::1`); optional on loopback | unset (refuses off loopback) |
+| `TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN` | Set to `1` to allow binding the HTTP gateway off loopback without a bearer token when an authenticating reverse proxy sits in front (logs a warning on every start) | unset (disabled) |
+| `GRADIO_AUTH` | UI login (`user:pass`); applied on every UI start when set, and required off loopback / in Docker / on `--share` | unset (loopback only) |
+| `TOOL_COMPASS_UI_ALLOW_NO_LOGIN` | Set to `1` to allow starting the UI off loopback without `GRADIO_AUTH` behind an authenticating proxy (warns and hides execute controls) | unset |
 
 **Default data directories:**
 - **Windows:** `%LOCALAPPDATA%\tool-compass\`

{tool_compass-2.5.4 → tool_compass-2.5.6}/SECURITY.md

@@ -61,8 +61,9 @@ Tool Compass is designed as a **local development tool**. It has these security
 
 | Component | Security Model |
 |-----------|----------------|
-| Gradio UI | No authentication by default |
-| MCP Gateway | Trusts backend servers |
+| Gradio UI | Loopback (`127.0.0.1` / `localhost` / `::1`) has no login by default unless `GRADIO_AUTH` / `--auth` is set; non-loopback binds (including Docker) and `--share` require `GRADIO_AUTH=user:pass` (or `TOOL_COMPASS_UI_ALLOW_NO_LOGIN=1` behind an authenticating proxy, which warns and hides execute controls) |
+| MCP Gateway (stdio) | Local subprocess transport; trusts configured backend servers |
+| MCP Gateway (HTTP) | Binds `127.0.0.1` by default; off loopback refuses to start without `TOOL_COMPASS_GATEWAY_AUTH_TOKEN` (`gateway_auth_token`) or `TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN=1` behind an authenticating proxy (`/health` and `/ready` remain unauthenticated for probes); trusts configured backend servers |
 | Analytics DB | Local SQLite, no encryption |
 | Embeddings | Sent to local Ollama |
 
@@ -70,14 +71,12 @@ Tool Compass is designed as a **local development tool**. It has these security
 
 If deploying Tool Compass in a shared environment:
 
-1. **Enable Gradio authentication**:
-   ```python
-   demo.launch(auth=("user", "password"))
-   ```
+1. **Configure UI login**:
+   Set `GRADIO_AUTH=user:pass` (or pass `tool-compass ui --auth user:pass`). Non-loopback binds and the Docker UI image refuse to start without `GRADIO_AUTH` unless `TOOL_COMPASS_UI_ALLOW_NO_LOGIN=1` is explicitly set behind a reverse proxy that enforces its own login (which prints a startup warning and hides the UI execute controls).
 
 2. **Use environment variables** for sensitive config (not `compass_config.json`)
 
-3. **Network isolation**: Run behind a reverse proxy with auth
+3. **Network isolation and HTTP gateway auth**: Run behind an authenticating reverse proxy (`TOOL_COMPASS_UI_ALLOW_NO_LOGIN=1` if delegating UI login to the proxy). When the HTTP gateway binds off loopback (`HOST` not `127.0.0.1`, `localhost`, or `::1`), set `TOOL_COMPASS_GATEWAY_AUTH_TOKEN` (or `gateway_auth_token` in config, or `fly secrets set TOOL_COMPASS_GATEWAY_AUTH_TOKEN=<token>` on Fly.io); only set `TOOL_COMPASS_GATEWAY_ALLOW_NO_TOKEN=1` when a proxy in front enforces authentication and blocks direct access to the gateway port
 
 4. **Rate limiting**: Add nginx/Cloudflare rate limiting for the UI