dev-security/pyproject.toml at main · Christian-Katzmann/dev-security · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
[project]
name = "security-observatory"
version = "0.2.0"
description = "Local-first security observability for modern AI-era repositories."
requires-python = ">=3.11"
dependencies = []

[project.optional-dependencies]
mcp = ["mcp>=1.0"]

[project.scripts]
security-scan = "security_observatory.cli:main"
devsec-mcp = "security_observatory.mcp_server:main"
devsec-mcp-rw = "security_observatory.mcp_server:main_rw"

[tool.pytest.ini_options]
pythonpath = ["src"]
testpaths = ["tests"]

[tool.uv]
# Install the package itself into the uv-managed venv so the `security-scan`
# and MCP script entry points work via `uv run <name>`.
package = true

[tool.hatch.build.targets.wheel]
packages = ["src/security_observatory"]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[dependency-groups]
dev = [
    "pytest>=9.0.3",
    # The MCP SDK backs the write-guard, injection, clean-room, red-team, and
    # corrupt-store recovery trust tests. Pinned into the canonical dev group (not
    # just the optional `mcp` extra) so `uv sync --dev` always installs it and the
    # `pytest.importorskip("mcp")` guards run instead of silently skipping. A dev
    # checkout missing it now fails loudly rather than reporting a weaker green.
    "mcp>=1.0",
]