safe-pkgs/Cargo.toml at main · math280h/safe-pkgs · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
[workspace]
members = [
    ".",
    "crates/core",
    "crates/http",
    "crates/osv",
    "crates/registry/*",
    "crates/checks/*",
]
resolver = "2"

[workspace.package]
version = "1.0.0"
edition = "2024"
rust-version = "1.85"
license = "MIT"
repository = "https://github.com/math280h/safe-pkgs"

[workspace.dependencies]
anyhow = "1"
async-trait = "0.1"
chrono = { version = "0.4", features = ["clock", "serde"] }
clap = { version = "4", features = ["derive"] }
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
rmcp = { version = "1.4", features = ["server", "transport-io"] }
rusqlite = { version = "0.32", features = ["bundled"] }
schemars = "1"
semver = "1"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
sha2 = "0.10"
thiserror = "2"
tokio = { version = "1", features = ["full"] }
toml = "0.8"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
wiremock = "0.6"

[package]
name = "safe-pkgs"
version.workspace = true
edition.workspace = true
rust-version.workspace = true
license.workspace = true
repository.workspace = true
description = "Package safety checks for AI agents before install — MCP server + CLI with allow/deny decisions, risk scoring, and audit logs."
readme = "README.md"
keywords = ["mcp", "security", "supply-chain", "dependencies", "cli"]
categories = ["command-line-utilities", "development-tools"]
# Distributed as a binary (cargo install --path . / release binaries), not published to crates.io.
publish = false

[dependencies]
# External dependencies
anyhow.workspace = true
async-trait.workspace = true
chrono.workspace = true
clap.workspace = true
reqwest.workspace = true
rmcp.workspace = true
rusqlite.workspace = true
schemars.workspace = true
semver.workspace = true
serde.workspace = true
serde_json.workspace = true
sha2.workspace = true
tokio.workspace = true
toml.workspace = true
tracing.workspace = true
tracing-subscriber.workspace = true

# Internal workspace crates
safe-pkgs-core = { path = "crates/core" }

# Registry crates
safe-pkgs-cargo = { path = "crates/registry/cargo" }
safe-pkgs-npm = { path = "crates/registry/npm" }
safe-pkgs-pypi = { path = "crates/registry/pypi" }

# Check crates
safe-pkgs-check-advisory = { path = "crates/checks/advisory" }
safe-pkgs-check-existence = { path = "crates/checks/existence" }
safe-pkgs-check-install-script = { path = "crates/checks/install-script" }
safe-pkgs-check-popularity = { path = "crates/checks/popularity" }
safe-pkgs-check-staleness = { path = "crates/checks/staleness" }
safe-pkgs-check-typosquat = { path = "crates/checks/typosquat" }
safe-pkgs-check-version-age = { path = "crates/checks/version-age" }

[dev-dependencies]
wiremock.workspace = true