pyproject.toml

[project]
name = "codealive-mcp"
dynamic = ["version"]
description = "MCP server for the CodeAlive API"
readme = "README.md"
requires-python = ">=3.11"
dependencies = [
    "fastmcp==3.4.3",
    "httpx==0.28.1",
    "python-dotenv==1.2.2",
    "loguru==0.7.3",
    "opentelemetry-api==1.43.0",
    "opentelemetry-sdk==1.43.0",
    "opentelemetry-exporter-otlp-proto-http==1.43.0",
    "opentelemetry-instrumentation-httpx==0.64b0",
    "opentelemetry-instrumentation-starlette==0.64b0",
    "opentelemetry-semantic-conventions==0.64b0",
]

[project.optional-dependencies]
test = [
    "pytest==9.1.1",
    "pytest-asyncio==1.4.0",
    "pytest-mock==3.15.1",
    "pytest-cov==7.1.0",
    "mcp==1.28.1",
    "jsonschema==4.26.0",
]

[project.scripts]
codealive-mcp = "codealive_mcp.server:main"

[build-system]
requires = ["setuptools==83.0.0", "setuptools-scm==10.2.0"]
build-backend = "setuptools.build_meta"

[tool.setuptools]
packages = ["src"]
package-dir = {"" = "."}

[tool.setuptools_scm]
fallback_version = "3.0.2"

[tool.uv]
# Relative dates in exclude-newer (e.g. "7 days") require uv ≥ 0.11.
# Older versions silently ignore the whole [tool.uv] section on parse error.
required-version = "==0.11.28"
exclude-newer = "7 days"
# Security exception: cryptography 50.0.0 fixes GHSA-g6cj-pr64-35w5 and was
# released inside the normal quarantine window. Keep the exception package-
# scoped so all unrelated dependencies remain subject to the seven-day delay.
exclude-newer-package = { cryptography = "2026-08-01T00:00:00Z" }
# Security minimums are older than the global seven-day quarantine. Exact direct
# pins plus exclude-newer keep every future lock update inside the same policy.
constraint-dependencies = [
    "cryptography>=48.0.1",
    "idna>=3.15",
    "pydantic-settings>=2.14.2",
    "pyjwt>=2.13.0",
    "urllib3>=2.7.0",
]