pyproject.toml

[project]
name = "mcp-context-server"
version = "2.2.2"
description = "MCP Context Server — a FastMCP-based server providing persistent multimodal context storage for LLM agents."
readme = "README.md"
license = "Elastic-2.0"
license-files = ["LICENSE"]
authors = [{ name = "Aleksandr Filippov", email = "alexfeel@protonmail.com" }]
requires-python = ">=3.12,<3.13"

dependencies = [
    "fastmcp==3.2.4",  # CVE-2026-32871, CVE-2026-27124, CVE-2025-64340 fixes
    "pydantic-settings==2.14.2",  # GHSA-4xgf-cpjx-pc3j fix
    "pydantic==2.12.5",
    "python-dotenv==1.2.2",  # CVE-2026-28684 fix
    "typing_extensions==4.15.0",
    "asyncpg==0.31.0",
    "anyio==4.12.1",
    "tenacity==9.1.2",
    "uuid_utils>=0.14.1,<0.15.0",
    "numpy>=2.4.1",
    "threadpoolctl>=3.5",
    "regex>=2024.11.6",
]

[build-system]
requires = ["hatchling>=1.27"]  # PEP 639 license expression support
build-backend = "hatchling.build"

[project.scripts]
mcp-context-server = "app.server:main"
mcp-context = "app.server:main"
mcp-context-server-migrate = "app.cli.migrate:main"

[tool.hatch.build.targets.wheel]
packages = ["app"]

[tool.uv]
package = true
constraint-dependencies = [
    "python-multipart>=0.0.31",  # CVE-2026-24486, CVE-2026-42561, CVE-2026-53539, CVE-2026-53540 fixes
    "cryptography>=48.0.1",  # CVE-2026-26007, GHSA-537c-gmf6-5ccf fixes
    "pillow>=12.2.0",  # CVE-2026-25990, CVE-2026-40192, CVE-2026-42311 fixes
    "langsmith>=0.8.18",  # CVE-2026-25528, CVE-2026-45134, GHSA-f4xh-w4cj-qxq8 fixes
    "langchain-core>=1.3.3",  # CVE-2026-26013, CVE-2026-34070, CVE-2026-44843 fixes
    "langchain-openai>=1.1.14",  # CVE-2026-26013, CVE-2026-41488 fixes
    "langchain-anthropic>=1.4.6",  # GHSA-gr75-jv2w-4656 fix
    "langchain-text-splitters>=1.1.2",  # CVE-2026-41481 fix
    "authlib>=1.7.1",  # CVE-2026-28802, CVE-2026-41425, CVE-2026-41479, CVE-2026-44681 fixes
    "pyjwt>=2.13.0",  # CVE-2026-32597, CVE-2026-48526 fixes
    "orjson>=3.11.6",  # CVE-2025-67221 fix
    "aiohttp>=3.14.1",  # CVE-2026-34520 fix plus the remaining aiohttp 3.13/3.14-line CVE set
    "starlette>=1.3.1",  # CVE-2026-48818, CVE-2026-54283 fixes
    "urllib3>=2.7.0",  # CVE-2026-44431, CVE-2026-44432 fixes
    "requests>=2.33.0",  # CVE-2026-25645 fix
    "idna>=3.15",  # CVE-2026-45409 fix
    "protobuf>=6.33.5",  # CVE-2026-0994 fix
    "pygments>=2.20.0",  # CVE-2026-4539 fix
]

[project.optional-dependencies]
# Embedding providers - install ONE based on EMBEDDING_PROVIDER setting
# Each includes all necessary dependencies
embeddings-ollama = [
    "numpy>=2.4.1",
    "sqlite-vec>=0.1.6",
    "pgvector>=0.4.0",
    "langchain-ollama>=0.3.0",
    "langchain-text-splitters>=1.1.2",  # CVE-2026-41481 fix
]
embeddings-openai = [
    "numpy>=2.4.1",
    "sqlite-vec>=0.1.6",
    "pgvector>=0.4.0",
    "langchain-openai>=1.1.14",  # CVE-2026-26013, CVE-2026-41488 fixes
    "langchain-text-splitters>=1.1.2",  # CVE-2026-41481 fix
]
embeddings-azure = [
    "numpy>=2.4.1",
    "sqlite-vec>=0.1.6",
    "pgvector>=0.4.0",
    "langchain-openai>=1.1.14",  # Azure uses same package as OpenAI; CVE-2026-26013, CVE-2026-41488 fixes
    "langchain-text-splitters>=1.1.2",  # CVE-2026-41481 fix
]
embeddings-huggingface = [
    "numpy>=2.4.1",
    "sqlite-vec>=0.1.6",
    "pgvector>=0.4.0",
    "langchain-huggingface>=0.2.0",
    "langchain-text-splitters>=1.1.2",  # CVE-2026-41481 fix
]
embeddings-voyage = [
    "numpy>=2.4.1",
    "sqlite-vec>=0.1.6",
    "pgvector>=0.4.0",
    "langchain-voyageai>=0.3.0",
    "langchain-text-splitters>=1.1.2",  # CVE-2026-41481 fix
]

# Convenience: all embedding providers (for testing/development)
embeddings-all = [
    "numpy>=2.4.1",
    "sqlite-vec>=0.1.6",
    "pgvector>=0.4.0",
    "langchain-ollama>=0.3.0",
    "langchain-openai>=1.1.14",  # CVE-2026-26013, CVE-2026-41488 fixes
    "langchain-huggingface>=0.2.0",
    "langchain-voyageai>=0.3.0",
    "langchain-text-splitters>=1.1.2",  # CVE-2026-41481 fix
]

# Reranking providers
reranking = [
    "flashrank>=0.2.0",
]

# Convenience: all search quality improvements
search-quality = [
    "langchain-text-splitters>=1.1.2",  # CVE-2026-41481 fix
    "flashrank>=0.2.0",
]

# LangSmith tracing (optional observability)
langsmith = [
    "langsmith>=0.8.18",  # CVE-2026-25528, CVE-2026-45134, GHSA-f4xh-w4cj-qxq8 fixes
]

# Summary providers - install ONE based on SUMMARY_PROVIDER setting
summary-ollama = [
    "langchain-ollama>=0.3.0",
]
summary-openai = [
    "langchain-openai>=1.1.14",  # CVE-2026-26013, CVE-2026-41488 fixes
]
summary-anthropic = [
    "langchain-anthropic>=1.4.6",  # GHSA-gr75-jv2w-4656 fix
]

# Convenience: all summary providers (for testing/development)
summary-all = [
    "langchain-ollama>=0.3.0",
    "langchain-openai>=1.1.14",  # CVE-2026-26013, CVE-2026-41488 fixes
    "langchain-anthropic>=1.4.6",  # GHSA-gr75-jv2w-4656 fix
]

[dependency-groups]
dev = [
    "pre-commit",
    "pytest-asyncio>=1.0.0",
    "pytest-cov>=6.1.1",
    "pytest>=8.3.5",
    "hatchling>=1.27.0",
    "mypy>=1.18.2",
    "pyright>=1.1.406",
    "pytest-timeout>=2.4.0",
    "asyncpg-stubs>=0.31.1",
    "types-jsonschema>=4.23.0",
    # PyYAML itself arrives with fastmcp; the stubs are what let the deploy tests parse
    # the workflow files under the same strict type checking as the rest of the suite.
    "types-PyYAML>=6.0.12",
]

[tool.ruff]
# Enable preview features
preview = true
# General settings
src = ["app"]
target-version = "py312"
line-length = 127
extend-include = ["tests/**/*.py"]

[tool.ruff.lint]
# Ignore specific rules
ignore = ["B008", "PIE807"]  # B008: lambda in default_factory, PIE807: Prefer list over lambda
# Per-file ignores:
# - app/server.py: DOC201, DOC501 required - FastMCP tools use inline JSON structures instead of formal docstring sections.
#   app/server.py: E402 required - config_logger() MUST be called BEFORE importing app.backends (which triggers
#   backend module loading). This ensures logging is configured before any backend code runs.
# - tests/conftest.py: E402 required - Windows event loop policy and LangSmith env vars MUST be set
#   BEFORE importing app.server (which triggers httpx import). See conftest.py comments for details.
# - app/instructions.py: E501, W293 required - DEFAULT_INSTRUCTIONS is a triple-quoted Markdown string
#   where long lines and indented blank lines are intentional content formatting.
# - app/summary/instructions.py: E501, W293 required - DEFAULT_SUMMARY_PROMPT uses concatenated strings
#   where long lines are intentional prompt formatting.
# - tests/run_server.py: E402 required - sys.path setup MUST precede project imports
#   (from tests.helpers) since run_server.py is executed as a subprocess.
extend-per-file-ignores = { "app/server.py" = ["DOC201", "DOC501", "E402"], "tests/conftest.py" = ["E402"], "tests/run_server.py" = ["E402"], "app/instructions.py" = ["E501", "W293"], "app/summary/instructions.py" = ["E501", "W293"] }
# Enable rule groups
select = [
    "FAST",  # FastAPI
    "YTT",  # flake8-2020
    "ANN",  # flake8-annotations
    "ASYNC",  # flake8-async
    "B",  # flake8-bugbear
    "COM",  # flake8-commas
    "C4",  # flake8-comprehensions
    "DTZ",  # flake8-datetimez
    "T10",  # flake8-debugger
    "EXE",  # flake8-executable
    "FIX",  # flake8-fix-me
    "FA",  # flake8-future-annotations
    "INT",  # flake8-gettext
    "ISC",  # flake8-implicit-str-concat
    "ICN",  # flake8-import-conventions
    "LOG",  # flake8-logging
    "PIE",  # flake8-pie
    "PYI",  # flake8-pyi
    "PT",  # flake8-pytest-style
    "Q",  # flake8-quotes
    "RSE",  # flake8-raise
    "RET",  # flake8-return
    "SIM",  # flake8-simplify
    "SLOT",  # flake8-slots
    "TID",  # flake8-tidy-imports
    # "TC",  # flake8-type-checking
    "ARG",  # flake8-unused-arguments
    "FLY",  # flynt
    "I",  # isort
    "NPY",  # NumPy-specific rules
    "PD",  # pandas-vet
    "N",  # pep8-naming
    "PERF",  # Perflint
    "E", "W",  # pycodestyle
    "DOC",  # pydoclint
    "F",  # Pyflakes
    "PGH",  # pygrep-hooks
    "UP",  # pyupgrade
    "FURB",  # refurb
]

[tool.ruff.lint.flake8-annotations]
allow-star-arg-any = true
ignore-fully-untyped = true

[tool.ruff.lint.flake8-quotes]
docstring-quotes = "double"
inline-quotes = "single"
multiline-quotes = "single"

[tool.ruff.lint.flake8-type-checking]
quote-annotations = true
strict = false

[tool.ruff.lint.isort]
known-first-party = ["app"]
force-single-line = true

[tool.ruff.lint.pydoclint]
ignore-one-line-docstrings = true

[tool.mypy]
# Core safety, balanced for production
python_version = '3.12'
files = ['app', 'tests']
disallow_untyped_defs = true
disallow_incomplete_defs = true
disallow_untyped_calls = true
check_untyped_defs = true
disallow_any_generics = true
disallow_any_explicit = false
disallow_any_unimported = true

# None and Optional handling
no_implicit_optional = true

# Warnings that catch real bugs
warn_return_any = true
warn_redundant_casts = true
warn_unreachable = true
warn_unused_ignores = true
warn_unused_configs = true

# Cleaner public APIs and safer comparisons
implicit_reexport = false
strict_equality = true

# Error message quality
show_error_codes = true
pretty = true

# Encourage precise ignores and common correctness checks
enable_error_code = [
  'ignore-without-code',
  'unused-awaitable',
  'possibly-undefined',
  'truthy-bool',
  'truthy-iterable',
  'redundant-expr',
  'explicit-override'
]

# Pydantic v2 plugin for better type inference on models and validators
plugins = ['pydantic.mypy']

# Skip common noise and respect .gitignore
exclude_gitignore = true
exclude = '''(?x)(
  ^\.venv/
| ^\.tox/
| ^\.mypy_cache/
| ^\.pytest_cache/
| ^build/
| ^dist/
| ^node_modules/
| ^site-packages/
)'''

# Looser rules for tests
[[tool.mypy.overrides]]
module = ['tests.*', 'test.*']
disallow_untyped_defs = false
disallow_untyped_calls = false
check_untyped_defs = false
warn_return_any = false
disallow_any_explicit = false

# Handle optional dependencies for semantic search, chunking, reranking, and tracing
[[tool.mypy.overrides]]
module = [
  'sqlite_vec',
  'pgvector.asyncpg',
  'ollama',
  'numpy',
  'langchain_openai',
  'langchain_huggingface',
  'langchain_voyageai',
  'langchain_ollama',
  'langchain_anthropic',
  'langchain_anthropic.*',
  'langchain_core',
  'langchain_core.*',
  'langchain_text_splitters',
  'langchain_text_splitters.*',
  'flashrank',
  'flashrank.*',
  'langsmith',
  'langsmith.*',
  'onnxruntime',
  'onnxruntime.*',
  'threadpoolctl',
  'regex',
]
ignore_missing_imports = true
follow_imports = 'skip'

[tool.pyright]
include = ["app", "tests"]
exclude = [".venv", "**/__pycache__"]
# Strict mode globally with per-directory suppressions via executionEnvironments
typeCheckingMode = "strict"

# Let Ruff handle these (use false, not "none" - pyright 1.1.407 requires boolean)
reportUnusedImport = false
reportUnusedVariable = false
reportUnnecessaryTypeIgnoreComment = false

# Suppress optional dependency errors in app/backends (pgvector.asyncpg, sqlite_vec)
[[tool.pyright.executionEnvironments]]
root = "app/backends"
reportMissingImports = false
reportMissingModuleSource = false
reportMissingTypeStubs = false

# Suppress optional dependency errors in app/embeddings/providers (langchain_*)
[[tool.pyright.executionEnvironments]]
root = "app/embeddings/providers"
reportMissingImports = false
reportUnknownVariableType = false
reportAttributeAccessIssue = false

[[tool.pyright.executionEnvironments]]
root = "app/reranking/providers"
reportMissingImports = false
reportUnknownVariableType = false
reportAttributeAccessIssue = false
reportMissingTypeStubs = false

# Suppress optional dependency errors in app/summary/providers (langchain_*)
[[tool.pyright.executionEnvironments]]
root = "app/summary/providers"
reportMissingImports = false
reportUnknownVariableType = false
reportAttributeAccessIssue = false
reportMissingTypeStubs = false

# Suppress optional dependency errors in app/repositories (sqlite_vec, numpy)
[[tool.pyright.executionEnvironments]]
root = "app/repositories"
reportMissingImports = false
reportMissingTypeStubs = false

# Catch-all for remaining app files (e.g., server.py) - MUST come after more specific environments
[[tool.pyright.executionEnvironments]]
root = "app"
reportMissingImports = false
reportMissingTypeStubs = false
reportUnknownVariableType = false
reportUnknownMemberType = false

# Relaxed checking for tests (simulate basic mode + suppress optional deps)
[[tool.pyright.executionEnvironments]]
root = "tests"
reportMissingImports = false
reportMissingModuleSource = false
reportMissingTypeStubs = false
reportUnknownVariableType = false
reportUnknownMemberType = false
reportUnknownArgumentType = false
reportUnknownParameterType = false
reportUnknownLambdaType = false
reportPrivateUsage = false
reportOptionalMemberAccess = false
reportOptionalSubscript = false
reportOptionalCall = false
reportOptionalIterable = false
reportOptionalContextManager = false
reportOptionalOperand = false
reportMissingParameterType = false
reportUnnecessaryComparison = false
reportArgumentType = false
reportAttributeAccessIssue = false

[tool.pytest.ini_options]
asyncio_mode = "strict"
asyncio_default_fixture_loop_scope = "function"
testpaths = ["tests"]
# Default per-test timeout (pytest-timeout). A generous ceiling that no legitimate
# unit or integration test approaches; it converts an accidental un-mocked network
# call (e.g. to a real Ollama host) from an indefinite hang into a fast, stack-traced
# failure. timeout_method="thread" is required on Windows (the signal method is POSIX-only).
timeout = 600
timeout_method = "thread"
markers = [
    "integration: marks tests as integration tests (deselect with '-m \"not integration\"')",
    "slow: marks tests as slow tests (deselect with '-m \"not slow\"')",
    "performance: marks tests as performance tests",
    "requires_chunking: marks tests requiring langchain-text-splitters",
    "requires_flashrank: marks tests requiring flashrank",
    "requires_docker_postgres: marks tests requiring a docker-compose PostgreSQL container (skipped when docker is unavailable)",
]

[tool.coverage.run]
relative_files = true
source = ["app"]
omit = ["*/tests/*", "*/__pycache__/*"]

[tool.coverage.report]
exclude_also = [
    "def __repr__",
    "if self\\.debug",
    "raise AssertionError",
    "raise NotImplementedError",
    "if 0:",
    "if __name__ == .__main__.:",
    "@(abc\\.)?abstractmethod",
]
ignore_errors = true

[tool.coverage.html]
directory = "htmlcov"