pyproject.toml

# ── Build system ──────────────────────────────────────────────────────────────
[build-system]
requires      = ["setuptools>=68", "wheel"]
build-backend = "setuptools.build_meta"

# ── Project metadata ──────────────────────────────────────────────────────────
[project]
name            = "bawbel-scanner"
version         = "1.3.0"
description     = "Security linter and scanner for MCP servers and AI skill files. Detects toxic flows, prompt injection, tool poisoning, and supply chain attacks."
readme          = "README.md"
license         = { text = "Apache-2.0" }
requires-python = ">=3.10"
authors         = [
    { name = "Bawbel", email = "bawbel.io@gmail.com" }
]
keywords = [
    "ai-skill-linter",
    "skill-linter",
    "mcp-scanner",
    "mcp-server-scanner",
    "ai-skill-scanner",
    "skill-scanner",
    "model-context-protocol",
    "agentic-ai",
    "ai-security",
    "llm-security",
    "prompt-injection",
    "toxic-flow",
    "toxic-flow-detection",
    "tool-poisoning",
    "supply-chain-security",
    "vulnerability-scanner",
    "security-scanner",
    "devsecops",
    "sast",
    "static-analysis",
    "pre-commit",
    "github-actions",
    "ai-agent",
    "ave",
    "aivss",
    "owasp",
    "sarif",
    "mcp",
    "llm",
    "claude",
    "openai",
]
classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Developers",
    "Intended Audience :: Information Technology",
    "Intended Audience :: System Administrators",
    "License :: OSI Approved :: Apache Software License",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Topic :: Security",
    "Topic :: Software Development :: Libraries :: Python Modules",
    "Topic :: Software Development :: Quality Assurance",
    "Environment :: Console",
]

# Core dependencies - installed on every pip install bawbel-scanner
dependencies = [
    "click>=8.1.0",
    "rich>=13.7.0",
    "pydantic>=2.5.0",
]

# ── Optional dependencies ─────────────────────────────────────────────────────
[project.optional-dependencies]

# Detection engines (optional - scanner works without them)
yara    = ["yara-python>=4.5.0"]
semgrep = ["semgrep>=1.60.0"]
llm     = ["litellm>=1.30.0", "jsonschema~=4.25.1"]
magika  = ["magika>=0.5.0"]
watch   = ["watchdog>=4.0.0"]
all     = [
    "yara-python>=4.5.0",
    "semgrep>=1.60.0",
    "litellm>=1.30.0",
    "magika>=0.5.0",
    "watchdog>=4.0.0",
    "jsonschema~=4.25.1",
]

# Development tooling
dev = [
    "pytest>=8.0.0",
    "pytest-cov>=5.0.0",
    "pytest-mock>=3.12.0",
    "black>=24.4.0",
    "flake8>=7.0.0",
    "flake8-bugbear>=24.0.0",
    "bandit>=1.7.8",
    "pre-commit>=3.7.0",
    "pip-audit>=2.7.0",
    "build>=1.0.0",
    "twine>=5.0.0",
]

# ── URLs ──────────────────────────────────────────────────────────────────────
[project.urls]
Homepage      = "https://bawbel.io"
Documentation = "https://bawbel.io/docs"
Repository    = "https://github.com/bawbel/scanner"
"Bug Tracker" = "https://github.com/bawbel/scanner/issues"
Changelog     = "https://github.com/bawbel/scanner/releases"
"AVE Standard" = "https://github.com/bawbel/ave"

# ── CLI entry point ───────────────────────────────────────────────────────────
# Points to scanner/cli.py:main() - inside the package, always importable
[project.scripts]
bawbel = "scanner.cli:main"

# ── Package discovery ─────────────────────────────────────────────────────────
# Include scanner/ only - config lives at scanner/config/ and is covered by scanner*
[tool.setuptools.packages.find]
where   = ["."]
include = ["scanner*"]
exclude = ["tests*", "scripts*", "docs*"]

# Include non-Python files (YARA and Semgrep rules) in the distribution
[tool.setuptools.package-data]
"scanner" = [
    "rules/yara/*.yar",
    "rules/semgrep/*.yaml",
    "rules/semgrep/*.yml",
]

# ── Tool: black ───────────────────────────────────────────────────────────────
[tool.black]
line-length     = 100
target-version  = ["py310", "py311", "py312"]
exclude         = '''/(\.git|\.venv|build|dist)/'''

# ── Tool: pytest ──────────────────────────────────────────────────────────────
[tool.pytest.ini_options]
testpaths   = ["tests"]
python_files  = ["test_*.py", "*_test.py"]
python_classes = ["Test*"]
python_functions = ["test_*"]
addopts     = "-v --tb=short --strict-markers"
markers = [
    "unit: unit tests (fast, no external deps)",
    "integration: integration tests (may require semgrep/yara)",
    "slow: slow tests (sandbox, LLM)",
]

# ── Tool: coverage ────────────────────────────────────────────────────────────
[tool.coverage.run]
source = ["scanner"]
omit   = [
    "tests/*",
    ".venv/*",
    "scanner/cli.py",                    # legacy entry point shim
    "scanner/__main__.py",               # entry point — not unit-testable
    "scanner/cli/__main__.py",           # entry point — not unit-testable
    "scanner/bawbel_pre_commit.py",      # pre-commit hook infrastructure
    "scanner/pre_commit_init.py",        # pre-commit initialisation
    "scanner/engines/sandbox_engine.py", # Stage 3: requires Docker
    "scanner/engines/sandbox/*",         # Stage 3: requires Docker
    "scanner/engines/meta_analyzer.py",  # requires LLM API key
    "scanner/fetcher.py",                # network I/O — integration tested
    "scanner/pinner.py",                 # file-pinning — integration tested
    "scanner/cli/cmd_init.py",           # writes to disk — integration tested
    "scanner/cli/cmd_pin.py",            # file-pinning CLI — integration tested
    "scanner/cli/cmd_ssc.py",            # server-card fetch — requires network
]

[tool.coverage.report]
fail_under    = 80
show_missing  = true
exclude_lines = [
    "pragma: no cover",
    "if __name__ == .__main__.:",
    "except ImportError:",
    "except Exception:",
]

# ── Tool: bandit ──────────────────────────────────────────────────────────────
[tool.bandit]
exclude_dirs = [".venv", "tests", "build", "dist"]
skips = [
    "B101",  # assert in tests
    "B404",  # subprocess - intentional for semgrep integration
    "B603",  # subprocess list args - correct, never shell=True
]
severity = "medium"

# ── Tool: flake8 ──────────────────────────────────────────────────────────────
[tool.flake8]
max-line-length = 100
extend-ignore   = ["E203", "W503", "E501"]
exclude         = [".venv", "build", "dist", "__pycache__"]
per-file-ignores = ["tests/*:S101"]