refactor!: MCP-only toolset with account discovery, search/execute, and hardened security - #199

Open

willleeney wants to merge 49 commits into

mainfrom

chore/remove-nix-toolchain

Commits on Sep 14, 2026

test(mocks): run MCP mock server with tsx instead of bun

willleeney
and
claude
committed
ab14240
build: replace justfile with Makefile

willleeney
and
claude
committed
769df34
chore: remove nix toolchain in favour of uv and ruff

willleeney
and
claude
committed
3bf1a27
docs(agents): add AGENTS.md symlink as shared instruction source

willleeney
and
claude
committed
e6b6230
docs(agents): consolidate rules into CLAUDE.md

willleeney
and
claude
committed
b4a52bc
chore: remove scripts/ directory

willleeney
and
claude
committed
41de837
chore: remove .envrc left over from nix removal

willleeney
and
claude
committed
c9db3e5
fix: raise minimum Python to 3.11, fix CI, harden action headers

willleeney
and
claude
committed
e936fe9
refactor!: restructure package to types/tools/toolset, pass schemas through

willleeney
and
claude
committed
2eca620
test: add validate.sh covering examples, conformance and consumer smoke tests

willleeney
and
claude
committed
7a59485
ci: enforce the conformance wire contract on every push

willleeney
and
claude
committed
f96287e

Commits on Sep 15, 2026

docs: recommend uv over pip, and fail examples that load zero tools

willleeney
and
claude
committed
f7441fb
build: add a self-documenting make help target

willleeney
and
claude
committed
7fb8813
build: collapse make into one fix target, run tools directly in CI

willleeney
and
claude
committed
e33deda
build: remove the publish target

willleeney
and
claude
committed
1b8babf
build: drop the gitleaks target, leaving secret scanning to CI

willleeney
and
claude
committed
0ea083a
build: default EXTRAS to --all-extras so `make install` stops stripping the venv

willleeney
and
claude
committed
1ec2e0b
refactor!: put mcp in core and langchain behind an extra

willleeney
and
claude
committed
c35be4a
refactor!: collapse dependency-groups into extras

willleeney
and
claude
committed
fd11498
build: split install into `install` and `extras`

willleeney
and
claude
committed
f2acc61
build: make extras a flag on install rather than its own target

willleeney
and
claude
committed
879438c
build: drop the coverage target

willleeney
and
claude
committed
a0ad354
test: load .env in validate.sh, or say it is missing

willleeney
and
claude
committed
fab2113
test: keep validate off the live API entirely

willleeney
and
claude
committed
87244ea

Commits on Sep 16, 2026

test: drop examples/test_examples.py

willleeney
and
claude
committed
e980833
fix: surface MCP failures, discover accounts, and support search_execute

willleeney
and
claude
committed
3820f32
feat(toolset): discover accounts and expose search/execute

willleeney
and
claude
committed
b08bfa8
fix(toolset): one argument contract for execute(), tolerate failing connectors

willleeney
and
claude
committed
11adb81
docs(readme): fix the file-download example's argument key

willleeney
and
claude
committed
958d9b4
docs(readme): follow the trimmed structure

willleeney
and
claude
committed
69f8e71

Commits on Sep 17, 2026

fix: close argument-hijack, header-injection and cache-poisoning defects

willleeney
and
claude
committed
c04c813
docs: rewrite the README and examples around what actually runs

willleeney
and
claude
committed
a5e69d7
fix(ci): make the examples gate actually gate, and unblock pydantic-ai 2.x

willleeney
and
claude
committed
5356d83
test: make the mocks refuse what the real API refuses

willleeney
and
claude
committed
a6c8531
fix: schema-driven header allowlist, faithful LangChain schemas, actionable errors

willleeney
and
claude
committed
bf90c1e
fix(tools): warn when two accounts serve the same tool name

willleeney
and
claude
committed
78f6a3c
fix(toolset): stop clear_catalog_cache() being undone, and isolate cached state

willleeney
and
claude
committed
209b6ab
fix: gate PyPI publish on tests, unify execute() return shape, correct the docs

willleeney
and
claude
committed
164aaad
fix: honour timeout on the MCP path, one root error, and pin every fix from this sweep

willleeney
and
claude
committed
d113af1
fix: contain encoding failures; trim the sdist; dependabot that can actually pass CI

willleeney
and
claude
committed
a8da64e
docs(readme): trim to the Quick Start, integrations and filtering structure

willleeney
and
claude
committed
37fd56b
feat(tools): execute_openai_tool_calls, so the OpenAI loop is not hand-written

willleeney
and
claude
committed
ab998b5

Commits on Sep 18, 2026