[build-system]
requires = ["setuptools>=68.0", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "agent-bom"
version = "0.75.1"
description = "Security scanner for AI infrastructure and supply chain. AI agent discovery (25 MCP clients), AST source code analysis, AI BOM generation (CycloneDX 1.6 ML extensions), CVE scanning (OSV/NVD/EPSS/KEV), blast radius mapping (CVE → package → MCP server → agent → credentials → tools), runtime proxy (112 detection patterns, PII redaction), Shield SDK, secret scanning, red team simulator, 33 MCP tools, CIS benchmarks, 14-framework compliance, 19 output formats, 20-page Next.js dashboard."
readme = "README.md"
license = {text = "Apache-2.0"}
requires-python = ">=3.11"
authors = [
    {name = "Wagdy Saad", email = "andwgdysaad@gmail.com"}
]
keywords = ["ai-bom", "sbom", "mcp", "mcp-server", "security", "ai-agents", "vulnerability", "supply-chain", "owasp", "mitre-atlas", "nist-ai-rmf", "grype", "syft", "blast-radius", "cve", "llm-security", "remediation", "mcp-introspection", "openclaw", "ai-enrichment", "credential-exposure", "config-security", "ai-supply-chain", "ai-infrastructure", "gpu-security", "cuda", "pytorch", "openssf-scorecard", "malicious-package-detection", "runtime-monitoring", "model-provenance"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Intended Audience :: Developers",
    "Intended Audience :: Information Technology",
    "Intended Audience :: System Administrators",
    "License :: OSI Approved :: Apache Software License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3 :: Only",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Environment :: Console",
    "Topic :: Security",
    "Topic :: System :: Monitoring",
]
dependencies = [
    "click>=8.0",
    "rich>=13.0",
    "httpx>=0.28.1",  # Requires urllib3>=2.6.3 (CVE-2025-66418, CVE-2025-66471, CVE-2026-21441)
    "pydantic>=2.0",
    "cyclonedx-python-lib>=11.6",  # Updated for better CycloneDX 1.6 support
    "packageurl-python>=0.17",
    "packaging>=24.0",
    "toml>=0.10",
    "pyyaml>=6.0",
    "jsonschema>=4.0",
    # Transitive dep pins — fix known CVEs flagged by OpenSSF/OSV
    "jinja2>=3.1.6",  # GHSA-cpwx-vrp4-4pq7, GHSA-gmj6-6f8f-6699 (sandbox breakout)
    "werkzeug>=3.1.6",  # GHSA-29vq-49wr-vm6x, GHSA-2g68-c3qc-8985, GHSA-87hc-h4r5-73f7, GHSA-f9vj-2wh5-fj8j, GHSA-hgf8-39gv-g3f2, GHSA-hrfv-mqp8-q5rw, GHSA-px8h-6qxv-m22q, GHSA-q34m-jh98-gwm2, GHSA-xg9f-g7g7-2323
    "flask>=3.1.3",  # GHSA-68rp-wp8r-4726, GHSA-m2qf-hxjv-5gpq (Vary: Cookie session exposure; transitive via mlflow)
    "requests>=2.32.4",  # GHSA-9hjg-9r4m-mvj7, GHSA-j8r2-6x86-q33q (session cookie leak)
    # NOTE: nltk pin removed — safety (which pulled nltk) was replaced by pip-audit.
    # nltk is not imported by agent-bom. Keeping it added 3 CVEs to Docker images.
    "pyjwt>=2.12.0",  # CVE-2026-32597 (crit header bypass) — transitive via auth
    "tornado>=6.5.5",  # CVE-2026-31958 (multipart DoS), GHSA-78cv-mqj4-43f7 (cookie injection) — transitive via streamlit
    # NOTE: pyopenssl (transitive via snowflake[cloud] extra) — GHSA-68rp-wp8r-4726, GHSA-5pwr-322w-8jr4,
    # GHSA-vp96-hxj8-p424 — all fixed in pyopenssl>=26.0.0, but snowflake-connector-python requires pyopenssl<26.0.0.
    # Cannot upgrade until upstream drops that cap. Not exploitable: agent-bom does not use affected pyopenssl paths.
    # Tracked: https://github.com/msaad00/agent-bom/issues/930
]

[project.optional-dependencies]
api = [
    "fastapi>=0.115",
    "uvicorn[standard]>=0.32",
    "sse-starlette>=2.1",
]
otel = [
    "opentelemetry-api>=1.20",
    "opentelemetry-sdk>=1.20",
    "opentelemetry-exporter-otlp-proto-http>=1.20",
    "protobuf>=6.33.5",  # CVE-2022-1941, CVE-2026-0994 (ParseDict DoS) — transitive via otlp-proto-http
]
ui = [
    "agent-bom[api]",
]
aws = ["boto3>=1.34"]
azure = [
    "azure-identity>=1.15",
    "azure-mgmt-cognitiveservices>=13.5",
    "azure-mgmt-web>=7.2",
    "azure-mgmt-containerinstance>=10.1",
    "azure-mgmt-machinelearningservices>=1.0",
    "azure-mgmt-containerservice>=30.0",
    "azure-mgmt-resource>=23.0",
]
gcp = [
    "google-cloud-aiplatform>=1.38",
    "google-cloud-functions>=1.16",
    "google-cloud-container>=2.36",
    "google-cloud-run>=0.10",
    "google-cloud-resource-manager>=1.12",
]
coreweave = []  # kubectl only — no pip packages
databricks = ["databricks-sdk>=0.20"]
snowflake = ["snowflake-connector-python>=3.6"]
nebius = ["requests>=2.32.4"]  # GHSA-9hjg-9r4m-mvj7 (session cookie leak)
huggingface = ["huggingface-hub>=0.20"]
wandb = ["wandb>=0.16"]
mlflow = ["mlflow>=2.10"]
openai = ["openai>=1.12"]
ai-enrich = ["litellm>=1.30"]
graph = ["networkx>=3.0"]
postgres = ["psycopg[binary]>=3.1", "psycopg-pool>=3.1"]
watch = ["watchdog>=4.0"]
runtime = ["psutil>=5.9"]  # Process + container discovery (--include-processes)
mcp-server = [
    "mcp>=1.26",
    "smithery>=0.4",
]
dashboard = ["streamlit>=1.37.0", "plotly>=5.18", "pillow>=12.1.1"]  # GHSA-rxff-vr5r-8cj5 (fixed in 1.37.0); pillow>=12.1.1 fixes CVE-2023-50447, CVE-2024-28219, CVE-2026-25990 (PSD OOB write)
snyk = []  # Uses existing httpx dependency, no additional packages needed
oidc = [
    "PyJWT>=2.8",
    "cryptography>=41.0",
]
cloud = [
    "agent-bom[aws]",
    "agent-bom[azure]",
    "agent-bom[gcp]",
    "agent-bom[databricks]",
    "agent-bom[snowflake]",
    "agent-bom[nebius]",
    "agent-bom[huggingface]",
    "agent-bom[wandb]",
    "agent-bom[mlflow]",
    "agent-bom[openai]",
]
docs = [
    "mkdocs-material>=9.5",
    "mkdocstrings[python]>=0.24",
]
dev = [
    "pytest>=7.0",
    "pytest-asyncio>=0.21",
    "ruff>=0.4",
    "mypy>=1.0",
    "types-PyYAML>=6.0",
    "types-requests>=2.31",
    "types-toml>=0.10",
    "pip-audit>=2.10",  # Security dependency scanning (replaces safety — not executed in CI)
    "bandit>=1.9",      # Static security analysis
    "pytest-cov>=4.1",  # Coverage reporting
]
dev-all = [
    "agent-bom[dev]",
    "agent-bom[ui]",
    "agent-bom[mcp-server]",
]

[project.scripts]
agent-bom = "agent_bom.cli:cli_main"
agent-shield = "agent_bom.cli.shield:shield_main"
agent-cloud = "agent_bom.cli.cloud:cloud_main"
agent-iac = "agent_bom.cli.iac:iac_main"
agent-claw = "agent_bom.cli.claw:claw_main"

[project.urls]
Homepage = "https://github.com/msaad00/agent-bom"
Repository = "https://github.com/msaad00/agent-bom"
Issues = "https://github.com/msaad00/agent-bom/issues"
Changelog = "https://github.com/msaad00/agent-bom/releases"
Documentation = "https://github.com/msaad00/agent-bom#readme"
"Security Policy" = "https://github.com/msaad00/agent-bom/blob/main/SECURITY.md"
"Trust & Permissions" = "https://github.com/msaad00/agent-bom/blob/main/PERMISSIONS.md"

[tool.uv]
# Only install core deps by default — extras (cloud, dev) must be explicit.
# Prevents `uv sync` from pulling heavy optional deps (azure, gcp, etc.)
# which break on Python 3.14 and bloat CI/container builds.
default-groups = []

[tool.setuptools.packages.find]
where = ["src"]

[tool.setuptools.package-data]
agent_bom = ["mcp_registry.json", "ui_dist/**"]

[tool.smithery]
server = "agent_bom.mcp_server:create_smithery_server"

[tool.pytest.ini_options]
asyncio_mode = "strict"
pythonpath = ["src"]
markers = [
    "network: tests that require network access (OSV API)",
]

[tool.mypy]
python_version = "3.11"
warn_unused_configs = true
disallow_untyped_defs = false          # Phase 2: enable after all functions annotated
check_untyped_defs = false             # Phase 2: enable after baseline is clean
ignore_missing_imports = true          # Third-party stubs (yaml, toml, requests)
no_implicit_optional = true
warn_redundant_casts = true
show_error_codes = true

[tool.ruff]
line-length = 140  # Relaxed from 120 for CLI help strings
target-version = "py311"

[tool.ruff.lint]
select = ["E", "F", "I", "N", "W"]
ignore = []

[tool.ruff.lint.per-file-ignores]
"__init__.py" = ["F401"]  # Allow unused imports in __init__.py
"fuzz/*.py" = ["N802"]  # TestOneInput is the required atheris entry-point name
"src/agent_bom/output/html.py" = ["E501"]  # Inline HTML/CSS/JS template strings cannot be meaningfully wrapped
"src/agent_bom/cloud/*_cis_benchmark.py" = ["E501"]  # CIS benchmark remediation strings are naturally long
