refactor: Replace Bandit with Ruff security checks and cleanup

- Remove Bandit dependency in favor of Ruff's flake8-bandit rules (S prefix)
- Update CI/CD workflow to use Ruff for security scanning
- Remove Bandit from pre-commit hooks
- Update documentation to reflect security scanning with Ruff
- Clean up nosec comments since Ruff uses per-file ignores
- Remove IMPROVEMENTS.md (historical review document no longer needed)
- Simplify toolchain by consolidating security checks into Ruff
- Fix pre-commit hook issues (trailing whitespace, EOF, mypy types)
- Configure mypy to be less strict for test files

Ruff now includes comprehensive security rules from flake8-bandit,
making a separate Bandit installation redundant. This reduces
dependencies and improves performance while maintaining the same
security coverage.

Author: ashwch

.github/workflows/ci.yml

@@ -13,38 +13,38 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
         python-version: ["3.10", "3.11", "3.12", "3.13"]
-    
+
     steps:
     - uses: actions/checkout@v4
-    
+
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
-    
+
     - name: Install uv
       uses: astral-sh/setup-uv@v3
       with:
         enable-cache: true
         cache-dependency-glob: "uv.lock"
-    
+
     - name: Install dependencies
       run: |
         uv sync --all-extras --dev
-    
+
     - name: Run linting
       run: |
         uv run ruff check .
         uv run ruff format --check .
-    
+
     - name: Run type checking
       run: |
         uv run mypy src/
-    
+
     - name: Run tests with coverage
       run: |
         uv run pytest -v --cov=src/gemini_mcp --cov-report=xml --cov-report=term
-    
+
     - name: Upload coverage to Codecov
       if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.11'
       uses: codecov/codecov-action@v4
@@ -59,54 +59,58 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
-    
+
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
         python-version: "3.11"
-    
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@v3
+
     - name: Install dependencies
       run: |
-        pip install bandit[toml] safety
-    
+        uv sync --all-extras --dev
+        pip install safety
+
     - name: Run security checks
       run: |
-        bandit -r src/ -f json -o bandit-report.json
+        uv run ruff check --select S --output-format=json > ruff-security-report.json || true
         safety check --json --output safety-report.json || true
-    
+
     - name: Upload security reports
       uses: actions/upload-artifact@v4
       with:
         name: security-reports
         path: |
-          bandit-report.json
+          ruff-security-report.json
           safety-report.json
 
   build:
     runs-on: ubuntu-latest
     needs: [test, security]
     steps:
     - uses: actions/checkout@v4
-    
+
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
         python-version: "3.11"
-    
+
     - name: Install build tools
       run: |
         pip install build twine
-    
+
     - name: Build package
       run: |
         python -m build
-    
+
     - name: Check package
       run: |
         twine check dist/*
-    
+
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:
         name: dist
-        path: dist/
+        path: dist/

.github/workflows/release.yml

@@ -13,20 +13,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
-    
+
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
         python-version: "3.11"
-    
+
     - name: Install build tools
       run: |
         pip install build
-    
+
     - name: Build package
       run: |
         python -m build
-    
+
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:
@@ -45,8 +45,8 @@ jobs:
       with:
         name: dist
         path: dist/
-    
+
     - name: Publish to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        skip-existing: true
+        skip-existing: true

.gitignore

@@ -44,4 +44,4 @@ coverage.xml
 dmypy.json
 
 # Ruff
-.ruff_cache/
+.ruff_cache/

.pre-commit-config.yaml

@@ -24,10 +24,3 @@ repos:
       - id: mypy
         additional_dependencies: [types-aiofiles, pydantic]
         args: [--ignore-missing-imports]
-
-  - repo: https://github.com/pycqa/bandit
-    rev: 1.7.6
-    hooks:
-      - id: bandit
-        args: ["-c", "pyproject.toml"]
-        additional_dependencies: ["bandit[toml]"]

CONTRIBUTING.md

@@ -49,16 +49,16 @@ By participating in this project, you agree to be respectful and constructive in
    ```bash
    # Run all tests
    uv run pytest
-   
+
    # Check code style
    uv run ruff check .
    uv run ruff format .
-   
+
    # Type checking
    uv run mypy src/
-   
+
    # Security checks
-   uv run bandit -r src/
+   uv run ruff check --select S .
    ```
 
 6. **Commit Your Changes**
@@ -124,4 +124,4 @@ Releases are managed by maintainers and follow semantic versioning:
 
 ## Questions?
 
-Feel free to open an issue for any questions about contributing!
+Feel free to open an issue for any questions about contributing!

IMPROVEMENTS.md

@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+SOFTWARE.

LICENSE

@@ -71,4 +71,4 @@ uv run mypy src/
 ## Publishing
 
 The project is configured for automated PyPI releases via GitHub Actions.
-Create a new release on GitHub to trigger the publication workflow.
+Create a new release on GitHub to trigger the publication workflow.

PROJECT_INFO.md

@@ -239,7 +239,7 @@ uv run ruff format .
 uv run mypy src/
 
 # Run security checks
-uv run bandit -r src/
+uv run ruff check --select S .
 ```
 
 ## Troubleshooting
@@ -301,4 +301,4 @@ This project is licensed under the MIT License - see the [LICENSE](LICENSE) file
 
 - Built on top of the [Model Context Protocol](https://github.com/anthropics/mcp)
 - Integrates with Google's Gemini CLI (unofficial integration)
-- Inspired by the MCP ecosystem and community
+- Inspired by the MCP ecosystem and community

README.md

@@ -6,4 +6,4 @@
       "description": "Gemini CLI integration for research and analysis"
     }
   }
-}
+}