1.0.0 readiness: version-resolution, parser, security, and release fixes (#28)

* chore(release): bump workspace to 1.0.0 and add package metadata

Set the workspace version to 1.0.0 and add distribution metadata: license
(MIT), rust-version (1.85, matching edition 2024), repository, description,
readme, keywords, categories, and publish = false (the project ships as a
binary via release artifacts and `cargo install --path .`, not to crates.io).
Add the semver dependency to the core crate for version-requirement resolution.

* fix(checks): resolve ranged/partial versions and normalize policy names

check_package forwarded the raw requested version to an exact-match lookup, so
a range or partial requirement (`react` "18", "^4.17.0", `serde` "1",
`requests` ">=2") was denied as a nonexistent "hallucinated" version — a false
block on the primary agent workflow, on all three registries. Resolve the
requirement per ecosystem to the best matching published version (semver for
npm/cargo, PEP 440 specifiers for PyPI); only a concrete exact version that is
genuinely absent is still flagged.

Also compare canonical names in denylist/allowlist/dependency-confusion matching
so an equivalent spelling (case, and `-`/`_`/`.` per PyPI/crates.io rules) cannot
bypass a rule (e.g. denylisting `evil-pkg` now also blocks `evil_pkg`).

* fix(parsers): skip non-registry deps and split PyPI specifiers correctly

npm and PyPI manifests emitted local/git/URL dependencies as if they were
registry packages, producing false "does not exist" findings for a project's
own path/git/private deps (cargo already filtered these). Skip `file:`, git,
tarball-URL, and `workspace:`/`link:` (npm) and `path`/`git`/`url` (Poetry) and
PEP 508 `name @ url` dependencies; resolve npm aliases (`npm:real-pkg@1.2.3`) to
the real target.

PyPI requirement lines were split by operator list-order, so multi-specifier
lines like `torch>1.9,<2.0` and `numpy!=1.24.0,>=1.20` were mis-split and
silently dropped. Split on the leftmost operator instead.

* fix(mcp): advertise safe-pkgs server identity to MCP hosts

get_info did not set server_info, so rmcp reported its own crate name and
version (`rmcp`/<rmcp version>) to every MCP host. Advertise the crate's own
name and version instead.

* fix(registry): only send bearer token over secure transport

The npm and PyPI clients attached a private-registry bearer token
unconditionally, while the base URL is env-overridable to http://, so a token
could be sent in cleartext to a remote mirror. Gate the token on HTTPS (or an
http loopback host for local testing), mirroring the audit and remote-config
guards. The token is still sent only to the metadata host, never to the
downloads or popularity hosts.

* docs+ci: correct README, gate the workspace in CI, add CHANGELOG

Fix the README rmcp badge (1.x) and the decision-payload metadata note (advisories
are evidence, not metadata). Run clippy and test with --workspace so every crate
is gated in CI. Add a 1.0.0 CHANGELOG and ignore stray .tmp/.cache/WORKFLOW.md.

Author: math280h

.github/workflows/ci.yml

@@ -35,13 +35,13 @@ jobs:
         run: cargo fmt --all -- --check
 
       - name: Lint with Clippy
-        run: cargo clippy --all-targets -- -D warnings
+        run: cargo clippy --workspace --all-targets -- -D warnings
 
       - name: Run tests
         shell: bash
         run: |
           set -o pipefail
-          cargo test 2>&1 | tee test-output.log
+          cargo test --workspace 2>&1 | tee test-output.log
           test_status=${PIPESTATUS[0]}
 
           # Emit inline annotations for panic locations so PR diffs highlight failures.

.gitignore

@@ -1,3 +1,6 @@
 /target
 .claude
 /site
+.cache
+.tmp
+WORKFLOW.md

CHANGELOG.md

@@ -0,0 +1,51 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2026-07-20
+
+First stable release. This release focuses on correctness of version and dependency
+handling across all three ecosystems, plus security and release hardening.
+
+### Fixed
+
+- **`check_package` now accepts ranged and partial versions.** A request such as
+  `check_package(name="react", version="18")`, `"^4.17.0"`, `serde "1"`, or
+  `requests ">=2"` was previously denied as a nonexistent ("hallucinated") version.
+  Version requirements are now resolved per ecosystem to the best matching published
+  version; only a concrete exact version that is genuinely absent is flagged.
+- **npm/PyPI manifests no longer flag local, git, and URL dependencies.** `file:`,
+  `git`/`github:`, tarball URL, `workspace:`/`link:` (npm) and `path`/`git`/`url`
+  (Poetry) and PEP 508 `name @ url` dependencies are skipped rather than looked up on
+  the public registry and reported as nonexistent. npm aliases (`npm:real-pkg@1.2.3`)
+  now audit the real target.
+- **PyPI requirement lines with multiple specifiers are no longer dropped.** Lines such
+  as `torch>1.9,<2.0` and `numpy!=1.24.0,>=1.20` are now split on the leftmost
+  operator and audited instead of being silently skipped.
+- **Denylist, allowlist, and dependency-confusion matching now compare canonical
+  names.** An equivalent spelling (case, and `-`/`_`/`.` per PyPI/crates.io rules) can
+  no longer bypass a rule (for example, a denylisted `evil-pkg` now also blocks
+  `evil_pkg`).
+- **The MCP server now advertises its own identity** (`safe-pkgs`/version) instead of
+  the underlying `rmcp` crate name and version.
+- Private-registry bearer tokens are no longer sent over cleartext `http://` (except to
+  loopback hosts), matching the audit and remote-config guards.
+
+### Changed
+
+- Version bumped to `1.0.0`.
+- Package metadata added for distribution: `license = "MIT"`, `rust-version = "1.85"`,
+  `repository`, `description`; the workspace is marked `publish = false` (distributed as
+  a binary via release artifacts and `cargo install --path .`).
+- CI now runs `clippy` and `test` with `--workspace`, so all crates are gated.
+- README: corrected the rmcp version badge and the decision-payload `metadata` note.
+
+### Known limitations
+
+- A lockfile that pins the same package at multiple versions (for example
+  `windows-sys` 0.48 and 0.52 in a `Cargo.lock`) is currently audited at a single
+  version; the other pinned version is not evaluated. This is tracked for a follow-up
+  release.

Cargo.lock

@@ -10,8 +10,11 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.2.0"
+version = "1.0.0"
 edition = "2024"
+rust-version = "1.85"
+license = "MIT"
+repository = "https://github.com/math280h/safe-pkgs"
 
 [workspace.dependencies]
 anyhow = "1"
@@ -37,6 +40,15 @@ wiremock = "0.6"
 name = "safe-pkgs"
 version.workspace = true
 edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+description = "Package safety checks for AI agents before install — MCP server + CLI with allow/deny decisions, risk scoring, and audit logs."
+readme = "README.md"
+keywords = ["mcp", "security", "supply-chain", "dependencies", "cli"]
+categories = ["command-line-utilities", "development-tools"]
+# Distributed as a binary (cargo install --path . / release binaries), not published to crates.io.
+publish = false
 
 [dependencies]
 # External dependencies

Cargo.toml

@@ -12,7 +12,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/rust-stable-orange" alt="Rust" />
-  <img src="https://img.shields.io/badge/MCP-rmcp%200.15-blue" alt="MCP" />
+  <img src="https://img.shields.io/badge/MCP-rmcp%201.x-blue" alt="MCP" />
   <img src="https://img.shields.io/badge/cache-SQLite-green" alt="Cache" />
   <img src="https://img.shields.io/endpoint?url=https%3A%2F%2Fmath280h.github.io%2Fsafe-pkgs%2Fbadges%2Fcoverage.json" alt="Coverage" />
 </p>
@@ -41,7 +41,7 @@ Decision payload includes:
 - `risk`: `low | medium | high | critical`
 - `reasons`: human-readable findings
 - `evidence`: structured findings (`kind`, stable `id`, `severity`, `message`, `facts`)
-- `metadata`: package context (latest, publish date, downloads, advisories)
+- `metadata`: package context (latest, publish date, downloads)
 - `fingerprints`: deterministic hashes (`config`, `policy`)
 
 ## Install + Run in 60 Seconds

README.md

@@ -6,6 +6,7 @@ edition.workspace = true
 [dependencies]
 async-trait.workspace = true
 chrono.workspace = true
+semver.workspace = true
 serde.workspace = true
 thiserror.workspace = true