fix: close dependency security gaps

[saagpatel]

Summary

Closes MCPAudit's three live HIGH runtime dependency alerts and the actionable
mutable-action supply-chain findings. The package now excludes vulnerable MCP
Python SDK versions from both locked development installs and downstream
distribution resolution, while every external GitHub Action is bound to an
immutable reviewed commit.

Changes

• Raise the direct runtime floor from mcp>=1.27.0 to mcp>=1.28.1 and refresh
  uv.lock.
• Close GHSA-vj7q-gjh5-988w, GHSA-jpw9-pfvf-9f58, and
  GHSA-hvrp-rf83-w775 with the smallest common patched SDK version.
• Pin CI, CodeQL, self-audit, Scorecard, composite-action, agent-permission, and
  PyPI publishing actions to immutable release commits.
• Add regression tests that reject a vulnerable MCP floor or any action
  reference that differs from the explicitly reviewed action, release, and
  commit tuple.
• Align the README compatibility table with the new mcp 1.28.1 floor.
• Record the security changes under [Unreleased].

Checklist

• Canonical verifier passes (uv run pytest, uv run ruff check, uv run mypy .)
• Security implications considered — described below.
• CHANGELOG.md updated under [Unreleased]
• New security invariants are covered by repository-native tests

Security implications

Before this change, the checked-in lock selected mcp 1.27.0 and the published
requirement allowed 1.27.x. MCPAudit imports the SDK's client and FastMCP server
surfaces, so vulnerable transport/task code could be installed even where the
default CLI path did not exercise every affected server mode.

The required invariant is now:

1. repository and downstream installs cannot resolve an MCP SDK older than
   1.28.1; and
2. build, test, analysis, and publishing workflows cannot silently execute a
   different action revision through a mutable tag.

The 1.28.1 upgrade preserves Python 3.11–3.13 support. Upstream deprecations in
1.28.x affect WebSocket and experimental task APIs that MCPAudit does not call.
Connector, FastMCP server, complete-suite, and installed-package verification
all pass.

Live alert disposition

• Dependabot docs: refresh implementation roadmap #24, feat(analyzer): flag prompt and resource risks #25, and feat(policy): add per-server gates #26: fixed by the 1.28.1 runtime floor and lock.
• Scorecard pinned-dependency alerts docs: clarify audit readiness workflow #19 and feat(pinning): explain tool schema drift #21–feat: deepen MCP audit expansion #32, plus feat(cli): prepare 1.0.0rc1 release candidate #36: fixed by full
  commit pins, including the composite action's dependencies.
• Scorecard Code Review chore: prepare beta readiness #33: valid process-risk signal, not dismissed. The
  repository currently has one human contributor/collaborator, so requiring a
  second-person approval would deadlock all changes. Required CI, administrator
  enforcement, conversation resolution, CodeQL, and independent automated
  review remain in place, but they do not substitute for human review.
• Scorecard Fuzzing docs: prepare stable readiness #35 and CII Best Practices feat: harden beta adoption path #34: retained as medium/low
  maturity findings. They are not evidence of the three runtime
  vulnerabilities and are outside this bounded dependency repair.

Test plan

• uv lock --check
• uv run pytest -q — 1,010 passed
• uv run pytest -q tests/test_proof_before_action.py — 124 passed
• uv run pytest -q tests/test_connector.py tests/test_server.py — 56 passed
• uv run pytest -q tests/test_supply_chain_policy.py — 2 passed
• Ruff check and format check — clean
• uv run mypy . — clean
• Repository config-only self-audit — exit 0
• Gitleaks — 272 commits scanned, no leaks
• Wheel/sdist build and isolated Python 3.11 installation — mcp==1.28.1
  selected and wheel metadata requires mcp>=1.28.1
• Installed Proof Before Action flow — exact producer/subject/root verification
  anchored; wrong root, report tampering, malformed declaration, and image-ID
  mismatch all fail closed; offline HTML remains script-free with restrictive
  CSP; incomplete observation remains unknown

Independent review repairs

The exact-head Codex review of e9c7bdf567 raised two P2 findings. Both are
fixed on the current head:

• corrected the stale README claim that MCP SDK 1.27+ remained supported; and
• replaced the shape-only action-SHA test with an explicit reviewed
  action→release→commit allowlist, including shorthand - uses: steps.

The full and focused parent gates were rerun after those repairs.

An exact-head Codex re-review was requested for 16009272b4 but returned a
usage-limit response. That response is recorded as UNKNOWN, not approval.
Final-head fallback review evidence consists of green CodeQL, agent-permission
diff with zero findings, all ten required CI checks, resolved prior review
threads, the reviewed action-release allowlist, and the complete local
acceptance gates above.

Limitations and rollback

Proof Before Action retains its documented partial-observer and trust-authority
limitations. This PR does not publish a package or release, change output
schemas, alter detector scoring, or deploy anything.

Rollback is a normal revert of this PR, but doing so would reopen the three HIGH
dependency vulnerabilities and mutable-action risk; rollback should therefore
be paired with an alternative patched SDK constraint and immutable action pins.

Related issues

Supersedes Dependabot PR #168, whose lock-only update did not raise the published
runtime floor.

[github-actions]

Agent Permission Diff

• Base: 3feb6806268fc287f044cba0009781e61ee346db
• Head: 16009272b4e02197f9dc49d2b5ac30974e326ec8
• Findings: 0
• Gate findings: 0
• Acknowledged findings: 0
• Permission changes: 2
• Gate: pass in observe mode
• Fail on: critical
• Exit code: 0

Gate Decision

No findings were produced.

Findings

No agent-facing permission findings.

Permission Changes

• added actions cloud_deploy pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 in .github/workflows/publish.yml
• removed actions cloud_deploy pypa/gh-action-pypi-publish@release/v1 in .github/workflows/publish.yml

[saagpatel]

@codex review

Use light reasoning. Review exact head e9c7bdf567c04628a25a0fce39d91889360c012b, findings first and severity first. Focus on whether the MCP lower bound fully closes all three advisories, immutable action pins preserve the intended versions and workflow behavior, the regression tests cover the real supply-chain boundary, and any release or rollback claim is misleading. Do not treat unavailable review as clean.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e9c7bdf567

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[saagpatel]

@codex review

Use light reasoning. Re-review exact repaired head 16009272b4e02197f9dc49d2b5ac30974e326ec8, findings first and severity first. Confirm the two prior P2 findings are fully closed, inspect the - uses: parsing and reviewed action→release→commit policy for bypasses, and report any remaining merge-relevant issue. Do not treat unavailable review as clean.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.