v0.5.0 is a narrow integration-driven release.

andrey.korchemkin · andrey.korchemkin · commit d76aeb73eb1f · 2026-03-31T11:22:51.000+03:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,27 @@ All notable changes to this project will be documented in this file.
 
 The format is based on Keep a Changelog and this project uses Semantic Versioning.
 
+## [0.5.0] - 2026-03-31
+
+Integration-driven release.
+
+### Added
+
+- explicit `scan_timestamp` field in JSON reports for downstream temporal-decay consumers
+- matching scan timestamp metadata in SARIF run properties and invocation metadata
+- release-ready interface contract for Layer 1 style static baseline consumers
+
+### Changed
+
+- bumped report schema version to `0.5`
+- refreshed release docs and README examples for `v0.5.0`
+- regenerated sample artifacts from the current scanner output
+
+### Notes
+
+- `generated_at` is retained for backward compatibility
+- `scan_timestamp` is the canonical cross-layer timestamp field going forward
+
 ## [0.4.0] - 2026-03-29
 
 First practically useful public release.
diff --git a/README.md b/README.md
@@ -11,7 +11,8 @@
 
 `MCP Trust Kit` scans a local MCP server over `stdio`, discovers its tools, runs deterministic
 checks for protocol and tool hygiene plus risky exposed capabilities, calculates a score from
-`0..100`, and emits terminal, JSON, and SARIF output that fits cleanly into CI.
+`0..100`, and emits terminal, JSON, and SARIF output that fits cleanly into CI. JSON and SARIF
+include an explicit `scan_timestamp` field for downstream consumers.
 
 **MCP Trust Kit scores surface risk, not business intent.**
 
@@ -122,7 +123,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Run MCP Trust Kit
-        uses: aak204/MCP-Trust-Kit@v0.4.0
+        uses: aak204/MCP-Trust-Kit@v0.5.0
         with:
           cmd: python path/to/your/server.py
           min-score: "80"
@@ -141,7 +142,7 @@ The action fails when:
 - the scan fails technically
 - the final score is below `min-score`
 
-If the `v0.4.0` tag is not published yet, use a branch name or commit SHA while testing privately.
+If the `v0.5.0` tag is not published yet, use a branch name or commit SHA while testing privately.
 
 ## Example Output
 
@@ -228,7 +229,7 @@ The scoring model is intentionally simple and predictable:
 3. clamp to `0..100`
 4. compute category scores the same way
 
-Severity mapping in `v0.4.0`:
+Severity mapping in `v0.5.0`:
 
 | Severity | Penalty |
 | --- | --- |
@@ -273,7 +274,7 @@ More detail:
 
 ## Roadmap
 
-Near-term work after `v0.4.0`:
+Near-term work after `v0.5.0`:
 
 - expand deterministic rules for `auth` and `secrets`
 - improve SARIF location mapping when source context is available
diff --git a/docs/architecture.md b/docs/architecture.md
@@ -1,6 +1,6 @@
 # Architecture
 
-`MCP Trust Kit` keeps the `v0.4.0` pipeline intentionally small and deterministic.
+`MCP Trust Kit` keeps the `v0.5.0` pipeline intentionally small and deterministic.
 
 ```mermaid
 flowchart LR
@@ -18,7 +18,7 @@ flowchart LR
 
 Key properties:
 
-- one MCP transport for `v0.4.0`: local `stdio`
+- one MCP transport for `v0.5.0`: local `stdio`
 - one deterministic rule per file
 - one deterministic surface-risk scoring engine
 - output layer formats an already-built `Report`
diff --git a/docs/release-checklist.md b/docs/release-checklist.md
@@ -1,6 +1,6 @@
 # Release Checklist
 
-Use this list before publishing `v0.4.0`.
+Use this list before publishing `v0.5.0`.
 
 ## Repository
 
@@ -28,7 +28,7 @@ Windows note:
 - run `pip install .`
 - run `mcp-trust --help`
 - verify `import mcp_trust; print(mcp_trust.__version__)`
-- verify package metadata shows version `0.4.0`
+- verify package metadata shows version `0.5.0`
 
 ## Examples And Reports
 
@@ -47,7 +47,7 @@ Windows note:
 
 ## Release
 
-- create tag `v0.4.0`
+- create tag `v0.5.0`
 - publish GitHub Release notes from `CHANGELOG.md`
 - attach or link sample artifacts if desired
 - smoke-test the published action from a separate repository
diff --git a/docs/release-notes-v0.5.0.md b/docs/release-notes-v0.5.0.md
@@ -0,0 +1,64 @@
+# MCP Trust Kit v0.5.0
+
+`v0.5.0` is a narrow integration-driven release.
+
+The scanner contract from `v0.4.0` stays intentionally stable: local `stdio` discovery,
+deterministic rules, predictable scoring, terminal summary, JSON, SARIF, and GitHub Actions.
+The main reason for `v0.5.0` is to make Layer 1 baseline output easier to consume by downstream
+systems that care about scan freshness and temporal decay.
+
+## Highlights
+
+- explicit `scan_timestamp` field in JSON output
+- matching timestamp metadata in SARIF
+- no break to existing `generated_at` consumers
+- release-ready static baseline contract for higher-layer integrations
+
+## Included In v0.5.0
+
+- JSON reports now expose:
+  - `scan_timestamp`
+  - `generated_at`
+  - aggregate score breakdown
+  - capability-aware and hygiene-aware findings
+- SARIF runs now expose:
+  - `runs[].properties.scan_timestamp`
+  - `runs[].invocations[].endTimeUtc`
+- sample reports regenerated from the current scanner
+- release docs and README updated for `v0.5.0`
+
+## Validation Snapshot
+
+- `examples/insecure-server` -> `10/100`
+- `@modelcontextprotocol/server-memory@2026.1.26` -> `100/100`
+- `@modelcontextprotocol/server-filesystem@2026.1.14` -> `40/100`
+
+## Contract Note
+
+`generated_at` is still present for backward compatibility.
+
+`scan_timestamp` is now the canonical timestamp field for downstream integrations that need to
+reason about baseline freshness.
+
+## Quickstart
+
+Local:
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+pip install -e .[dev]
+mcp-trust scan --json-out baseline.json --cmd python examples/insecure-server/server.py
+```
+
+GitHub Actions:
+
+```yaml
+- name: Run MCP Trust Kit
+  uses: aak204/MCP-Trust-Kit@v0.5.0
+  with:
+    cmd: python path/to/your/server.py
+    min-score: "80"
+    json-out: mcp-trust-report.json
+    sarif-out: mcp-trust-report.sarif
+```
diff --git a/docs/validated-servers.md b/docs/validated-servers.md
@@ -7,7 +7,7 @@ The point is narrower: show that `MCP Trust Kit` works on real servers outside t
 
 **MCP Trust Kit scores surface risk, not business intent.**
 
-Validation date: `2026-03-29`
+Validation date: `2026-03-31`
 
 Reference sources for the public packages used here:
 
diff --git a/pyproject.toml b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mcp-trust-kit"
-version = "0.4.0"
+version = "0.5.0"
 description = "CI-first deterministic surface-risk scoring for MCP servers."
 readme = "README.md"
 license = "Apache-2.0"
diff --git a/sample-reports/insecure-server.report.json b/sample-reports/insecure-server.report.json
@@ -1,7 +1,8 @@
 {
-  "schema_version": "0.4",
-  "toolkit_version": "0.4.0",
-  "generated_at": "2026-03-29T13:48:58.855632+00:00",
+  "schema_version": "0.5",
+  "toolkit_version": "0.5.0",
+  "scan_timestamp": "2026-03-31T07:26:34.700338+00:00",
+  "generated_at": "2026-03-31T07:26:34.700338+00:00",
   "server": {
     "target": "stdio:[\".\\\\.venv\\\\Scripts\\\\python\",\"examples\\\\insecure-server\\\\server.py\"]",
     "name": "Insecure Demo Server",
diff --git a/sample-reports/insecure-server.report.sarif b/sample-reports/insecure-server.report.sarif
@@ -6,7 +6,7 @@
       "tool": {
         "driver": {
           "name": "MCP Trust Kit",
-          "semanticVersion": "0.4.0",
+          "semanticVersion": "0.5.0",
           "rules": [
             {
               "id": "duplicate_tool_names",
@@ -490,11 +490,15 @@
       "invocations": [
         {
           "executionSuccessful": true,
+          "endTimeUtc": "2026-03-31T07:26:34.700338+00:00",
           "workingDirectory": {
             "uri": "file:///D:/Dev/MCP%20Trust%20Kit"
           }
         }
       ],
+      "properties": {
+        "scan_timestamp": "2026-03-31T07:26:34.700338+00:00"
+      },
       "results": [
         {
           "ruleId": "overly_generic_tool_name",
diff --git a/src/mcp_trust/__init__.py b/src/mcp_trust/__init__.py
@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "0.4.0"
+__version__ = "0.5.0"
diff --git a/src/mcp_trust/models.py b/src/mcp_trust/models.py
@@ -355,7 +355,7 @@ class Report:
     score: ScoreBreakdown
     rule_descriptors: dict[str, RuleDescriptor] = field(default_factory=dict)
     generated_at: datetime = field(default_factory=lambda: datetime.now(UTC))
-    schema_version: str = "0.4"
+    schema_version: str = "0.5"
     toolkit_version: str = __version__
     metadata: dict[str, JSONValue] = field(default_factory=dict)
 
@@ -386,3 +386,8 @@ def finding_count(self) -> int:
     def total_score(self) -> int:
         """Return the total score from the scoring breakdown."""
         return self.score.total_score
+
+    @property
+    def scan_timestamp(self) -> datetime:
+        """Return the canonical scan timestamp for downstream consumers."""
+        return self.generated_at
diff --git a/src/mcp_trust/reporters/json.py b/src/mcp_trust/reporters/json.py
@@ -29,10 +29,12 @@ def render(self, report: Report) -> str:
 
 def report_to_json_data(report: Report) -> dict[str, object]:
     """Return a JSON-compatible representation of a report."""
+    scan_timestamp = report.scan_timestamp.isoformat()
     return {
         "schema_version": report.schema_version,
         "toolkit_version": report.toolkit_version,
-        "generated_at": report.generated_at.isoformat(),
+        "scan_timestamp": scan_timestamp,
+        "generated_at": scan_timestamp,
         "server": _serialize_server(report.server),
         "tools": [_serialize_tool(tool) for tool in report.server.tools],
         "findings": [_serialize_finding(finding) for finding in report.findings],
diff --git a/src/mcp_trust/reporters/sarif.py b/src/mcp_trust/reporters/sarif.py
@@ -29,6 +29,7 @@ def report_to_sarif_data(report: Report) -> dict[str, object]:
     """Return a SARIF-compatible representation of a report."""
     rule_descriptors = tuple(report.rule_descriptors.values())
     artifact_uri = _infer_artifact_uri(report)
+    scan_timestamp = report.scan_timestamp.isoformat()
 
     return {
         "$schema": SARIF_SCHEMA_URI,
@@ -48,9 +49,13 @@ def report_to_sarif_data(report: Report) -> dict[str, object]:
                 "invocations": [
                     {
                         "executionSuccessful": True,
+                        "endTimeUtc": scan_timestamp,
                         "workingDirectory": {"uri": Path.cwd().as_uri()},
                     }
                 ],
+                "properties": {
+                    "scan_timestamp": scan_timestamp,
+                },
                 "results": [
                     _serialize_result(
                         finding,
diff --git a/tests/test_github_action.py b/tests/test_github_action.py
@@ -27,7 +27,7 @@ def test_readme_documents_github_actions_quickstart() -> None:
     readme_text = (ROOT / "README.md").read_text(encoding="utf-8")
 
     assert "## GitHub Actions Quickstart" in readme_text
-    assert "uses: aak204/MCP-Trust-Kit@v0.4.0" in readme_text
+    assert "uses: aak204/MCP-Trust-Kit@v0.5.0" in readme_text
     assert "cmd: python path/to/your/server.py" in readme_text
     assert "github/codeql-action/upload-sarif@v3" in readme_text
     assert "mcp-trust-report.sarif" in readme_text
diff --git a/tests/test_launch_assets.py b/tests/test_launch_assets.py
@@ -18,13 +18,15 @@ def test_sample_reports_exist_and_match_current_demo_shape() -> None:
     hero_svg = hero_image.read_text(encoding="utf-8")
 
     assert json_data["server"]["name"] == "Insecure Demo Server"
+    assert "scan_timestamp" in json_data
     assert json_data["total_score"] == 10
     assert json_data["summary"]["finding_count"] == 7
     assert json_data["summary"]["why_score"] == (
         "Score is driven mainly by detected command execution and file system issues."
     )
     assert sarif_data["version"] == "2.1.0"
     assert len(sarif_data["runs"]) == 1
+    assert "scan_timestamp" in sarif_data["runs"][0]["properties"]
     assert len(sarif_data["runs"][0]["results"]) == 7
     assert "```text" in terminal_text
     assert "Total Score: 10/100" in terminal_text
diff --git a/tests/test_sarif.py b/tests/test_sarif.py
@@ -38,6 +38,8 @@ def test_sarif_report_contains_rules_results_and_locations() -> None:
     assert len(runs) == 1
     driver = runs[0]["tool"]["driver"]
     assert driver["name"] == "MCP Trust Kit"
+    assert runs[0]["properties"]["scan_timestamp"] == report.generated_at.isoformat()
+    assert runs[0]["invocations"][0]["endTimeUtc"] == report.generated_at.isoformat()
     assert {rule["id"] for rule in driver["rules"]} == {
         "duplicate_tool_names",
         "missing_tool_description",
@@ -105,4 +107,5 @@ def test_scan_cli_writes_sarif_report(
     assert exit_code == 0
     assert "Total Score: 10/100" in captured.out
     assert parsed["version"] == "2.1.0"
+    assert "scan_timestamp" in parsed["runs"][0]["properties"]
     assert parsed["runs"][0]["results"][0]["ruleId"] == "overly_generic_tool_name"
diff --git a/tests/test_scoring.py b/tests/test_scoring.py
@@ -82,6 +82,8 @@ def test_json_report_contains_total_score_and_category_breakdown() -> None:
     rendered = JsonReporter().render(report)
     parsed = json.loads(rendered)
 
+    assert json_data["scan_timestamp"] == report.generated_at.isoformat()
+    assert json_data["generated_at"] == report.generated_at.isoformat()
     assert json_data["total_score"] == 90
     assert json_data["summary"] == {
         "tool_count": 0,
@@ -160,5 +162,6 @@ def test_json_report_contains_total_score_and_category_breakdown() -> None:
     }
     assert json_data["tools"] == []
     assert parsed["total_score"] == 90
+    assert parsed["scan_timestamp"] == report.generated_at.isoformat()
     assert parsed["score"]["total_score"] == 90
     assert parsed["findings"][0]["score_category"] == "tool_surface"

Original file line number	Diff line number	Diff line change
`@@ -6,7 +6,7 @@`
`6`	`6`	`"tool": {`
`7`	`7`	`"driver": {`
`8`	`8`	`"name": "MCP Trust Kit",`
`9`		`- "semanticVersion": "0.4.0",`
	`9`	`+ "semanticVersion": "0.5.0",`
`10`	`10`	`"rules": [`
`11`	`11`	`{`
`12`	`12`	`"id": "duplicate_tool_names",`
`@@ -490,11 +490,15 @@`
`490`	`490`	`"invocations": [`
`491`	`491`	`{`
`492`	`492`	`"executionSuccessful": true,`
	`493`	`+ "endTimeUtc": "2026-03-31T07:26:34.700338+00:00",`
`493`	`494`	`"workingDirectory": {`
`494`	`495`	`"uri": "file:///D:/Dev/MCP%20Trust%20Kit"`
`495`	`496`	`}`
`496`	`497`	`}`
`497`	`498`	`],`
	`499`	`+ "properties": {`
	`500`	`+ "scan_timestamp": "2026-03-31T07:26:34.700338+00:00"`
	`501`	`+ },`
`498`	`502`	`"results": [`
`499`	`503`	`{`
`500`	`504`	`"ruleId": "overly_generic_tool_name",`
Original file line number	Diff line number	Diff line change
`@@ -2,4 +2,4 @@`
`2`	`2`
`3`	`3`	`__all__ = ["__version__"]`
`4`	`4`
`5`		`-__version__ = "0.4.0"`
	`5`	`+__version__ = "0.5.0"`