Rebuild as the FrameCite MCP server

.github/workflows/ci.yml

@@ -0,0 +1,60 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.12", "3.14"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Install project
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+      - name: Lint
+        run: ruff check .
+      - name: Check formatting
+        run: ruff format --check .
+      - name: Test without network sockets
+        run: pytest
+
+  package:
+    name: Package and metadata
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Install build tools
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+      - name: Build distributions
+        run: python -m build
+      - name: Validate MCP Registry metadata
+        run: check-jsonschema --no-cache --schemafile https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json server.json
+      - name: Smoke-test the wheel
+        run: |
+          python -m venv /tmp/framecite-smoke
+          /tmp/framecite-smoke/bin/python -m pip install dist/*.whl
+          /tmp/framecite-smoke/bin/framecite --help

.github/workflows/public-corpus.yml

@@ -0,0 +1,32 @@
+name: Public PCAP compatibility
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: public-pcap-corpus
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    name: Pinned upstream captures
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Install FrameCite
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e .
+      - name: Download, verify, and delete the public corpus
+        run: python scripts/verify_public_corpus.py

.gitignore

@@ -1,48 +1,28 @@
-# macOS system files
-.DS_Store
-.AppleDouble
-.LSOverride
-
-# macOS specific folders
-__MACOSX/
-
 # Python
-*.pyc
-*.pyo
-*.pyd
 __pycache__/
+*.py[cod]
+*.egg-info/
+.python-version
+.venv/
 venv/
-.env
-*.env
-
-# Streamlit
-.streamlit/
-secrets.toml
 
-# FastAPI
-instance/
-*.log
+# Build and test output
+.coverage
+.pytest_cache/
+.ruff_cache/
+build/
+dist/
+htmlcov/
 
-# Docker
-docker-compose.override.yml
-*.tar
-*.img
-*.container
-
-# Logs and temp files
-logs/
-*.log
-*.swp
-*.swo
-*.swn
-nohup.out
+# Local configuration and captures
+.env
+*.env
+*.pcap
+*.pcapng
 
-# VSCode & JetBrains IDEs
-.vscode/
+# Editors and operating systems
+.DS_Store
 .idea/
-
-# Node.js (if frontend needs it)
-node_modules/
-package-lock.json
-yarn.lock
+.vscode/
+*.swp
 

CONTRIBUTING.md

@@ -0,0 +1,26 @@
+# Contributing to FrameCite
+
+Thank you for helping make packet troubleshooting safer and more reproducible.
+
+## Before opening a change
+
+- Keep the MCP tool surface small and read-only.
+- Prefer deterministic facts over heuristic labels.
+- Give every generated conclusion at least one valid packet-number citation.
+- Never add a raw-payload return path, live capture, packet injection, shell command, or general-purpose runtime network client. Extension-file retrieval must remain the single audited, bounded network path.
+- Reproduce packet behavior with synthetic Scapy fixtures; never commit a private capture.
+- Keep public-corpus entries metadata-only, pinned to immutable upstream revisions, and accompanied by exact size, SHA-256, source, and license links.
+
+## Local checks
+
+```bash
+python -m pip install -e ".[dev]"
+ruff check .
+ruff format --check .
+pytest
+python -m build
+```
+
+Add tests for normal behavior, malformed input, boundaries, privacy, output budgets, and MCP schemas whenever they are relevant.
+
+The optional networked compatibility check is `python scripts/verify_public_corpus.py`. It downloads verified upstream captures only into a temporary directory and deletes them after the run. Do not add public or private capture files to the repository or upload them as workflow artifacts.