Skip to content

Packaging decisions left from #15: package name, Python floor, installability, dev dependency group #37

Description

@Shirofune-Security

Follow-up to #15, which was closed as partially addressed. #22 filled in the placeholder description; the packaging decisions that issue asked for are still open.

What #22 delivered

description is no longer "Add your description here".

What is left

pyproject.toml on main today:

[project]
name = "hayabusa-mcp"
version = "1.0.0"
description = "AI-driven DFIR analyzer for Hayabusa results: ..."
readme = "README.md"
requires-python = ">=3.13"
dependencies = ["duckdb>=1.4.4", "mcp>=1.26.0", "pandas>=3.0.1"]
Item State Note
name hayabusa-mcp The product is Mecha Hayabusa; the repo, docs site, and now the v1.0.0 release all use that name. hayabusa-mcp also reads like a component of hayabusa itself.
requires-python >=3.13 Excludes Ubuntu 24.04 LTS (ships 3.12) — a common DFIR workstation. Nothing in the code obviously needs 3.13.
[build-system] absent Virtual uv project (source = { virtual = "." }, uv.lock:205), so not pip-installable.
[project.scripts] absent No console entry point; distribution is clone + uv run server.py.
dev/test group absent pytest is not declared anywhere, which is why a plain pytest run fails with ModuleNotFoundError: No module named 'mcp' and CI has to use uv run python -m unittest.

The decision to make

These are all downstream of one choice, which is why they are worth deciding together rather than patching individually:

  • Stay a clone-and-run tool. Then name should still be corrected to mecha-hayabusa, and the absence of [build-system] / [project.scripts] is intentional and worth a one-line comment in pyproject.toml so the next reader does not "fix" it. Revisit the Python floor on its own merits.
  • Become installable (uv tool install / pipx install mecha-hayabusa). Then it needs [build-system], a [project.scripts] entry point wrapping server.py:main, and the name matters because it becomes the distribution name.

The Python floor and the dev group are worth doing either way: lowering to >=3.12 widens the audience measurably if nothing needs 3.13, and declaring the test dependencies makes the suite runnable without knowing the uv run incantation.

Why re-filed rather than left open

#15 bundled four items and one shipped, so its text no longer matches the tree — it still describes the description as a placeholder. This issue is only the residue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions