pyproject.toml

[project]
name = "idc-api"
version = "3.0.0b5"
description = "LLM-first REST API and MCP server for NCI Imaging Data Commons, backed by idc-index Parquet + DuckDB."
readme = "README.md"
requires-python = ">=3.11"
license = { text = "Apache-2.0" }
authors = [{ name = "Imaging Data Commons" }]
keywords = ["IDC", "DICOM", "cancer imaging", "MCP", "REST", "idc-index"]

dependencies = [
    # Query engine + data.
    # idc-index is pinned EXACTLY, unlike every other dependency here, because it transitively
    # pins idc-index-data (0.13.0 -> 25.0.0) — which *is* the IDC data release this server
    # advertises at /v3/version and documents in the changelog. The production image installs
    # from this file alone (the Dockerfile copies pyproject.toml and src, never uv.lock), so a
    # lower bound would let a rebuild of this very commit bake a later IDC release than the one
    # it claims to serve. Bump this pin to move IDC versions — see dev/deployment.md
    # § Updating for a new IDC release.
    "idc-index==0.13.0",
    "duckdb>=1.5.5",
    "pyarrow>=25.0.0",
    # Shared models / settings
    "pydantic>=2.7",
    "pydantic-settings>=2.15.0",
    # REST adapter
    "fastapi>=0.141.1",
    "uvicorn[standard]>=0.52.1",
    # MCP adapter (official SDK; bundles FastMCP server API).
    # Capped below 2.0: that release removes `mcp.server.fastmcp` entirely (FastMCP ->
    # MCPServer) and moves transport config off the constructor, so the adapter does not
    # import under it. Migration is a deliberate PR, not a dependency bump.
    # The cap alone does not hold the line — dependabot rewrites it. The matching ignore
    # condition in .github/dependabot.yml is what actually keeps 2.x out; change both together.
    "mcp>=1.29.0,<2",
]

[project.optional-dependencies]
dev = [
    "pytest>=9.1.1",
    "httpx>=0.27",          # FastAPI TestClient transport
    "pytest-asyncio>=0.23",
    "ruff>=0.16.2",
    "bandit>=1.7",          # static security lint (CI)
    "pip-audit>=2.7",       # dependency CVE scan (CI)
]

[project.scripts]
# Run the REST API (uvicorn under the hood)
idc-api = "idc_api.rest.app:main"
# Run the MCP server (stdio by default; --http for streamable-http)
idc-mcp = "idc_api.mcp.server:main"

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["src/idc_api"]

[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"

[tool.ruff]
line-length = 100
target-version = "py311"

[tool.ruff.lint]
# Selected explicitly rather than left to ruff's default. Ruff 0.16 expanded that default from
# 59 rules to 413, so a patch-range bump of the ruff pin silently became a lint policy change
# and failed CI on unmodified code. Pinning the set keeps `ruff check` reproducible across
# upgrades; widening it is a deliberate edit here, with the resulting fixes in the same PR.
select = ["E4", "E7", "E9", "F"]