perf: drop fastmcp + httpx; use stdlib urllib for engine download

Reduces BioRouter's 'uv sync' on install from ~20-30s (resolving fastmcp +
mcp + pydantic + httpx + httpcore + ...) to near-instant (empty deps,
venv creation only).

Also drops module-import overhead from ~500ms-1s to <100ms — the shim
never actually imported fastmcp (all three MCP servers use pure-stdlib
JSON-RPC). httpx was only used for the one engine download in
bootstrap._download_and_verify; replaced with urllib.request which
handles GitHub release redirects natively.

Author: Broccolito

pyproject.toml

@@ -11,10 +11,7 @@ license = {text = "MIT"}
 authors = [{name = "Wanjun Gu", email = "wanjun.gu@ucsf.edu"}]
 requires-python = ">=3.11"
 keywords = ["mcp", "biorouter", "codegraph", "code-intelligence", "knowledge-graph"]
-dependencies = [
-    "fastmcp>=2.11.2",
-    "httpx>=0.27",
-]
+dependencies = []
 
 [project.optional-dependencies]
 dev = [

src/codegraphagent/bootstrap.py

@@ -17,7 +17,8 @@
 import zipfile
 from pathlib import Path
 
-import httpx
+import urllib.error
+import urllib.request
 
 from codegraphagent.errors import BootstrapError
 
@@ -104,14 +105,33 @@ def _download_and_verify(*, url: str, dest: Path, expected_sha: str) -> None:
     bypass is logged.
     """
     dest.parent.mkdir(parents=True, exist_ok=True)
+    req = urllib.request.Request(
+        url,
+        headers={"User-Agent": "codegraphagent/0.1.0"},
+    )
     try:
-        with httpx.Client(timeout=120.0, follow_redirects=True) as client:
-            with client.stream("GET", url) as resp:
-                resp.raise_for_status()
-                with dest.open("wb") as fh:
-                    for chunk in resp.iter_bytes(64 * 1024):
-                        fh.write(chunk)
-    except httpx.HTTPError as exc:
+        with urllib.request.urlopen(req, timeout=120.0) as resp:
+            with dest.open("wb") as fh:
+                while True:
+                    chunk = resp.read(64 * 1024)
+                    if not chunk:
+                        break
+                    fh.write(chunk)
+    except urllib.error.HTTPError as exc:
+        if dest.exists():
+            dest.unlink()
+        raise BootstrapError(
+            f"Engine download failed: HTTP {exc.code}: {exc.reason}",
+            url=url,
+        ) from exc
+    except urllib.error.URLError as exc:
+        if dest.exists():
+            dest.unlink()
+        raise BootstrapError(
+            f"Engine download failed: {exc.reason}",
+            url=url,
+        ) from exc
+    except OSError as exc:
         if dest.exists():
             dest.unlink()
         raise BootstrapError(

tests/test_bootstrap.py

@@ -79,27 +79,24 @@ def test_download_and_verify_success(tmp_path: Path, monkeypatch: pytest.MonkeyP
     class FakeResponse:
         def __init__(self, content: bytes):
             self._content = content
-            self.status_code = 200
-        def iter_bytes(self, chunk_size: int = 65536):
-            yield self._content
-        def raise_for_status(self):
-            pass
+            self._pos = 0
+        def read(self, n: int = -1) -> bytes:
+            if n == -1 or n >= len(self._content) - self._pos:
+                chunk = self._content[self._pos:]
+                self._pos = len(self._content)
+                return chunk
+            chunk = self._content[self._pos:self._pos + n]
+            self._pos += len(chunk)
+            return chunk
         def __enter__(self):
             return self
         def __exit__(self, *args):
             return False
 
-    class FakeClient:
-        def __init__(self, *args, **kwargs):
-            pass
-        def __enter__(self):
-            return self
-        def __exit__(self, *args):
-            return False
-        def stream(self, method, url):
-            return FakeResponse(payload)
+    def fake_urlopen(req, timeout=None):
+        return FakeResponse(payload)
 
-    monkeypatch.setattr(bootstrap.httpx, "Client", FakeClient)
+    monkeypatch.setattr(bootstrap.urllib.request, "urlopen", fake_urlopen)
 
     dest = tmp_path / "engine.tar.gz"
     bootstrap._download_and_verify(
@@ -114,28 +111,26 @@ def test_download_and_verify_sha_mismatch(tmp_path: Path, monkeypatch: pytest.Mo
     payload = b"wrong-bytes"
 
     class FakeResponse:
-        def __init__(self):
-            self.status_code = 200
-        def iter_bytes(self, chunk_size: int = 65536):
-            yield payload
-        def raise_for_status(self):
-            pass
+        def __init__(self, content: bytes):
+            self._content = content
+            self._pos = 0
+        def read(self, n: int = -1) -> bytes:
+            if n == -1 or n >= len(self._content) - self._pos:
+                chunk = self._content[self._pos:]
+                self._pos = len(self._content)
+                return chunk
+            chunk = self._content[self._pos:self._pos + n]
+            self._pos += len(chunk)
+            return chunk
         def __enter__(self):
             return self
         def __exit__(self, *args):
             return False
 
-    class FakeClient:
-        def __init__(self, *args, **kwargs):
-            pass
-        def __enter__(self):
-            return self
-        def __exit__(self, *args):
-            return False
-        def stream(self, method, url):
-            return FakeResponse()
+    def fake_urlopen(req, timeout=None):
+        return FakeResponse(payload)
 
-    monkeypatch.setattr(bootstrap.httpx, "Client", FakeClient)
+    monkeypatch.setattr(bootstrap.urllib.request, "urlopen", fake_urlopen)
 
     dest = tmp_path / "engine.tar.gz"
     with pytest.raises(BootstrapError) as excinfo: