fix: resolve 7 dependency CVEs and ~80 code quality alerts

Bump minimum dependency versions to fix security vulnerabilities:
- mcp[cli]>=1.10.0 (CVE-2025-53366, CVE-2025-53365)
- requests>=2.32.4 (CVE-2024-47081)
- aiohttp>=3.12.14 (CVE-2025-53643)
- Transitive: starlette 0.52.1 (CVE-2025-54121), urllib3 2.6.3 (CVE-2025-50182, CVE-2025-50181)

Code quality fixes across 35+ files:
- Remove unused imports from source, test, example, and script files
- Replace empty except blocks with contextlib.suppress()
- Remove unnecessary pass statements in schemapin modules
- Fix imprecise assertion in test_mcp_audit_logging
- Fix mcp_tools.py corruption (restore from last good commit, re-apply schemapin changes)

Author: jaschadub

examples/mcp-proxy/authentication-example.py

@@ -14,7 +14,6 @@
 
 import asyncio
 import json
-from pathlib import Path
 
 # MockLoop MCP imports
 from mockloop_mcp.mcp_tools import create_mcp_plugin, execute_test_plan

examples/mcp-proxy/basic-mock-example.py

@@ -14,7 +14,6 @@
 
 import asyncio
 import json
-from pathlib import Path
 
 # MockLoop MCP imports
 from mockloop_mcp.mcp_tools import create_mcp_plugin, execute_test_plan

examples/mcp-proxy/hybrid-workflow-example.py

@@ -16,17 +16,9 @@
 import asyncio
 import json
 import os
-from pathlib import Path
 
 # MockLoop MCP imports
 from mockloop_mcp.mcp_tools import create_mcp_plugin, execute_test_plan
-from mockloop_mcp.proxy.config import (
-    ProxyConfig,
-    AuthConfig,
-    AuthType,
-    RouteRule,
-    ProxyMode,
-)
 
 
 async def main():

examples/mcp-proxy/proxy-validation-example.py

@@ -15,12 +15,9 @@
 
 import asyncio
 import json
-import os
-from pathlib import Path
 
 # MockLoop MCP imports
 from mockloop_mcp.mcp_tools import create_mcp_plugin, execute_test_plan
-from mockloop_mcp.proxy.config import ProxyConfig, AuthConfig, AuthType
 
 
 async def main():

examples/schemapin/complete_signing_example.py

@@ -16,7 +16,6 @@
 
 from mockloop_mcp.schemapin import (
     signed_tool,
-    SchemaSigner,
     create_test_signer,
     get_tool_signature,
     get_tool_domain,

pyproject.toml

@@ -33,9 +33,9 @@ dependencies = [
     "uvicorn[standard]>=0.24.0",
     "Jinja2>=3.1.0",
     "PyYAML>=6.0",
-    "requests>=2.31.0",
-    "aiohttp>=3.9.0",
-    "mcp[cli]>=1.0.0",
+    "requests>=2.32.4",
+    "aiohttp>=3.12.14",
+    "mcp[cli]>=1.10.0",
     "schemapin>=1.0.0",
 ]
 

requirements.txt

@@ -3,14 +3,11 @@ fastapi
 uvicorn[standard]
 Jinja2
 PyYAML
-requests
-
-# Enhanced functionality dependencies
-aiohttp
-pyyaml
+requests>=2.32.4
+aiohttp>=3.12.14
 
 # MCP SDK
-mcp[cli]
+mcp[cli]>=1.10.0
 
 # SchemaPin integration
 schemapin

scripts/bump_version.py

@@ -205,10 +205,8 @@ def create_git_commit_and_tag(self, version: str) -> None:
                 ["git", "tag", "-a", tag_name, "-m", tag_message], check=True
             )
 
-        except subprocess.CalledProcessError:
-            pass
-        except FileNotFoundError:
-            pass
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            pass  # Git operations are optional - silently skip if not in a git repo
 
 
 def main():

scripts/sign_all_schemas.py

@@ -15,7 +15,6 @@
 import argparse
 import ast
 import importlib.util
-import inspect
 import json
 import logging
 import os
@@ -28,8 +27,7 @@
 sys.path.insert(0, str(Path(__file__).parent.parent / "src"))
 
 from mockloop_mcp.schemapin.signing import SchemaSigner
-from mockloop_mcp.schemapin.decorators import extract_enhanced_tool_schema, list_signed_tools
-from mockloop_mcp.schemapin.config import SchemaPinConfig
+from mockloop_mcp.schemapin.decorators import extract_enhanced_tool_schema
 
 # Configure logging
 logging.basicConfig(

scripts/validate_signatures.py

@@ -26,7 +26,6 @@
 
 from mockloop_mcp.schemapin.signing import SchemaSigner
 from mockloop_mcp.schemapin.decorators import (
-    extract_enhanced_tool_schema,
     get_tool_signature,
     get_tool_domain,
     get_tool_schema,