Address review comments

Signed-off-by: Ed Snible <snible@us.ibm.com>

Author: esnible

.gitignore

@@ -222,5 +222,5 @@ secrets.*
 # Orchestration working directory
 .repos/
 
-# Bogus lock files created by running uv in wrong directory.
+# Bogus lock files created by running uv in home directory.
 uv.lock

Makefile

@@ -1,4 +1,4 @@
-.PHONY: lint fmt test test-a2a test-mcp sync-all-uv sync-a2a sync-mcp
+.PHONY: lint fmt test-docker test-a2a test-mcp sync-all-uv sync-a2a sync-mcp
 
 lint:
 	pre-commit run --all-files
@@ -7,7 +7,8 @@ fmt:
 	ruff format .
 	ruff check --fix .
 
-test: test-a2a test-mcp
+# This builds all of the A2A and MCP example Docker images to verify they can be built successfully.
+test-docker: test-a2a test-mcp
 
 # Verify all of the A2A example Docker images can be built
 # (Optional KAGENTI_DOCKER_FLAGS for docker build, e.g. --no-cache or --load)

mcp/reservation_tool/pyproject.toml

@@ -7,14 +7,14 @@ requires-python = ">=3.10"
 dependencies = [
     "fastmcp>=2.11.0",
     "pydantic>=2.0.0",
+    "authlib>=1.6.9",   # Indirect; prevents CVE-2026-27962
+    "urllib3>=2.6.3",   # Indirect; prevents CVE-2025-66418
+    "python-multipart>=0.0.22", # Indirect; prevents CVE-2026-24486
 ]
 
 [project.optional-dependencies]
 dev = [
     "pytest>=7.0.0",
     "pytest-asyncio>=0.21.0",
     "flake8>=6.0.0",
-    "authlib>=1.6.9",   # Indirect; prevents CVE-2026-27962
-    "urllib3>=2.6.3",   # Indirect; prevents CVE-2025-66418
-    "python-multipart>=0.0.22", # Indirect; prevents CVE-2026-24486
 ]