chore: quality improvements from Oracle architecture review

- Add MIT LICENSE file
- Add py.typed marker for type checker support
- Fix stale about() resource: 17 tools → 24 tools, 9 sources → 11 sources
- Replace 3x silent 'except Exception: pass' with debug logging
- Reuse httpx.AsyncClient in NVDClient (was creating per-request)
- Add disclaimer footers to assess_mcp_security and threat_model outputs
- 224/224 tests pass

Author: zer0-kr

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 zer0-kr
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

src/owasp_mcp/nvd.py

@@ -16,6 +16,12 @@ def __init__(self, api_key: str | None = None) -> None:
         self.api_key = api_key
         self._last_request = 0.0
         self._min_interval = 0.6 if api_key else 6.0
+        self._client: httpx.AsyncClient | None = None
+
+    async def _ensure_client(self) -> httpx.AsyncClient:
+        if self._client is None or self._client.is_closed:
+            self._client = httpx.AsyncClient(follow_redirects=True, timeout=30)
+        return self._client
 
     async def _get(self, endpoint: str, params: dict) -> dict:
         now = time.monotonic()
@@ -27,16 +33,15 @@ async def _get(self, endpoint: str, params: dict) -> dict:
         if self.api_key:
             headers["apiKey"] = self.api_key
 
-        async with httpx.AsyncClient(follow_redirects=True) as client:
-            resp = await client.get(
-                f"{self.BASE}/{endpoint}",
-                params=params,
-                headers=headers,
-                timeout=30,
-            )
-            resp.raise_for_status()
-            self._last_request = time.monotonic()
-            return resp.json()
+        client = await self._ensure_client()
+        resp = await client.get(
+            f"{self.BASE}/{endpoint}",
+            params=params,
+            headers=headers,
+        )
+        resp.raise_for_status()
+        self._last_request = time.monotonic()
+        return resp.json()
 
     async def search_cves(
         self,

src/owasp_mcp/py.typed

@@ -45,13 +45,16 @@ def about() -> str:
             f"- **Database available:** {'Yes' if info['exists'] else 'No'}\n"
             f"- **Database built:** {info.get('built_at', 'never')}\n"
             f"- **Database path:** `{info['path']}`\n\n"
-            "## Available Tools (17)\n\n"
+            "## Available Tools (24)\n\n"
             "- `list_projects` / `search_projects` / `get_project`\n"
-            "- `search_owasp` — Cross-source search (9 data sources)\n"
-            "- `get_top10` / `get_api_top10` / `get_llm_top10`\n"
+            "- `search_owasp` — Cross-source search (11 data sources)\n"
+            "- `get_top10` / `get_api_top10` / `get_llm_top10` / `get_mcp_top10`\n"
             "- `get_asvs` / `get_wstg` / `get_masvs`\n"
-            "- `get_proactive_controls` / `get_cheatsheet`\n"
-            "- `cross_reference` / `assess_stack` / `generate_checklist`\n"
+            "- `get_proactive_controls` / `get_cheatsheet` / `get_cwe`\n"
+            "- `cross_reference` / `compliance_map`\n"
+            "- `assess_stack` / `generate_checklist`\n"
+            "- `assess_mcp_security` / `threat_model`\n"
+            "- `search_cve` / `get_cve_detail`\n"
             "- `update_database` / `database_status`\n\n"
             "## Available Prompts (4)\n\n"
             "- `security_review` — Guided security review workflow\n"

src/owasp_mcp/server.py

@@ -495,8 +495,8 @@ async def cross_reference(
                     for row in asvs_results:
                         lines.append(f"- {_fmt_asvs(row)}")
                     sections.append("\n".join(lines))
-            except Exception:
-                pass
+            except Exception as exc:
+                log.debug("ASVS cross-reference search failed: %s", exc)
 
             try:
                 wstg_results, _ = db.search_fts(db_path, "wstg", cwe_num, limit=10)
@@ -520,8 +520,8 @@ async def cross_reference(
                     for row in wstg_results:
                         lines.append(f"- {_fmt_wstg(row)}")
                     sections.append("\n".join(lines))
-            except Exception:
-                pass
+            except Exception as exc:
+                log.debug("WSTG cross-reference search failed: %s", exc)
 
         if top10_id:
             id_upper = top10_id.strip().upper()
@@ -738,8 +738,8 @@ async def assess_stack(
                 if cs_results:
                     names = [r.get("name", "") for r in cs_results]
                     sections.append(f"### Related Cheat Sheets for \"{term}\"\n" + "\n".join(f"- {n}" for n in names))
-        except Exception:
-            pass
+        except Exception as exc:
+            log.debug("Cheat sheet search in assess_stack failed: %s", exc)
 
         header = f"## Security Assessment: {stack}\n"
         if not sections:
@@ -1016,6 +1016,7 @@ async def assess_mcp_security(
         lines.append("2. Implement authentication (MCP07) and audit logging (MCP08) as baseline controls")
         lines.append("3. Pin and verify all tool/plugin dependencies (MCP03, MCP04)")
         lines.append("4. Scope agent permissions to minimum required (MCP02)")
+        lines.append("\n_Note: This assessment is based on keyword analysis of your description. For a comprehensive review, examine each MCP Top 10 item individually using `get_mcp_top10`._")
 
         return "\n".join(lines)
 
@@ -1097,7 +1098,8 @@ async def threat_model(
         if not sections:
             return f"{header}\nNo significant threats identified from the description. Provide more detail about components, data flows, and trust boundaries."
 
-        return header + "\n\n".join(sections)
+        footer = "\n\n_Note: This threat model is based on keyword analysis. For comprehensive STRIDE analysis, provide detailed architecture documentation and review each category with domain-specific tools._"
+        return header + "\n\n".join(sections) + footer
 
     @mcp.tool(annotations=ToolAnnotations(readOnlyHint=True, idempotentHint=True))
     async def get_cwe(