synapto/pyproject.toml at main · ramonlimaramos/synapto · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "synapto"
version = "0.2.0"
description = "Persistent memory graph for AI coding agents — semantic search, knowledge graph, and time-based decay over MCP"
readme = "README.md"
license = "MIT"
requires-python = ">=3.11"
authors = [
    { name = "Ramon de Lima Ramos", email = "ramonlimaramos@gmail.com" },
]
keywords = ["mcp", "memory", "ai", "agents", "vector-search", "knowledge-graph", "claude", "cursor"]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: MIT License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Scientific/Engineering :: Artificial Intelligence",
    "Topic :: Database",
]
dependencies = [
    "fastmcp>=2.0.0",
    # pinned to fix GHSA-jj8c-mmj3-mmgv (CSRF in OAuth client cache);
    # fastmcp still ships the vulnerable range transitively — drop this once
    # fastmcp upstream bumps authlib itself
    "authlib>=1.6.11",
    "psycopg[binary,pool]>=3.1",
    "pgvector>=0.3.0",
    "redis>=5.0",
    "sentence-transformers>=3.0",
    "pydantic>=2.0",
    "click>=8.0",
    "tomli>=2.0;python_version<'3.11'",
    "tomli-w>=1.0",
    "numpy>=1.24",
    "structlog>=24.0",
    "orjson>=3.10",
]

[project.optional-dependencies]
openai = ["openai>=1.0"]
dev = [
    "pytest>=8.0",
    "pytest-asyncio>=0.23",
    "pytest-cov>=5.0",
    "ruff>=0.4",
    "bandit>=1.7",
    "pip-audit>=2.7",
    "build>=1.0",
    # pinned to fix CVE-2026-3219 in pip itself; uv bundles 26.0.1 by default
    # and pip-audit flags it. drop this constraint once uv ships a venv with
    # pip>=26.1 out of the box.
    "pip>=26.1",
]

[project.scripts]
synapto = "synapto.cli:main"

[project.urls]
Homepage = "https://github.com/ramonlimaramos/synapto"
Repository = "https://github.com/ramonlimaramos/synapto"
Issues = "https://github.com/ramonlimaramos/synapto/issues"

[tool.hatch.build.targets.wheel]
packages = ["src/synapto"]

[tool.ruff]
target-version = "py311"
line-length = 120

[tool.ruff.lint]
select = ["E", "F", "I", "N", "W", "UP"]

[tool.bandit]
exclude_dirs = ["tests", ".venv"]
skips = ["B101"]  # allow assert in non-test code (used in type narrowing)

[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"