Added mend

.github/workflows/mend-scan.yaml

@@ -1,13 +1,17 @@
 name: Mend CLI Scan
 
 on:
+  workflow_run:
+    workflows: ["Tests"]
+    types: [completed]
   workflow_dispatch:
   push:
 
 
 jobs:
   mend-scan:
     runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }} 
     steps:
       - name: Checkout code
         uses: actions/checkout@v6

.gitignore

@@ -14,4 +14,11 @@ wheels/
 # See https://github.com/joeblau/gitignore.io/issues/186 and https://github.com/joeblau/gitignore.io/issues/360
 
 .idea/
-version_info.txt
+version_info.txt
+
+# Mend/WhiteSource artifacts
+whitesource/
+.whitesource.lock
+mend
+mend-cli
+*.mend.json

.whitesource

@@ -0,0 +1,47 @@
+{
+  "scanSettings": {
+    "configMode": "AUTO",
+    "configExternalURL": "",
+    "projectToken": "",
+    "baseBranches": []
+  },
+  "scanSettingsSAST": {
+    "enableScan": true,
+    "scanPullRequests": true,
+    "incrementalScan": true,
+    "findingSuppressions": "enabled",
+    "enableSecretsScan": true,
+    "baseBranches": [],
+    "snippetSize": 10
+  },
+  "checkRunSettings": {
+    "vulnerableCheckRunConclusionLevel": "failure",
+    "displayMode": "diff",
+    "useMendCheckNames": true
+  },
+  "checkRunSettingsSAST": {
+    "checkRunConclusionLevel": "failure",
+    "severityThreshold": "high"
+  },
+  "issueSettings": {
+    "minSeverityLevel": "LOW",
+    "issueType": "DEPENDENCY"
+  },
+  "issueSettingsSAST": {
+    "minSeverityLevel": "high",
+    "issueType": "repo"
+  },
+  "remediateSettings": {
+    "workflowRules": {
+      "enabled": true
+    }
+  },
+   "imageSettings":{
+       "imageTracing":{
+           "enableImageTracingPR": false,
+           "addRepositoryCoordinate": false,
+           "addDockerfilePath": false,
+           "addMendIdentifier": false
+       }
+   }
+}

SECURITY.md

@@ -0,0 +1,12 @@
+# Security
+
+## Reporting a vulnerability
+
+If you believe you've found a security vulnerability, please report it responsibly:
+
+- **Preferred:** [Report via GitHub Security Advisories](https://github.com/PerfectoCode/perfecto-mcp/security/advisories) (private report).
+- **Alternative:** Open a [GitHub Issue](https://github.com/PerfectoCode/perfecto-mcp/issues) and use a discrete description; we will move sensitive details to a private channel.
+
+Please do not disclose security issues in public issues or discussions before we've had a chance to address them.
+
+Thank you for helping keep Perfecto MCP and its users safe.

mend.config

@@ -0,0 +1,25 @@
+# Mend CLI Configuration
+# Documentation: https://docs.mend.io/bundle/integrations/page/mend_cli.html
+
+# Scan configuration
+scope: "Perfecto//perfecto-mcp"
+
+# Policy enforcement (matching previous Unified Agent behavior)
+# Set to true if you want builds to fail on policy violations
+failPolicy: false
+
+# Update project inventory
+update: true
+
+# Additional scanning options
+scanSettings:
+  # Include dev dependencies
+  includeDevDependencies: false
+
+  # Scan comments to add metadata
+  scanComment: "${GITHUB_REF_NAME}"
+
+# Report settings
+reportSettings:
+  # Generate detailed reports
+  verbose: true

pyproject.toml

@@ -6,11 +6,13 @@ readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
     "httpx[http2]>=0.28.1",
-    "mcp[cli]>=1.17.0",
+    "mcp[cli]>=1.27.0",
     "opentelemetry-api>=1.20.0",
     "opentelemetry-sdk>=1.20.0",
     "opentelemetry-exporter-otlp>=1.20.0",
-    "pyinstaller>=6.0.0",
+    "pyjwt>=2.12.0",
+    "starlette>=0.47.3",
+    "pyinstaller>=6.17.0",
     "pydantic>=2.11.7",
     "pydantic-core>=2.33.2",
     "pydantic-settings>=2.10.1",