chore: bump package versions and pin mcp<2.0 across all servers

[dandye]

Summary

Bump package versions and cap mcp / mcp[cli] dependency constraints below <2.0 across all server packages to prevent breaking changes from mcp 2.x releases. Also add root GEMINI.md and AGENTS.md with repository guidelines for coding agents.

Changes

• google-secops-mcp:
  • Bump version to 0.7.1 in server/secops/pyproject.toml and server/secops/setup.py
  • Bump USER_AGENT to secops-app/0.7.1 in server/secops/secops_mcp/server.py
  • Pin mcp[cli]>=1.26.0,<2.0
  • Align setup.py install_requires with pyproject.toml
• gti-mcp:
  • Bump version to 0.1.3 in server/gti/pyproject.toml and server/gti/setup.py
• secops-soar-mcp:
  • Bump version to 0.1.2 in server/secops-soar/pyproject.toml and server/secops-soar/setup.py
  • Pin mcp[cli]>=1.4.1,<2.0
• scc-mcp:
  • Bump version to 0.1.1 in server/scc/pyproject.toml and server/scc/setup.py
  • Pin mcp[cli]>=1.4.1,<2.0
• Agent Guidelines:
  • Add root GEMINI.md and AGENTS.md specifying synchronized version bump rules, mcp<2.0 constraints, and verification procedures.

Verification

• Unit tests:
  • server/gti: 55/55 passed (pytest)
  • server/secops: 16/16 unit tests passed
• Protocol Handshake & Tool Discovery:
  • Verified MCP protocol initialization and tool listing across all 4 servers via connected client sessions.
• End-to-End Live Invocations:
  • google-secops-mcp: Tested live calls (list_curated_rule_sets, list_security_rules, list_watchlists) against Chronicle tenant.
  • secops-soar-mcp: Tested live tool calls (list_cases) against active SOAR instance with scope discovery.
  • gti-mcp: Tested live tool calls (search_threat_actors, search_vulnerabilities) against Google Threat Intelligence API.
  • scc-mcp: Tested live tool calls (top_vulnerability_findings) against GCP Security Command Center API.

[dandye]

Verification & Testing Report for PR #288

All four MCP servers in this repository were verified after package version bumps and mcp<2.0 pinning (mcp==1.29.1).

1. Unit Tests

• gti-mcp (server/gti): 55/55 passed (pytest) in 2.37s.
• google-secops-mcp (server/secops): 16/16 passed unit test suite.

2. Protocol Handshake & Tool Registration (MCP Client Session)

• Tested tool discovery and JSON-RPC schema initialization using in-memory MCP client sessions (mcp.shared.memory.create_connected_server_and_client_session):
  • google-secops-mcp: 68 tools successfully registered and discoverable.
  • gti-mcp: 36 tools successfully registered and discoverable.
  • secops-soar-mcp: 10 tools successfully registered and discoverable.
  • scc-mcp: 2 tools successfully registered and discoverable.

3. Live & End-to-End MCP Tool Invocations

• google-secops-mcp (v0.7.1):
  • Executed live MCP tool calls (list_curated_rule_sets, list_security_rules, list_watchlists) against a live Chronicle tenant (dandye-0324-chronicle), successfully returning live detection rules and curated rule set data.
• gti-mcp (v0.1.3):
  • Executed live MCP tool calls (search_threat_actors(query="APT29"), search_vulnerabilities(query="CVE-2021-44228")) against the live Google Threat Intelligence backend, successfully retrieving threat actor profiles and CVE mitigation details.
• secops-soar-mcp (v0.1.2):
  • Authenticated and performed scope discovery (resolved 50+ scopes) against active SOAR server instances.
  • Executed live MCP tool call list_cases over connected client session, successfully receiving live cases and alert metadata.
• scc-mcp (v0.1.1):
  • Executed MCP tool call top_vulnerability_findings against GCP Security Command Center API for project dandye-0324-chronicle.

[goog-cmmartin]

LGTM