Cargo.toml

[package]
name = "red-clippy"
version = "0.1.0"
edition = "2024"
description = "Red Clippy - multi-tenant pentest helper panel with findings, recon, REST API, and MCP server"
license = "GPL-3.0-only"
repository = "https://github.com/CSPF-Founder/red-clippy"
readme = "README.md"
keywords = ["pentest", "security", "mcp", "reporting", "recon"]
categories = ["command-line-utilities"]
build = "build.rs"

[dependencies]
axum = { version = "0.8", features = ["macros", "multipart"] }
tokio = { version = "1", features = ["full"] }
tower = "0.5"
tower-http = { version = "0.7", features = ["trace", "set-header"] }
sqlx = { version = "0.9", default-features = false, features = ["runtime-tokio", "sqlite", "chrono", "migrate", "macros"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
chrono = { version = "0.4", features = ["serde"] }
argon2 = "0.5"
rand = "0.10"
hex = "0.4"
base64 = "0.23"
anyhow = "1"
thiserror = "2"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
clap = { version = "4", features = ["derive", "env"] }
sha2 = "0.11"
toml = "1"
quick-xml = "0.42"
# `rustls` trusts the OS certificate store, not a compiled-in root set, so an
# HTTPS `mcp --url` through an intercepting proxy uses the operator's own CA.
reqwest = { version = "0.13", default-features = false, features = ["json", "rustls"] }
url = "2"
rust_xlsxwriter = "0.99"
# Embeds frontend/dist into the release binary so `red-clippy` ships as one
# file. Debug builds deliberately read the bundle off disk instead (no
# `debug-embed` feature), so rebuilding the SPA does not force a cargo rebuild.
rust-embed = "8"
mime_guess = "2"

[profile.release]
lto = "thin"
codegen-units = 1
strip = true