Release 2026-09-03b: CI secret-history scan fix, dependency refresh (FastMCP 4, MCP 2026-07-28)

USPTO Final Petition Decisions MCP server: petition search by application, art unit and criteria, petition details, document content and downloads. Example application 17896175 (no petitions) replaced with 17414168; the accepted identifier forms now match the validator (digits and slash only).

Updated to FastMCP 4.0.1 on the MCP Python SDK 2.x, speaking the 2026-07-28 MCP
protocol revision (MCP Apps now import from fastmcp.apps; a compat shim restores
defer_loading on the wire).

Security and robustness pass from the 2026-09-03 review: INTERNAL_AUTH_SECRET
rotation overlap window with per-purpose derived keys, bounded request bodies,
archives and PDF buffers, USPTO-authored text escaped before it reaches the
view HTML, response-size guard with paging markers on every tool, shared
cross-process USPTO rate limiter, health checks that can actually fail.

Documentation refresh: every example application, patent and proceeding number
verified live against the USPTO API and rewritten in the form the identifier
resolver expects; stale tool counts, env-var tables and response shapes fixed.
Removed the cost and spend wording around OCR; the extraction tiers are now
described by capability (native text layer first, OCR for scanned pages) and a
self-hosted Docling backend can be configured via DOCLING_SERVE_URL. Secrets and
prompt-injection baselines regenerated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CeSWJpSaEHe9Cx66xzahVV

Author: john-walkoe

.github/workflows/secret-scan.yaml

@@ -38,23 +38,25 @@ jobs:
 
       - name: Check for secrets in git history (last 100 commits)
         run: |
-          # Scan recent git history for accidentally committed secrets.
-          # detect-secrets exits 0 even when it finds something, so the results
-          # are inspected explicitly instead of being discarded with `|| true`.
-          git log --all --pretty=format: -p -100 | \
-          detect-secrets scan --stdin \
-            --exclude-files 'configs/.*\.json' \
-            --exclude-files '\.md$' \
-            --exclude-files '\.baseline$' > history-scan.json
+          # detect-secrets 1.5 has no stdin mode, so the recent history is written to a
+          # file first. Baseline files, lock files and markdown are left out of the diff;
+          # a finding whose hash is already in .secrets.baseline is a known placeholder.
+          git log --all --pretty=format: -p -100 -- . ':!*.baseline' ':!*.lock' ':!*.md' > history.diff
+          detect-secrets scan --exclude-files 'configs/.*\.json' history.diff > history-scan.json
           python - history-scan.json <<'PY'
           import json, sys
+          known = {f.get("hashed_secret")
+                   for fs in json.load(open(".secrets.baseline")).get("results", {}).values()
+                   for f in fs}
           results = json.load(open(sys.argv[1])).get("results", {})
-          for path, findings in results.items():
-              for finding in findings:
-                  print(f"{path}:{finding.get('line_number')} {finding.get('type')}")
-          if results:
-              sys.exit("Secrets detected in git history")
-          print("No secrets detected in git history")
+          new = [(p, f.get("line_number"), f.get("type"))
+                 for p, fs in results.items() for f in fs
+                 if f.get("hashed_secret") not in known]
+          for path, line, kind in new:
+              print(f"{path}:{line} {kind}")
+          if new:
+              sys.exit("Secrets detected in git history that are not in the baseline")
+          print("No new secrets detected in git history")
           PY
 
       - name: Security scan summary

.github/workflows/security-scan.yaml

@@ -38,23 +38,25 @@ jobs:
 
       - name: Check for secrets in git history (last 100 commits)
         run: |
-          # Scan recent git history for accidentally committed secrets.
-          # detect-secrets exits 0 even when it finds something, so the results
-          # are inspected explicitly instead of being discarded with `|| true`.
-          git log --all --pretty=format: -p -100 | \
-          detect-secrets scan --stdin \
-            --exclude-files 'configs/.*\.json' \
-            --exclude-files '\.md$' \
-            --exclude-files '\.baseline$' > history-scan.json
+          # detect-secrets 1.5 has no stdin mode, so the recent history is written to a
+          # file first. Baseline files, lock files and markdown are left out of the diff;
+          # a finding whose hash is already in .secrets.baseline is a known placeholder.
+          git log --all --pretty=format: -p -100 -- . ':!*.baseline' ':!*.lock' ':!*.md' > history.diff
+          detect-secrets scan --exclude-files 'configs/.*\.json' history.diff > history-scan.json
           python - history-scan.json <<'PY'
           import json, sys
+          known = {f.get("hashed_secret")
+                   for fs in json.load(open(".secrets.baseline")).get("results", {}).values()
+                   for f in fs}
           results = json.load(open(sys.argv[1])).get("results", {})
-          for path, findings in results.items():
-              for finding in findings:
-                  print(f"{path}:{finding.get('line_number')} {finding.get('type')}")
-          if results:
-              sys.exit("Secrets detected in git history")
-          print("No secrets detected in git history")
+          new = [(p, f.get("line_number"), f.get("type"))
+                 for p, fs in results.items() for f in fs
+                 if f.get("hashed_secret") not in known]
+          for path, line, kind in new:
+              print(f"{path}:{line} {kind}")
+          if new:
+              sys.exit("Secrets detected in git history that are not in the baseline")
+          print("No new secrets detected in git history")
           PY
 
       - name: Security scan summary