feat(mcp): add Docker deployment and harden MCP tools

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @thib3113

.github/FUNDING.yml

@@ -1,12 +1,2 @@
-# These are supported funding model platforms
-
-github: thib3113  # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-#patreon: # Replace with a single Patreon username
-#open_collective: # Replace with a single Open Collective username
-#ko_fi: # Replace with a single Ko-fi username
-#tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-#community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-#liberapay: # Replace with a single Liberapay username
-#issuehunt: # Replace with a single IssueHunt username
-#otechie: # Replace with a single Otechie username
-custom: paypal.me/thib3113
+github: thib3113
+custom: https://paypal.me/thib3113

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,66 @@
+name: Bug report
+description: Report a reproducible bug
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. Do **not** use this form for security
+        vulnerabilities: see [SECURITY.md](https://github.com/thib3113/node-crowdsec/blob/main/SECURITY.md).
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What happened, and what did you expect instead?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Install ...
+        2. Configure ...
+        3. Run ...
+    validations:
+      required: true
+  - type: input
+    id: package
+    attributes:
+      label: Package
+      placeholder: crowdsec-client / crowdsec-http-middleware / crowdsec-client-scenarios / crowdsec-mcp
+    validations:
+      required: true
+  - type: input
+    id: package-version
+    attributes:
+      label: Package version
+    validations:
+      required: true
+  - type: input
+    id: node-version
+    attributes:
+      label: Node.js version
+      placeholder: "24"
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs
+      description: Remove secrets and personal data before pasting.
+      render: shell
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/thib3113/node-crowdsec/security/advisories/new
+    about: Please report security issues privately, not in a public issue.
+  - name: Guides and usage documentation
+    url: https://github.com/thib3113/node-crowdsec/wiki
+    about: Read the guides (authentication, bouncer/watcher setup, performance).
+  - name: API reference
+    url: https://thib3113.github.io/node-crowdsec/
+    about: Read the generated technical documentation.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,36 @@
+name: Feature request
+description: Suggest an improvement
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What are you trying to do, and what blocks you today?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+    validations:
+      required: false
+  - type: dropdown
+    id: package
+    attributes:
+      label: Package
+      options:
+        - crowdsec-client
+        - crowdsec-http-middleware
+        - crowdsec-client-scenarios
+        - crowdsec-mcp
+        - documentation
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+## What changed
+
+<!-- Describe the change and the motivation. -->
+
+## Affected packages
+
+- [ ] `crowdsec-client`
+- [ ] `crowdsec-http-middleware`
+- [ ] `crowdsec-client-scenarios`
+- [ ] `crowdsec-mcp`
+- [ ] docs / examples / CI
+
+## Checklist
+
+- [ ] Tests added or updated (`pnpm -F <package> test`)
+- [ ] Lint passes (`pnpm -F <package> lint`)
+- [ ] README / docs updated if behavior or configuration changed
+- [ ] `package.json` metadata updated if the public API changed
+- [ ] No secrets or credentials committed
+
+## Related issues
+
+Closes #

.github/workflows/build_and_test/action.yml → .github/actions/build_and_test/action.yml

@@ -25,23 +25,23 @@ runs:
   using: "composite"
   steps:
     - name: Install Node.js
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
       with:
         node-version: ${{ inputs.node-version }}
 
-    - uses: pnpm/action-setup@v6
+    - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
       name: Install pnpm
       id: pnpm-install
       with:
-        run_install: true
+        run_install: false
 
     - name: Get pnpm store directory
       id: pnpm-cache
       shell: bash
       run: |
-        echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+        echo "STORE_PATH=$(pnpm store path)" >> "$GITHUB_OUTPUT"
 
-    - uses: actions/cache@v6
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
       name: Setup pnpm cache
       with:
         path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
@@ -50,13 +50,12 @@ runs:
           ${{ runner.os }}-pnpm-store-
 
     - name: Install dependencies
-      run: pnpm install
+      run: pnpm install --frozen-lockfile
       shell: bash
 
     - name: run eslint
       run: npm run ci:eslint
       working-directory: ${{ inputs.package_path }}
-      continue-on-error: true
       shell: bash
       env:
         CI: true
@@ -87,7 +86,7 @@ runs:
       run: |
         echo "safe=$(echo '${{ inputs.node-version }}' | tr -c 'A-Za-z0-9._-' '_')" >> "$GITHUB_OUTPUT"
 
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       with:
         name: "coverage-${{ inputs.package_name }}-${{ steps.norm-node.outputs.safe }}"
         path: |
@@ -98,7 +97,7 @@ runs:
       if: ${{ inputs.check == 'true' }}
 
 
-    - uses: codecov/codecov-action@v7
+    - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
       with:
         token: ${{ inputs.CODECOV_TOKEN }}
         flags: ${{ inputs.package_name }}

.github/release.yml

@@ -0,0 +1,24 @@
+changelog:
+  exclude:
+    labels:
+      - ignore-for-release
+  categories:
+    - title: Breaking changes
+      labels:
+        - breaking
+    - title: Features
+      labels:
+        - enhancement
+        - feature
+    - title: Bug fixes
+      labels:
+        - bug
+    - title: Dependencies
+      labels:
+        - dependencies
+    - title: Documentation
+      labels:
+        - documentation
+    - title: Other changes
+      labels:
+        - "*"