[atrearyan]

Summary

Modernizes the codebase to Python >=3.11 typing syntax as described in #344: PEP 585 built-in generics, PEP 604 X | Y unions, typing.Self where it applies, and consistent python_requires / classifiers.

The issue suggests one PR per package. This PR keeps that split as one commit per package, so it can be reviewed commit by commit, and I'm happy to break it into separate PRs if you prefer:

Commit	Package	Files
1	server/gti	10
2	server/secops	29
3	server/scc	3
4	server/secops-soar (core)	8
5	server/secops-soar/secops_soar_mcp/marketplace (generated)	294
6	run-with-google-adk	11

One deliberate exception: typing.Dict on tool return annotations

FastMCP (mcp 1.10 through 1.30) only builds an unwrapped <tool>DictOutput schema when a tool's return annotation is a built-in dict[...] (types.GenericAlias). typing.Dict[str, X] takes a different path and gets the wrapped {"result": ...} schema, and bare dict gets no outputSchema at all. Converting these annotations would therefore change outputSchema and the shape of structuredContent returned to clients for 62 tools (12 gti, 44 secops, 6 scc), and remove outputSchema from get_collection_mitre_tree.

To keep schemas unchanged, those 62 return annotations stay typing.Dict with # noqa: UP006 - typing.Dict keeps FastMCP {"result": ...} outputSchema (plus # noqa: UP035 on the matching import). Everything else is converted. A new gti test pins the wrapped schema so a future ruff --fix cannot silently change it. Upstream python-sdk is changing this check for mcp 2.x, so these markers should be removed together with an mcp 2.x upgrade.

Other changes

• server/gti: except (asyncio.TimeoutError, TimeoutError) becomes except TimeoutError (they are the same class on 3.11+).
• run-with-google-adk: the settings validator returns typing.Self; the typer floor is raised to >=0.12.4, because earlier versions cannot build CLI commands with X | None parameters.
• python_requires=">=3.11" added to the four setup.py files, and 3.12/3.13/3.14 classifiers added to the four server pyproject.toml files.
• No from __future__ import annotations was added anywhere, and nullable tool parameters keep X | None = None.

Testing

• For every package, list_tools() output (inputSchema, outputSchema, descriptions) was compared before and after: byte-identical for all 2,258 tools (gti 36, secops 70, scc 6, SOAR core 17, marketplace 2,123, ADK sample servers 6).
• call_tool() round-trips with mocked backends return identical structuredContent, including explicit null arguments.
• pytest, on Python 3.11 through 3.14:
  • gti: 73 passed.
  • secops: 51 passed, plus 54 integration tests that need a live tests/config.json, unchanged from main.
  • secops-soar: 11 passed.
  • run-with-google-adk: 44 passed.
• scc has no test suite. A smoke test of list_tools() and call_tool() matched main.
• The ADK typer CLI options, FastAPI OpenAPI schema, and AgentSettings JSON schema are identical before and after.

Notes for reviewers

• Commit 5 is mechanical. It can be reproduced with ruff check --isolated --target-version py311 --select UP006,UP007,UP035,UP045 --fix plus removing the unused names from each from typing import line. The marketplace modules are generated outside this repo, so the generator should be updated to match.
• Tool docstrings that mention Optional[str] / List[str] were left unchanged, because they become the tool descriptions clients see.
• Out of scope and unchanged: datetime.timezone.utc to datetime.UTC (21 places). Bugs that already exist on main, which I can open separately:
  • Some tool parameters typed str = None (scc, a few secops tools, and the marketplace) reject an explicit null, as fixed for gti in fix(gti): accept explicit null for parameters that default to None #323.
  • The --integrations loader cannot import the four marketplace modules with dots in their filenames.
• Likely merge conflicts: chore(scc): bump version to 0.2.0, fix SetMuteRequest, and add unit test suite #300 (scc setup.py), refactor(servers): replace wildcard imports with explicit exports and enforce tool import checks in CI #328 (secops server.py imports), and feat(secops): add SIEM dashboard MCP tools (native, scheduled reports, Content Hub, legacy Looker and SOAR) #331 (secops utils.py).

Closes #344