fix: require gql 4 and fastmcp 3.2 for mythic-c2 capabilities (ENG-8860)

[briangreunke]

Summary

mythic-c2-readonly capped gql at <4.0. gql 3 needs websockets<12, which forced uv to resolve fastmcp 2.12.5 and mcp 1.16.0. Black Duck flagged both (fastmcp: 1 critical, 3 high; mcp: 3 high).

• Drop the gql <4.0 cap in the four mythic-c2-readonly script headers. The new spec is gql[aiohttp,websockets]>=4.0.
• Require fastmcp>=3.2.0 in mythic-c2-readonly/mcp/server.py, test_server.py, and in mythic-c2/mcp_server.py and test_mcp.py.
• Copy the _patch_mythic_for_gql4() shim from mythic-c2/lib/mythic_api.py into mythic-c2-readonly/mcp/server.py and skills/.../scripts/mythic_read.py. mythic 0.2.x get_operation_name raises AttributeError on gql 4 GraphQLRequest. Capabilities cannot share code (ENG-7049), so this is a copy.
• Add TestGqlOperationName to both readonly test files. It checks the shimmed get_operation_name with a gql 4 GraphQLRequest and a plain DocumentNode.
• test_server.py: switch mcp.get_tools() to mcp.list_tools(). fastmcp 4 removed get_tools.
• Bump mythic-c2-readonly 1.0.0 → 1.0.1 and mythic-c2 2.1.0 → 2.1.1.

Linear: ENG-8860

Acceptance evidence (Python 3.13)

• uv tree --script capabilities/mythic-c2-readonly/mcp/server.py --depth 1: fastmcp 4.1.0, gql 4.4.0, mythic 0.2.6
• uv tree --script capabilities/mythic-c2/mcp_server.py --depth 1: fastmcp 4.1.0, mythic 0.2.6
• uv run capabilities/mythic-c2-readonly/mcp/test_server.py: 27 passed
• uv run capabilities/mythic-c2-readonly/skills/mythic-c2-readonly/scripts/test_mythic_read.py: 54 passed
• uv run capabilities/mythic-c2/test_mcp.py: 16 passed

Regression evidence

• just validate strict=true: 26 validated, 0 failed. The 6 warnings are missing tool binaries in other capabilities.
• pre-commit run --files <changed paths>: all hooks pass

Notes

• Most of the line churn in server.py, mythic_read.py, and the two readonly test files is ruff-format output. Those files already fail ruff format --check (ruff 0.8.6) on origin/main, and the pre-commit hook rewrites them on any edit. The churn is whitespace and line wrapping only.
• mythic resolves to 0.2.6, the newest stable release compatible with gql 4. This follows the ticket's decision to reject prereleases.
• Unmet criteria or waivers: none

Scope

Base main@ac4420c7ff446b445f3e1340ab07ff1fb32af8ba, head f5f37526e0492d0db67c098cc7a11906b30850e9. 8 files, matching the ticket scope:

• capabilities/mythic-c2-readonly/{capability.yaml, mcp/server.py, mcp/test_server.py}
• capabilities/mythic-c2-readonly/skills/mythic-c2-readonly/scripts/{mythic_read.py, test_mythic_read.py}
• capabilities/mythic-c2/{capability.yaml, mcp_server.py, test_mcp.py}

🤖 Generated with Claude Code

[briangreunke]

Automated agent review

This review was run by an agent. It is not a human approval.

Verdict: APPROVE (no blocking findings)
Base: main@ac4420c7ff446b445f3e1340ab07ff1fb32af8ba
Head: f5f37526e0492d0db67c098cc7a11906b30850e9

• R1–R6 each map to changed lines. The diff touches only the 8 files in the ticket scope. The extra churn is ruff-format output and does not change behavior.
• uv tree --script resolves fastmcp 4.1.0 and gql 4.4.0 for mythic-c2-readonly/mcp/server.py, gql 4.4.0 for mythic_read.py, and fastmcp 4.1.0 for mythic-c2/mcp_server.py (Python 3.13).
• Tests: test_server.py 27 passed, test_mythic_read.py 54 passed (both include the R6 GraphQLRequest and DocumentNode cases), mythic-c2/test_mcp.py 16 passed.
• just validate strict=true: 0 failed.
• Shim check against mythic 0.2.6: graphql_post and graphql_subscription look up get_operation_name as a module global, so the patch reaches the real call sites. gql 4.4.0 still accepts mythic's variable_values= and operation_name= kwargs.
• Not tested: a live Mythic instance. The ticket does not require one.
• CI on head: 5/5 pass.