diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c0bf3ed
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      npm:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/ai-selection-goldens.yml b/.github/workflows/ai-selection-goldens.yml
index 93dabb9..10683e6 100644
--- a/.github/workflows/ai-selection-goldens.yml
+++ b/.github/workflows/ai-selection-goldens.yml
@@ -32,16 +32,19 @@ on:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/benchmark-regression.yml b/.github/workflows/benchmark-regression.yml
index e5543f2..6757346 100644
--- a/.github/workflows/benchmark-regression.yml
+++ b/.github/workflows/benchmark-regression.yml
@@ -10,6 +10,9 @@ on:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
+permissions:
+  contents: read
+
 jobs:
   universal-benchmark:
     runs-on: ubuntu-latest
@@ -21,10 +24,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -60,7 +63,7 @@ jobs:
 
       - name: Upload benchmark report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: universal-benchmark-report-py${{ matrix.python-version }}
           path: ./.tmp/universal-benchmark/universal-route-report.json
diff --git a/.github/workflows/integration-smoke.yml b/.github/workflows/integration-smoke.yml
index 4e03290..c38ca05 100644
--- a/.github/workflows/integration-smoke.yml
+++ b/.github/workflows/integration-smoke.yml
@@ -7,6 +7,7 @@ on:
       - "bundle/**"
       - "fixtures/frame-shadow-parity/**"
       - "python/**"
+      - "tests/**"
       - "scripts/check_integration_smoke.py"
       - "scripts/release_bundle.py"
       - "package.json"
@@ -22,6 +23,7 @@ on:
       - "bundle/**"
       - "fixtures/frame-shadow-parity/**"
       - "python/**"
+      - "tests/**"
       - "scripts/check_integration_smoke.py"
       - "scripts/release_bundle.py"
       - "package.json"
@@ -34,6 +36,9 @@ on:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
+permissions:
+  contents: read
+
 jobs:
   integration-smoke:
     runs-on: ubuntu-latest
@@ -41,15 +46,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.11"
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: "24"
           cache: "npm"
@@ -57,6 +62,9 @@ jobs:
       - name: Install Node dependencies
         run: npm ci --ignore-scripts
 
+      - name: Run unit tests
+        run: python3 -m unittest discover -s tests
+
       - name: Run integration smoke
         run: python3 scripts/check_integration_smoke.py
 
diff --git a/.github/workflows/mcp-registry.yml b/.github/workflows/mcp-registry.yml
index b287557..04a8373 100644
--- a/.github/workflows/mcp-registry.yml
+++ b/.github/workflows/mcp-registry.yml
@@ -19,10 +19,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: "24"
           cache: "npm"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a498249..1bd6f7c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -20,10 +20,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
@@ -60,10 +60,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.11"
 
@@ -74,4 +74,4 @@ jobs:
         run: python -m build
 
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5a2655b..29d1fd4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,15 +17,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.11"
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: "24"
 
@@ -33,7 +33,7 @@ jobs:
         run: python3 scripts/release_bundle.py
 
       - name: Upload release assets
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           files: |
             dist/source-first-clone-bundle.tar.gz
diff --git a/.github/workflows/remote-mcp-smoke.yml b/.github/workflows/remote-mcp-smoke.yml
index 6b081c6..fabcfcb 100644
--- a/.github/workflows/remote-mcp-smoke.yml
+++ b/.github/workflows/remote-mcp-smoke.yml
@@ -18,18 +18,24 @@ on:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
+permissions:
+  contents: read
+
 jobs:
   smoke:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: "24"
 
+      - name: Run remote MCP unit tests
+        run: npm --prefix deploy/vercel-mcp test
+
       - name: Run remote MCP smoke
         run: npm run check:remote-mcp:local
diff --git a/deploy/vercel-mcp/package.json b/deploy/vercel-mcp/package.json
index f55c407..2bc6084 100644
--- a/deploy/vercel-mcp/package.json
+++ b/deploy/vercel-mcp/package.json
@@ -5,6 +5,6 @@
   "type": "module",
   "scripts": {
     "smoke": "node ./scripts/smoke.mjs",
-    "test": "node --test test/"
+    "test": "node --test"
   }
 }