docs: Apply million-dollar repo standardization (Security, Conduct, Templates)

Author: EngineerAbdullahBinZafar

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+## Description
+<!-- Describe your changes in detail. Include what problem it solves and how it solves it. -->
+
+## Motivation and Context
+<!-- Why is this change required? What issue does it resolve? -->
+<!-- If it fixes an open issue, please link to the issue here. -->
+
+## Safety & Sandbox
+<!-- For any tool that writes to ROS2 (topics, parameters, nodes): -->
+- [ ] This tool respects the `CommandSandbox` (checks `check_publish` / `check_set_parameter`).
+- [ ] This change maintains the strict `SAFETY_LEVEL=safe_write` default.
+
+## Testing
+<!-- Describe how you tested your changes (e.g., simulation mode, on a real Jetson). -->
+- [ ] All tests pass locally (`python run_tests.py`).
+- [ ] I have added new tests covering my changes.
+- [ ] My code passes the `ruff` linter checks.
+
+## Types of changes
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] Documentation update

CODE_OF_CONDUCT.md

@@ -0,0 +1,21 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall community
+
+## Enforcement
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.

CONTRIBUTING.md

@@ -0,0 +1,27 @@
+# Contributing to `ros2-mcp-server`
+
+First off, thank you for considering contributing to `ros2-mcp-server`! We welcome all contributions, from bug reports and documentation fixes to major feature additions.
+
+## Local Development & Instant Playground
+
+You do **not** need a physical robot or a complex ROS2 installation to develop for this repository.
+We have built a robust simulation layer that generates synthetic LiDAR, IMU, and Battery data.
+
+To test your code locally:
+```bash
+python -m venv venv
+source venv/bin/activate  # On Windows: venv\Scripts\activate
+pip install -e .
+python ros2_mcp/server.py --demo-sim
+```
+
+## Pull Request Process
+
+1. **Fork & Branch**: Fork the repository and create a descriptive branch name (e.g. `feat/new-mcp-tool`).
+2. **Strict Linting**: We use `ruff` to ensure absolute codebase integrity. Before committing, run:
+   ```bash
+   python -m ruff check . --fix
+   python -m ruff format .
+   ```
+3. **Tests**: Ensure the 38-test suite passes via `python run_tests.py`.
+4. **Submit PR**: Use our provided PR template to explain your changes. We will review your PR within 2-3 business days.

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Threat Model: AI & Physical Hardware
+
+Bridging an autonomous AI agent to physical robotics introduces unique attack vectors:
+1. **Hallucinated Commands**: The LLM predicts a valid-looking but physically catastrophic command (e.g., publishing `velocity = 100 m/s`).
+2. **Infinite Loops**: The LLM traps itself in a read-publish loop.
+3. **Malicious Payloads**: Injection of malformed ROS2 parameters leading to buffer overflows in C++ nodes.
+
+## The Command Sandbox
+
+To mitigate this, `ros2-mcp-server` enforces a strict permission boundary.
+We implement three safety levels via the `SAFETY_LEVEL` environment variable:
+
+- **`read_only` (Default)**: The AI can list nodes, read topics, and fetch diagnostics, but it **cannot** publish, tune PIDs, or alter parameters.
+- **`safe_write`**: The AI can read data and invoke safely allowlisted tuning tools (like PID tuning or parameter adjustment on safe namespaces). Direct publishing to actuator nodes is blocked.
+- **`full`**: Unrestricted access. *Only use this in a simulated environment.*
+
+## Reporting a Vulnerability
+
+If you discover a sandbox escape or a crash loop vulnerability, please do **NOT** create a public GitHub issue.
+Instead, email us at `abz.king.1.9.2003@gmail.com` with the subject `[SECURITY] ROS2 MCP Server`. We will respond within 48 hours.