diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..371218d
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,13 @@
+# CODEOWNERS for hawk-mcpkit
+* @GrayCodeAI/maintainers
+
+# SDK source
+/               @GrayCodeAI/core-team
+
+# CI / release / build tooling
+/.github/        @GrayCodeAI/devops-team
+/Makefile        @GrayCodeAI/devops-team
+/scripts/        @GrayCodeAI/devops-team
+
+# Documentation
+*.md             @GrayCodeAI/docs-team
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..bf1266f
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,118 @@
+name: Bug report
+description: Something is broken or behaving unexpectedly.
+title: "bug: <one-line summary>"
+labels: ["bug", "triage"]
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug report. Please fill in as much
+        of the form as you can — the more we know, the faster we can fix it.
+
+        Before submitting:
+        - Search [existing issues](https://github.com/GrayCodeAI/hawk-mcpkit/issues) to avoid duplicates.
+        - If this is a security issue, please **do not** file a public issue. See `SECURITY.md`.
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear, concise description of the bug.
+      placeholder: When I call mcpkit.New() and then s.ServeHTTP(), I expected X but got Y.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Surface
+      description: Which SDK surface is affected?
+      options:
+        - "Server construction (New)"
+        - "Tool registration (AddTool)"
+        - "Resource registration (AddResource, AddResourceTemplate, AddGraphResource)"
+        - "Prompt registration (AddPrompt)"
+        - "HTTP transport (ServeHTTP, ServeHTTPWithShutdown)"
+        - "Stdio transport (ServeStdio)"
+        - "Auth (RequireBearerToken, WithHTTPToken)"
+        - "Handler helpers (StrArg, JSONResult)"
+        - "Build / packaging"
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Minimal Go snippet that reliably reproduces the problem.
+      render: go
+      placeholder: |
+        s := mcpkit.New("my-server", "0.1.0")
+        // ... register tools ...
+        err := s.ServeHTTP(":8080")
+        // ^ wrong behaviour / panic / hang / etc.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What did you expect to happen instead?
+    validations:
+      required: true
+
+  - type: input
+    id: sdk-version
+    attributes:
+      label: hawk-mcpkit version
+      description: Contents of the VERSION file or `go list -m github.com/GrayCodeAI/hawk-mcpkit`.
+      placeholder: "0.1.0"
+    validations:
+      required: true
+
+  - type: input
+    id: go-version
+    attributes:
+      label: Go version
+      description: Output of `go version`.
+      placeholder: "go1.26.5"
+    validations:
+      required: true
+
+  - type: input
+    id: os
+    attributes:
+      label: Operating system
+      description: e.g. macOS 14.5 (arm64), Ubuntu 24.04 (amd64), Windows 11 (amd64).
+      placeholder: "macOS 14.5 (arm64)"
+    validations:
+      required: true
+
+  - type: textarea
+    id: deps
+    attributes:
+      label: Relevant dependency versions
+      description: |
+        Paste the output of `go list -m all | grep -E "mcp-go|mark3labs"`.
+      render: shell
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / traceback
+      description: |
+        Paste any relevant output, including the full error/stack trace.
+        **Redact API tokens, session IDs, and any private data first.**
+      render: shell
+
+  - type: checkboxes
+    id: confirm
+    attributes:
+      label: Confirmation
+      options:
+        - label: I searched existing issues and did not find a duplicate.
+          required: true
+        - label: I redacted any secrets, tokens, or private data from logs.
+          required: true
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..d318cc0
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/GrayCodeAI/hawk-mcpkit/security/advisories/new
+    about: Please report security issues privately via a GitHub Security Advisory. See SECURITY.md.
+  - name: Question / discussion
+    url: https://github.com/GrayCodeAI/hawk/discussions
+    about: Have a question or want to discuss an idea? Open a discussion on the hawk repo.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..0599609
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,75 @@
+name: Feature request
+description: Suggest an improvement or a new SDK capability.
+title: "feat: <one-line summary>"
+labels: ["enhancement", "triage"]
+
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for proposing a feature. hawk-mcpkit is a thin Go wrapper
+        around `mark3labs/mcp-go` that provides construction, transports, and
+        handler helpers for the hawk ecosystem. Every feature is evaluated
+        against whether it serves **a single developer** building an MCP
+        server — i.e. it improves ergonomics, lowers boilerplate, or simplifies
+        integration.
+
+        Before submitting:
+        - Search [existing issues](https://github.com/GrayCodeAI/hawk-mcpkit/issues) to avoid duplicates.
+        - This repo must never import hawk-eco dependencies. If your feature
+          requires a hawk-ecosystem type, it belongs in the consuming engine.
+
+  - type: dropdown
+    id: kind
+    attributes:
+      label: Kind of feature
+      description: What flavour of change is this?
+      options:
+        - "New server constructor option"
+        - "New transport (e.g. Unix socket, WebSocket)"
+        - "New handler helper (e.g. StrArg variant, JSONResult option)"
+        - "Auth / security (token gating, rate limiting)"
+        - "Resource / graph resource helper"
+        - "Tool / prompt registration helper"
+        - "Error handling / typed errors"
+        - "Tooling / CI / docs / packaging"
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the user problem first. Solutions can come later.
+      placeholder: When I build an MCP server with mcpkit, I have to write boilerplate Y because the SDK doesn't expose X.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: How would you like the SDK to behave? Snippet of API you'd want.
+      render: go
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: |
+        What did you try? What do other MCP Go libraries (`mark3labs/mcp-go`,
+        `modelcontextprotocol/go-sdk`, `fifty-shades-of-go/mcp`) do? Why
+        isn't that enough?
+
+  - type: checkboxes
+    id: principles
+    attributes:
+      label: Foundation-layer fit
+      description: hawk-mcpkit avoids hawk-eco scope. Confirm this feature respects that.
+      options:
+        - label: Works with zero configuration (sensible defaults).
+        - label: Does not introduce a hawk-eco dependency.
+        - label: Does not break wire-compatibility with existing MCP clients.
+        - label: Has an escape hatch (override via parameter or option).
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..7ac5094
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,67 @@
+<!--
+  Thanks for your contribution! Please fill out this template so reviewers can
+  understand the change quickly. Anything that does not apply can be left in
+  place; do not delete unanswered sections — write "n/a".
+-->
+
+## Summary
+
+<!--
+  One paragraph describing what this PR does and why. Link the related
+  issue(s) with `Fixes #N` or `Refs #N` if applicable.
+-->
+
+## Changes
+
+<!--
+  Bullet list of what changed, grouped by area (server, transport, auth,
+  helpers, types, version, CI, docs).
+  Reviewers should be able to skim this and know what to look at first.
+-->
+
+-
+
+## API impact
+
+<!--
+  Did you add, remove, rename, or change the signature of any exported
+  symbol? List them here. If yes, confirm whether this is a breaking
+  change and bump the version accordingly in `VERSION`. If no exported
+  surface changed, write "n/a".
+-->
+
+## Ecosystem boundary check
+
+<!--
+  hawk-mcpkit must never import hawk-eco dependencies. Confirm this PR
+  does not add any imports of `hawk`, `eyrie`, `yaad`, `tok`, `trace`,
+  `sight`, `inspect`, `hawk-core-contracts`, or any SDK.
+-->
+
+## Testing
+
+<!--
+  Describe how you tested. Paste output of `make test` and `make lint`.
+  If you added new tests, list them.
+-->
+
+```text
+$ make test
+...
+$ make lint
+...
+$ make boundaries
+...
+```
+
+## Checklist
+
+- [ ] Commits follow [Conventional Commits](https://www.conventionalcommits.org/)
+      (`feat:`, `fix:`, `perf:`, `refactor:`, `docs:`, `test:`, etc.)
+- [ ] `make ci` passes locally
+- [ ] `make boundaries` passes (no hawk-eco imports)
+- [ ] New or changed code has tests
+- [ ] Public APIs have doc comments
+- [ ] `CHANGELOG.md` updated under `## [Unreleased]` if user-visible
+- [ ] `VERSION` file is **not** edited manually — release-please bumps it
+- [ ] No secrets, tokens, or PII added to the repo
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..be2fec5
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,117 @@
+# Contributing to hawk-mcpkit
+
+Thanks for your interest! This guide covers the conventions used across the
+hawk-eco. The eco-wide standards (versioning, release tooling, repo layout)
+are defined in <https://github.com/GrayCodeAI/hawk/blob/main/VERSIONING.md>.
+
+## Quick start
+
+1. Fork the repo and create a feature branch off `main`:
+   ```bash
+   git checkout -b feat/short-description
+   ```
+2. Make your changes in small, focused commits.
+3. Run the full local check before pushing:
+   ```bash
+   make ci
+   ```
+4. Open a pull request. CI will re-run the same checks plus security
+   scanning and race-detector tests.
+
+## Build & test
+
+This repo uses the standardised hawk-eco Makefile targets. Run `make help`
+for the full list. The most common targets:
+
+| Target              | What it does                                     |
+| ------------------- | ------------------------------------------------ |
+| `make build`        | Build the binary / verify the library compiles  |
+| `make test`         | Run unit tests                                   |
+| `make test-race`    | Run unit tests with the race detector            |
+| `make cover`        | Generate a coverage report                       |
+| `make lint`         | Run the linter (`golangci-lint`)                 |
+| `make fmt`          | Format source files                              |
+| `make vet`          | Run `go vet`                                     |
+| `make security`     | Run `govulncheck`                                |
+| `make boundaries`   | Enforce ecosystem boundary rules                 |
+| `make ci`           | Run everything CI runs (the gate before pushing) |
+
+## Commit message convention
+
+We use [Conventional Commits](https://www.conventionalcommits.org/). This
+isn't cosmetic — release-please reads commit messages to bump the `VERSION`
+file and generate the CHANGELOG, so getting them right matters.
+
+```
+<type>(<optional scope>): <short summary>
+
+<optional body>
+
+<optional footer(s)>
+```
+
+**Types:**
+
+- `feat:` — a new feature (triggers a minor version bump)
+- `fix:` — a bug fix (triggers a patch version bump)
+- `perf:` — performance improvement
+- `refactor:` — code restructure with no behaviour change
+- `docs:` — documentation only
+- `test:` — adding or fixing tests
+- `build:` — build system or dependencies
+- `ci:` — CI configuration
+- `chore:` — anything else (no release effect)
+- `revert:` — reverts a previous commit
+
+**Breaking changes:** add `!` after the type/scope or include `BREAKING
+CHANGE:` in the footer. This triggers a major version bump.
+
+## Ecosystem boundaries
+
+hawk-mcpkit is a **foundation repo** — it must never import `hawk`, any
+engine (`eyrie`, `yaad`, `tok`, `trace`, `sight`, `inspect`), any SDK, or
+`hawk-core-contracts`. Its only non-stdlib dependency is upstream
+`mark3labs/mcp-go`. Run `make boundaries` (also run in CI) to verify.
+
+If you need a hawk-ecosystem type here, that's a sign it belongs in the
+consuming engine instead, not in this repo.
+
+## Pull request checklist
+
+Before requesting review:
+
+- [ ] `make ci` passes locally.
+- [ ] New behaviour has tests; bug fixes have a regression test.
+- [ ] `make boundaries` passes (no hawk-eco imports).
+- [ ] `CHANGELOG.md` entries are **not** edited manually — release-please
+      generates them from your commit messages.
+- [ ] The `VERSION` file is **not** edited manually — release-please bumps
+      it on release.
+- [ ] Public API changes have updated doc comments.
+- [ ] No secrets, API keys, or PII in code, comments, tests, or fixtures.
+
+## Code review etiquette
+
+- Reviewers focus on correctness, design, and tests; formatting is
+  enforced by tooling, not humans.
+- Authors respond to every comment (resolved, addressed, or politely
+  declined with rationale) — no silent dismissals.
+- Squash-merge by default; the PR title becomes the commit (so it must
+  be a valid Conventional Commit message).
+- One approving review from a CODEOWNERS-listed reviewer is required.
+
+## Reporting bugs
+
+Open an issue using the bug-report template. Include the
+`hawk-mcpkit` version (`VERSION` file), reproduction steps, expected
+behaviour, and actual behaviour.
+
+## Reporting security issues
+
+**Do not open a public issue.** See [SECURITY.md](./SECURITY.md) for
+private reporting channels.
+
+## License
+
+By contributing, you agree that your contributions will be licensed under
+the same license as this repo (see [LICENSE](./LICENSE)).
diff --git a/SECURITY.md b/SECURITY.md
index 5744c34..17c5fce 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -45,16 +45,12 @@ We follow [coordinated vulnerability disclosure](https://en.wikipedia.org/wiki/C
 ## Security practices in this repo
 
 - **Dependency monitoring:** vulnerable dependencies are detected by
-  `govulncheck`, which runs on every CI build (see "Vulnerability scanning").
-- **Static analysis:** `golangci-lint` / `ruff` / `mypy` enforced in CI.
-- **Vulnerability scanning:** `govulncheck` (Go) / `pip-audit` (Python) run
-  on every CI build.
-- **Lockfiles:** `go.sum` / `pnpm-lock.yaml` / `pyproject.toml` are pinned
-  and committed.
-- **Reproducible builds:** release artefacts ship with SHA-256 checksums via
-  goreleaser.
-- **No secrets in source:** API keys are configuration, not constants. Pre-
-  commit hooks block accidental secret commits.
+  `govulncheck`, which runs on every CI build (see `.github/workflows/ci.yml`).
+- **Static analysis:** `golangci-lint` is enforced in CI.
+- **Vulnerability scanning:** `govulncheck` runs on every CI build.
+- **Secret detection:** `trufflehog` runs on every CI build.
+- **Reproducible builds:** the library is built with `go build`.
+- **No secrets in source:** API keys are configuration, not constants.
 
 ## Scope
 
@@ -62,8 +58,7 @@ This policy covers the code in this repository and the release artefacts
 published from it. It does not cover:
 
 - Third-party dependencies (report to upstream).
-- LLM provider services that hawk-mcpkit integrates with (report to the
-  provider).
+- LLM provider services (report to the provider).
 - Local filesystem misuse where an attacker already has shell access (out of
   threat model).