Dependabot proposed mcp 1.28.1 → 2.0.0 in #256. It is a breaking release, and the migration is its own piece of work rather than a dependency bump.
What 2.0 changes, from the failing type check
| symptom |
meaning |
"Server" expects between 0 and 1 type arguments, but 2 given |
the second type parameter is gone |
"Server[Any]" has no attribute "list_tools" / call_tool |
the decorator-factory registration surface moved |
"Server[Any]" has no attribute "request_context" |
per-request context is reached differently |
Unexpected keyword argument "inputSchema" for "Tool"; did you mean "input_schema"? |
the schema field was renamed |
Need more than 2 values to unpack (3 expected) |
streamable_http_client returns two values, not three |
Ten call sites across src/korvid/mcp/server.py, tests/mcp/test_server.py and tests/ui/test_mcp_ui_context.py.
Why it is not being done as part of the bump
The rename and the unpack change are mechanical, but Server.request_context and the registration surface are not — they decide how a call reaches the UI bridge, which is where the approval gate lives. That is exactly the code that must not be migrated by guesswork.
Deferred rather than rushed: mcp ships in the optional [mcp] extra, so 1.28.1 is what users install today and nothing regresses by waiting.
Scope
- Migrate the registration surface and per-request context.
inputSchema → input_schema.- Fix the two-value
streamable_http_client unpacking in both test modules.
- Re-verify the security invariants the MCP path carries: the approval gate, the masking pipeline, and the DNS-rebinding/Origin checks in
tests/mcp/test_server.py.
- Remove the
mcp major-version ignore from .github/dependabot.yml in the same change.
Acceptance
uv sync --locked --dev --all-extras resolves with mcp>=2, mypy is clean, and the full MCP test module passes unchanged in intent — no assertion weakened to accommodate the new API.
Dependabot proposed
mcp1.28.1 → 2.0.0 in #256. It is a breaking release, and the migration is its own piece of work rather than a dependency bump.What 2.0 changes, from the failing type check
"Server" expects between 0 and 1 type arguments, but 2 given"Server[Any]" has no attribute "list_tools"/call_tool"Server[Any]" has no attribute "request_context"Unexpected keyword argument "inputSchema" for "Tool"; did you mean "input_schema"?Need more than 2 values to unpack (3 expected)streamable_http_clientreturns two values, not threeTen call sites across
src/korvid/mcp/server.py,tests/mcp/test_server.pyandtests/ui/test_mcp_ui_context.py.Why it is not being done as part of the bump
The rename and the unpack change are mechanical, but
Server.request_contextand the registration surface are not — they decide how a call reaches the UI bridge, which is where the approval gate lives. That is exactly the code that must not be migrated by guesswork.Deferred rather than rushed:
mcpships in the optional[mcp]extra, so 1.28.1 is what users install today and nothing regresses by waiting.Scope
inputSchema→input_schema.streamable_http_clientunpacking in both test modules.tests/mcp/test_server.py.mcpmajor-version ignore from.github/dependabot.ymlin the same change.Acceptance
uv sync --locked --dev --all-extrasresolves withmcp>=2,mypyis clean, and the full MCP test module passes unchanged in intent — no assertion weakened to accommodate the new API.