chore(deps): update dependency mcp to v2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mcp	>= 1.25.0, < 2.0.0 → >=2.0.0, <2.1.0

---

Release Notes

modelcontextprotocol/python-sdk (mcp)

v2.0.0

Compare Source

MCP Python SDK v2 Stable Release

This is v2.0.0, the stable v2 release of the MCP Python SDK. It supports the 2026-07-28 revision of the Model Context Protocol and serves every earlier revision from the same server. pip install mcp now installs 2.x.

pip install "mcp[cli]"

# or
uv add "mcp[cli]"

Documentation Rewrite

The documentation has the full tutorial and API reference. Coming from v1? What's new in v2 is the tour of what changed and why, and the migration guide lists every breaking change with before-and-after code.

V1 Maintenance mode

v1.x is in maintenance mode and will only receive security fixes from now on The 1.x line lives on the v1.x branch, continues to receive critical bug fixes and security patches, and is documented at https://py.sdk.modelcontextprotocol.io/v1/. If your project is not ready to migrate, keep a <2 upper bound on your requirement (for example mcp>=1.28,<2).

Highlights

One SDK, both protocol eras

v2 speaks the 2026-07-28 revision (stateless requests with no handshake, server/discover, subscriptions/listen, multi-round-trip requests) and still serves every 2025-era client from the same MCPServer, over Streamable HTTP and stdio, with nothing to configure. Client(target) negotiates the version automatically.

FastMCP is now MCPServer, and there is a first-class Client

The decorator API is unchanged; the low-level Server is rebuilt around a shared dispatcher engine, and one Client object replaces v1's transport-plus-ClientSession-plus-initialize() layering. It connects to a URL, a stdio subprocess, a custom transport, or straight to a server object in memory for tests.

Multi-round-trip requests and resolver dependency injection

At 2026-07-28 the server can no longer call the client, so tools return the question instead. A Resolve(fn) parameter is filled by your function invisibly to the model and can put a question to the user; one tool body serves both eras.

Extension APIs, OpenTelemetry, and a standalone types package

Servers and clients compose protocol extensions through pluggable extension APIs (MCP Apps built in); OpenTelemetry tracing ships on by default; every protocol type is its own package, mcp-types (imported as mcp_types), published in lock-step with mcp.

Hardened stdio and auth

stdio servers keep handler subprocesses and stray prints off the wire, and stdout is diverted to stderr while serving. OAuth adds RFC 9207 issuer validation, the SEP-990 identity-assertion flow, and the client-credentials extension.

Coming from a v2 pre-release

Since the last release candidate: the per-version wire packages are private (mcp_types._v*), mcp.types is a permanent alias for mcp_types, the auth registration request model is split from the registered-client record, cancelled requests are no longer answered, and log notifications are gated on the per-request log-level opt-in at 2026-07-28. Since the betas: Client(cache=False) is now cache=None with CacheConfig() the default; Context.client_id, RFC7523OAuthClientProvider, and OAuthClientProvider(timeout=) are removed; the client-credentials providers take scope=; message_handler receives notifications and exceptions only; FileResource(is_binary=) becomes encoding; MCP_* env vars are gone with pydantic-settings; Streamable HTTP servers reject bodies over 4 MiB with HTTP 413. The migration guide covers all of it.

Known gaps

The tasks extension (SEP-2663) is not part of this release. On the client, the DPoP proof binding (SEP-1932) and the workload-identity jwt-bearer grant are not implemented; both are additive and can land in 2.x.

Feedback

Something rough, confusing, or broken? Open an issue or find us in #python-sdk-dev on the MCP Contributors Discord.

Full Changelog: modelcontextprotocol/python-sdk@v2.0.0rc1...v2.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: uv.lock

Command failed: uv lock --upgrade-package mcp
Using CPython 3.14.6 interpreter at: /opt/containerbase/tools/python/3.14.6/bin/python3
  × No solution found when resolving dependencies for split (markers:
  │ python_full_version >= '3.14' and sys_platform == 'win32'):
  ╰─▶ Because fastmcp-slim[full]<=3.3.0b1 depends on mcp>=1.24.0,<2.0 and
      fastmcp==3.3.0b1 depends on fastmcp-slim[full]==3.3.0b1, we can conclude
      that fastmcp==3.3.0b1 depends on mcp>=1.24.0,<2.0. (1)

      Because fastmcp-slim[client]>=3.3.0b2,<=3.4.5 depends
      on mcp>=1.24.0,<2.0 and fastmcp==3.3.0b2 depends on
      fastmcp-slim[client]==3.3.0b2, we can conclude that fastmcp==3.3.0b2
      depends on mcp>=1.24.0,<2.0.
      And because we know from (1) that fastmcp==3.3.0b1 depends on
      mcp>=1.24.0,<2.0, we can conclude that fastmcp>=3.3.0b1,<=3.3.0b2
      depends on mcp>=1.24.0,<2.0.
      And because fastmcp>=3.0.0,<=3.2.4 depends on mcp>=1.24.0,<2.0, we can
      conclude that fastmcp>=3.0.0,<=3.3.0b2 depends on mcp>=1.24.0,<2.0. (2)

      Because fastmcp-slim[client]>=3.3.0,<=3.4.5 depends on mcp>=1.24.0,<2.0
      and fastmcp==3.4.0b1 depends on fastmcp-slim[client]==3.4.0b1, we can
      conclude that fastmcp==3.4.0b1 depends on mcp>=1.24.0,<2.0.
      And because we know from (2) that fastmcp>=3.0.0,<=3.3.0b2 depends on
      mcp>=1.24.0,<2.0, we can conclude that all of:
          fastmcp>=3.0.0,<=3.3.0b2
          fastmcp==3.4.0b1
      depend on mcp>=1.24.0,<2.0. (3)

      Because all of:
          fastmcp-slim[client]>=3.3.0,<=3.3.1
          fastmcp-slim[client]>=3.4.0,<=3.4.5
      depend on mcp>=1.24.0,<2.0 and fastmcp==3.3.0 depends on
      fastmcp-slim[client]==3.3.0, we can conclude that fastmcp==3.3.0 depends
      on mcp>=1.24.0,<2.0.
      And because we know from (3) that all of:
          fastmcp>=3.0.0,<=3.3.0b2
          fastmcp==3.4.0b1
      depend on mcp>=1.24.0,<2.0, we can conclude that all of:
          fastmcp>=3.0.0,<=3.3.0
          fastmcp==3.4.0b1
      depend on mcp>=1.24.0,<2.0. (4)

      Because all of:
          fastmcp-slim[client]==3.3.1
          fastmcp-slim[client]>=3.4.0,<=3.4.5
      depend on mcp>=1.24.0,<2.0 and fastmcp==3.3.1 depends on
      fastmcp-slim[client]==3.3.1, we can conclude that fastmcp==3.3.1 depends
      on mcp>=1.24.0,<2.0.
      And because we know from (4) that all of:
          fastmcp>=3.0.0,<=3.3.0
          fastmcp==3.4.0b1
      depend on mcp>=1.24.0,<2.0, we can conclude that
      fastmcp>=3.0.0,<=3.4.0b1 depends on mcp>=1.24.0,<2.0. (5)

      Because fastmcp-slim[client]>=3.4.0,<=3.4.5 depends on mcp>=1.24.0,<2.0
      and fastmcp==3.4.0 depends on fastmcp-slim[client]==3.4.0, we can
      conclude that fastmcp==3.4.0 depends on mcp>=1.24.0,<2.0.
      And because we know from (5) that fastmcp>=3.0.0,<=3.4.0b1 depends on
      mcp>=1.24.0,<2.0, we can conclude that fastmcp>=3.0.0,<=3.4.0 depends on
      mcp>=1.24.0,<2.0. (6)

      Because fastmcp-slim[client]>=3.4.1,<=3.4.5 depends on mcp>=1.24.0,<2.0
      and fastmcp==3.4.1 depends on fastmcp-slim[client]==3.4.1, we can
      conclude that fastmcp==3.4.1 depends on mcp>=1.24.0,<2.0.
      And because we know from (6) that fastmcp>=3.0.0,<=3.4.0 depends on
      mcp>=1.24.0,<2.0, we can conclude that fastmcp>=3.0.0,<=3.4.1 depends on
      mcp>=1.24.0,<2.0. (7)

      Because fastmcp-slim[client]>=3.4.2,<=3.4.5 depends on mcp>=1.24.0,<2.0
      and fastmcp==3.4.2 depends on fastmcp-slim[client]==3.4.2, we can
      conclude that fastmcp==3.4.2 depends on mcp>=1.24.0,<2.0.
      And because we know from (7) that fastmcp>=3.0.0,<=3.4.1 depends on
      mcp>=1.24.0,<2.0, we can conclude that fastmcp>=3.0.0,<=3.4.2 depends on
      mcp>=1.24.0,<2.0. (8)

      Because fastmcp-slim[client]>=3.4.3,<=3.4.5 depends on mcp>=1.24.0,<2.0
      and fastmcp==3.4.3 depends on fastmcp-slim[client]==3.4.3, we can
      conclude that fastmcp==3.4.3 depends on mcp>=1.24.0,<2.0.
      And because we know from (8) that fastmcp>=3.0.0,<=3.4.2 depends on
      mcp>=1.24.0,<2.0, we can conclude that fastmcp>=3.0.0,<=3.4.3 depends on
      mcp>=1.24.0,<2.0. (9)

      Because fastmcp-slim[client]>=3.4.4,<=3.4.5 depends on mcp>=1.24.0,<2.0
      and fastmcp==3.4.4 depends on fastmcp-slim[client]==3.4.4, we can
      conclude that fastmcp==3.4.4 depends on mcp>=1.24.0,<2.0.
      And because we know from (9) that fastmcp>=3.0.0,<=3.4.3 depends on
      mcp>=1.24.0,<2.0, we can conclude that fastmcp>=3.0.0,<=3.4.4 depends on
      mcp>=1.24.0,<2.0. (10)

      Because fastmcp-slim[client]==3.4.5 depends on mcp>=1.24.0,<2.0 and
      fastmcp==3.4.5 depends on fastmcp-slim[client]==3.4.5, we can conclude
      that fastmcp==3.4.5 depends on mcp>=1.24.0,<2.0.
      And because we know from (10) that fastmcp>=3.0.0,<=3.4.4 depends on
      mcp>=1.24.0,<2.0, we can conclude that fastmcp>=3.0.0,<=3.4.5 depends
      on mcp>=1.24.0,<2.0.
      And because your project depends on fastmcp>=3.0.0,<4.0.0 and
      mcp>=2.0.0,<2.1.0, we can conclude that your project's requirements
      are unsatisfiable.

hint: The resolution failed for an environment that is not the current one, consider limiting the environments with `tool.uv.environments`.