fix(deps): Avoid DOA-pin mcp below 2.0.0 ahead of upstream MCP v2 release

[shashi-stackone]

MCP v2

MCP Python SDK v2.0.0 ships 2026-07-28 alongside the new spec revision and is a breaking release. The mcp extra declared mcp>=1.3.0 with no upper bound, so every fresh pip install 'stackone-ai[mcp]' would have resolved to 2.0.0 and broken fetch_tools() on day one:
Python SDK will be DOA once the v2 ships for every fresh install.

Lockfile

uv.lock pinned 1.25.0, which protects CI and local development but not consumers a library's lockfile does not constrain downstream installs. The published constraint in pyproject.toml is what resolvers use.

Potential Breaking Changes with mcp V2

This change is to avoid DOA but there are few things might break that needs separate fix

Verified against mcp==2.0.0b1 locally. _fetch_mcp_tools (stackone_ai/toolset.py) has seven incompatibilities:

Break	Detail
mcp.types removed	Types moved to a separate mcp-types distribution
streamablehttp_client	Renamed to streamable_http_client
headers= kwarg removed	Auth must move to a caller-supplied httpx.AsyncClient
Transport return shape	Yields a 2-tuple; the session-id getter is gone (sessions removed from the protocol)
list_tools(cursor)	Now keyword-only: params=PaginatedRequestParams(cursor=...)
tool.inputSchema	Renamed tool.input_schema
result.nextCursor	Renamed result.next_cursor

The first two raise ImportError, which the existing handler converts to:

ToolsetConfigError: MCP dependencies are required for fetch_tools. Install with 'pip install "stackone-ai[mcp]"'.

So affected users would be told to install a package they already have, a misleading error on top of a hard failure.

Upstream explicitly recommends this bound for library maintainers (SDK beta announcement).

Notes

• The 19 fixture errors are caused by vendor/stackone-ai-node/node_modules being absent, so tests/mocks/serve.ts can't start. Tracked separately

---

Summary by cubic

Pin the mcp extra to <2.0.0 to avoid breaking changes from the MCP Python SDK v2 and prevent fresh installs of stackone-ai[mcp] from failing. Updates pyproject.toml and uv.lock to enforce the bound until v2 support is added.

^{Written for commit ec5e9d9. Summary will update on new commits.}

[Copilot]

Pull request overview

Adds an upper bound to the mcp extra dependency to prevent downstream installs of stackone-ai[mcp] from automatically resolving to the breaking mcp Python SDK v2.x when it releases, avoiding day-one failures for consumers.

Changes:

• Constrain the mcp optional dependency to >=1.3.0,<2.0.0 for the published package metadata.
• Align the lockfile metadata to reflect the same constrained specifier.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pyproject.toml	Adds an upper bound (<2.0.0) to the mcp optional dependency to protect downstream resolvers.
uv.lock	Updates the recorded requires-dist entry for the mcp extra to match the new constraint.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

No issues found across 2 files

<sub>Auto-approved: Pins mcp dependency to <2.0.0 to prevent breaking changes from the upcoming v2 release. This is a bounded, clearly beneficial constraint that does not expand exposure or alter behavior beyond version restriction.

Re-trigger cubic</sub>