fix(python): require mcp>=1.29.0,<2 in fetch, git, and time - #4663
Merged
olaservo merged 2 commits intoAug 18, 2026
Conversation
mcp 2.0.0 renamed McpError to MCPError and replaced the low-level Server decorators with constructor handlers. The three servers had no upper bound, so a fresh uvx install has resolved 2.0.0 since 2026-07-28 and failed to start: fetch and time raise ImportError on the McpError import, git raises AttributeError on server.list_tools(). The floor moves to 1.29.0, the last 1.x release. The previous floors (1.0.0 for git, 1.1.3 for fetch, 1.23.0 for time) resolved versions affected by GHSA-vj7q-gjh5-988w, GHSA-jpw9-pfvf-9f58, and GHSA-hvrp-rf83-w775. Porting to the v2 SDK is tracked separately. Closes modelcontextprotocol#4560 Closes modelcontextprotocol#4570 Closes modelcontextprotocol#4580 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Caps Python MCP SDK dependencies to the compatible, security-patched 1.x release line.
Changes:
- Require
mcp>=1.29.0,<2for fetch, git, and time servers. - Regenerate each server’s lockfile with MCP 1.29.0.
Reviewed changes
Copilot reviewed 3 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
src/fetch/pyproject.toml |
Adds the MCP version bounds. |
src/fetch/uv.lock |
Locks MCP 1.29.0. |
src/git/pyproject.toml |
Adds the MCP version bounds. |
src/git/uv.lock |
Locks MCP 1.29.0. |
src/time/pyproject.toml |
Adds the MCP version bounds. |
src/time/uv.lock |
Locks MCP 1.29.0. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Users hitting the 2.0.0 startup failure land on the README first. Also makes the three packages qualify for the next release: the release workflow selects packages by .py/.ts/.md changes, so a dependency-only fix would merge without publishing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Member
Author
|
Added a README line to each of the three servers noting the |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 9 changed files in this pull request and generated no new comments.
Suppressed comments (1)
src/git/README.md:11
- This explanation is inaccurate for the git server: its v2 startup failure is caused by removal of the low-level
Server.list_tools/call_tooldecorator API, not an API rename. Please describe the removed decorators so users understand why a rename-only workaround cannot restore compatibility.
Requires MCP Python SDK 1.x (`mcp>=1.29.0,<2`). SDK 2.0 renamed APIs this server uses. The port to v2 is in progress.
This was referenced Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
mcp2.0.0 shipped on 2026-07-28 and became whatpip install mcp/uv add mcpresolves. It renamedMcpErrortoMCPErrorand replaced the low-levelServerdecorators with constructor handlers. All three Python servers declaredmcpwith no upper bound, so every freshuvxinstall since then has resolved 2.0.0 and failed to start:mcp-server-fetch:ImportError: cannot import name 'McpError' from 'mcp.shared.exceptions'mcp-server-time: sameImportErrormcp-server-git:AttributeError: 'Server' object has no attribute 'list_tools'This caps
mcpbelow 2 and raises the floor to 1.29.0, the last 1.x release. The previous floors (>=1.0.0for git,>=1.1.3for fetch,>=1.23.0for time) allowed resolutions affected by GHSA-vj7q-gjh5-988w, GHSA-jpw9-pfvf-9f58, and GHSA-hvrp-rf83-w775.Porting the servers to the v2 SDK is separate work — this is the unbreak.
Server Details
pyproject.toml,uv.lock)Motivation and Context
Closes #4560, closes #4570, closes #4580. Also reported in #4600 and #4635.
Supersedes #4563, #4572, #4577, #4611, #4645, #4657, which propose the same cap without the floor bump, and #4650, which raises the floor to 1.23.0 without capping.
How Has This Been Tested?
uv sync --frozen --all-extras --dev+uv run pytest+uv run pyrightfor all three servers. fetch 20 passed, time 38 passed, git 43 passed (git's 37 teardown errors are a pre-existing Windows-onlyPermissionErrorinshutil.rmtreeof the temp repo, unrelated to this change).initialize+tools/listboth answer correctly for fetch and time.mcp==2.0.0against the current pins and reproducing each of the three startup errors above.Breaking Changes
None for users on
mcp1.x. Anyone who pinnedmcp>=2alongside these servers had a broken install already.Types of changes
Checklist