diff --git a/pyproject.toml b/pyproject.toml
index 5a05157..48cf3ea 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -53,7 +53,7 @@ dependencies = [
     "textual>=0.50.0",
     "pydantic>=2.10.0",
     # <2.0: mcp 2.0.0 removes mcp.server.fastmcp, which aegis_memory/mcp_server.py is built on.
-    "mcp>=1.6.0,<2.0",
+    "mcp>=1.6.0,<3.0",
     # Transitive security floors (OpenSSF Scorecard / OSV) — pulled in transitively
     # (idna<-httpx, pygments<-rich); loose upstream bounds otherwise let known-vulnerable
     # versions resolve. Pinned to the first patched release of each advisory.