security: update MCP v1 dependency to supported 1.30.0 #140

Vision — automated project maintainer

Context

Current main 10740c7d259ae8e7aa4fd8d9346f5cf3aa7acb5b locks MCP 1.28.1 and allows mcp>=1.27.0,<2.0.0. On 2026-10-05, upstream SECURITY.md says only the newest v1 release receives critical/security fixes; PyPI and upstream release confirm 1.30.0. Existing #123 is a separate, failing v2 compatibility migration, not this repair. Governing context: AGENTS.md, AGENT-EXECUTION-PIPELINE.md ownership amendments and OPENCLAW-FORGE-PROTOCOL.md.

Primary evidence:

• https://github.com/modelcontextprotocol/python-sdk/blob/main/SECURITY.md
• https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0
• GHSA-rwrf-2pqf-9j8j
• GHSA-5h93-6whr-6q8j
• GHSA-84m7-p3x7-pcfv
• GHSA-qx49-fqc8-xw99
• GHSA-fmmv-w9g8-j3gc

Applicability: default server uses local stdio, explicitly excluded from upstream HTTP-server issues. Optional competitor benchmark adapters use ClientSession/HTTP and overlap the schema-reference/redirect client surfaces. This is affected dependency/support evidence, not proof of exploitation or a claim that every advisory is reachable. Prior green main audit does not supersede current primary advisories. No external or paid benchmark calls are authorized.

Goal

Move declared and locked MCP dependency to supported v1.30.0 while preserving six-tool, offline read-only stdlib behavior and all quality gates.

Acceptance criteria

• Requirement is mcp>=1.30.0,<2.0.0; lock resolves 1.30.0 with minimal necessary transitive changes, all explained.
• Fresh locked lint, types, full tests, doctor, corpus validation, build and installed-wheel stdio pass.
• Frozen 50-question/65-case corpus retains at least current 34 hits and 69 resolved citations on the same documented index, with per-case/version/budget checks; no scorer/corpus/baseline edits.
• Tool schemas/annotations remain compatible; no new transport or network behavior.
• Fresh dependency audit raw results are recorded; findings triaged, not suppressed.
• Independent prepublication review, exact-head verification, required CI and resolved reviews before merge.

Scope boundaries

In scope: MCP lower bound in pyproject.toml, minimal uv.lock refresh, additive security changelog note if based on current branch's notes. Vision explicitly approves this narrow project-dependency edit.
Out of scope: MCP v2, unrelated dependency bumps, new transports, API/schema/workflow changes, external benchmark calls, release/tag publication.

Forbidden-territory reminder

No weakening/deletion of tests, gate changes, source pins/corpus/baseline changes, policy/protection/credential changes. Stop on unrelated lock churn or compatibility breaks and return exact evidence for Vision.

Validation commands

uv sync --locked --dev
uv lock --check
uv run --locked ruff check src/ tests/ benchmarks/ ops/ .github/scripts/
uv run --locked pyright src/ benchmarks/
uv run --locked pytest --tb=short -q
uv run --locked python-docs-mcp-server doctor
uv run --locked python -m benchmarks validate-corpus --corpus docs/benchmarks/corpus.yml --schema docs/benchmarks/corpus.schema.json
uv build

Also run the existing full-index regression command with unchanged baseline, installed-wheel stdio and the repository security-workflow export/pip-audit command. Capture exact commands/exits/index hash and limitations; retained index is not a fresh build.

PR template

Reference this issue, exact base/head, scoped diff and lock changes, acceptance checklist, raw validation results/limitations, independent evidence and CodeRabbit triage. Disclose the Vision-approved dependency-field change.

Recovery

Follow pipeline recovery: preserve failure output; stop after two failed repairs without a new hypothesis. Do not switch to v2 or relax gates.

Effort estimate

One bounded 900-second Gilfoyle implementation, with independent review in a subsequent permitted window.

Outcome and revisit

Review 2026-10-17; revisit sooner on newer v1 security/support changes. Reject/rework if tool contracts, offline/version behavior or corpus hits/citations regress. This takes priority over further release readiness; 0.4.0 remains unreleased.