diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
index 78c651a..dfdccb1 100644
--- a/packages/mcp/CHANGELOG.md
+++ b/packages/mcp/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 2.3.5-keycardai-mcp (2026-10-22)
+
+
+- fix(keycardai-mcp): require mcp 2.2.0 and refresh vulnerable lockfile entries (#369)
+- Raises the published floors for GHSA-84m7-p3x7-pcfv (keycardai-mcp: mcp>=2.2.0,<3.0) and GHSA-fvww-7h3r-vfhp (keycardai-langchain serve and test extras: langgraph-sdk>=0.4.4). Moves PyJWT, anyio and certifi to patched versions in every uv.lock. keycardai-langchain releases through a separate patch bump. Supersedes #356 to #365 and #368.
+
 ## 2.3.4-keycardai-mcp (2026-10-15)
 
 
diff --git a/packages/mcp/pyproject.toml b/packages/mcp/pyproject.toml
index 4e01798..3e69573 100644
--- a/packages/mcp/pyproject.toml
+++ b/packages/mcp/pyproject.toml
@@ -142,7 +142,7 @@ filterwarnings = [
 
 [tool.commitizen]
 name = "cz_customize"
-version = "2.3.4"
+version = "2.3.5"
 tag_format = "${version}-keycardai-mcp"
 # Ignores sibling packages' tags only; it must not match this package's own tag, because commitizen applies ignored formats before tag_format.
 ignored_tag_formats = ["${version}-keycardai-(?!mcp$).*"]